• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login

    Fog client installation error - Cannot install CA certificate

    Scheduled Pinned Locked Moved
    FOG Problems
    6
    43
    6.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jonhwood360 @Sebastian Roth
      last edited by

      @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

      @jonhwood360 Didn’t expect it to bail out that early. So it doesn’t even get to where I expected it to fail (SSL/TLS cert validity check).

      Could you please try installing the fog-client on a system that is not in audit mode? Just want to make sure this has no effect.

      NonAuditModePCInstall.png

      The other thing we might take a look at is a network packet capture.

      Here is the packet capture:
      https://drive.google.com/file/d/1KM4WAsPPF43tVDomDUuR_HOEU_4bZ6oB/view?usp=sharing

      J 1 Reply Last reply Reply Quote 0
      • J
        jonhwood360 @jonhwood360
        last edited by

        @jonhwood360
        fog apache config

        fogapacheconf.png

        1 Reply Last reply Reply Quote 0
        • S
          Sebastian Roth Moderator
          last edited by

          @jonhwood360 The PCAP looks like the host sends a TLS Client Hello using TLS 1.0 and the Apache server rejects it. Have you disabled newer TLS versions via GPO by any chance??

          Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

          Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

          J 1 Reply Last reply Reply Quote 0
          • J
            jonhwood360 @Sebastian Roth
            last edited by

            @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

            @jonhwood360 The PCAP looks like the host sends a TLS Client Hello using TLS 1.0 and the Apache server rejects it. Have you disabled newer TLS versions via GPO by any chance??

            No, no GPOs are applied. The apache server is on ubuntu. I can try to force enable newer TLS versions on the workstations. Is ver 1.2 sufficient?

            J 1 Reply Last reply Reply Quote 0
            • J
              jonhwood360 @jonhwood360
              last edited by

              @jonhwood360 said in Fog client installation error - Cannot install CA certificate:

              @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

              @jonhwood360 The PCAP looks like the host sends a TLS Client Hello using TLS 1.0 and the Apache server rejects it. Have you disabled newer TLS versions via GPO by any chance??

              No, no GPOs are applied. The apache server is on ubuntu. I can try to force enable newer TLS versions on the workstations. Is ver 1.2 sufficient?

              @sebastian-roth,

              I reattempted install after hard enabling tls 1.1 and 1.2 in the registry of the machine. No change.

              tlsversions.jpg

              I also took another pcap: https://drive.google.com/file/d/19u1RKug2OwFOHC4S_l0bDT1uK7bbhR0I/view?usp=sharing

              J 1 Reply Last reply Reply Quote 0
              • J
                jonhwood360 @jonhwood360
                last edited by jonhwood360

                @Sebastian-Roth

                PCAP from workstation as well - https://drive.google.com/file/d/1y-lML_qrJ18nv3T7HQ3zsW9M9vUD3NOU/view?usp=sharing

                1 Reply Last reply Reply Quote 0
                • S
                  Sebastian Roth Moderator
                  last edited by

                  @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

                  The PCAP looks like the host sends a TLS Client Hello using TLS 1.0 and the Apache server rejects it. Have you disabled newer TLS versions via GPO by any chance??

                  Sorry, I wrote this without having had the time to test this on my side. I just found the time to do capture a PCAP in my test setup and it seems to use TLS 1.0 as well. Reading more about this on the we I found that it still seems to be the default in .NET framework 4.5.x which we use since fog-client version 0.12.0 (before we still used .NET 4.0, OMG).

                  Ok that explains why we both see TLS 1.0 in the PCAP but to it’s still a riddle why your Apache server rejects the request while mine doesn’t. Plus we haven’t heard from other users so far. Maybe this Ubuntu moved to some newer versions of Apache (and maybe openssl) not long ago that now reject TLS 1.0 completely.

                  I will try to force using of TLS 1.1 and newer in our code and upload a new installer for you to test soon.

                  Thanks a lot for working on this with me! While at first I thought this is not a general issue it seems to actually be and you are the first one to report it.

                  Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                  Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                  1 Reply Last reply Reply Quote 0
                  • S
                    Sebastian Roth Moderator
                    last edited by

                    @jonhwood360 Ok, here you go for another try: https://github.com/FOGProject/fog-client/releases/download/0.12.0/FOGService_enable_TLS12.msi

                    See if it can successfully pin to the FOG server with that and post a picture of the FOGService.install log as well.

                    Keep in mind, this is not for official deployment for various reasons.

                    Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                    Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      jonhwood360 @Sebastian Roth
                      last edited by

                      @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

                      @jonhwood360 Ok, here you go for another try: https://github.com/FOGProject/fog-client/releases/download/0.12.0/FOGService_enable_TLS12.msi

                      See if it can successfully pin to the FOG server with that and post a picture of the FOGService.install log as well.

                      Keep in mind, this is not for official deployment for various reasons.

                      We have a winner!

                      tls2success.png

                      So it seems that newer apache does not like the 1.0 connections.

                      A 1 Reply Last reply Reply Quote 1
                      • S
                        Sebastian Roth Moderator
                        last edited by Sebastian Roth

                        @jonhwood360 said in Fog client installation error - Cannot install CA certificate:

                        We have a winner!
                        So it seems that newer apache does not like the 1.0 connections.

                        Great! Thanks again for testing. I will need to dig through the code and see If there is more adjustment needed (other places in the code needing that fix as well). Allow me a few days and I will release a new 0.12.1 including that fix.

                        Can you post the latest FOGService.install log as well?

                        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          jonhwood360 @Sebastian Roth
                          last edited by

                          @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

                          @jonhwood360 said in Fog client installation error - Cannot install CA certificate:

                          We have a winner!
                          So it seems that newer apache does not like the 1.0 connections.

                          Great! Thanks again for testing. I will need to dig through the code and see If there is more adjustment needed (other places in the code needing that fix as well). Allow me a few days and I will release a new 0.12.1 including that fix.

                          Can you post the latest FOGService.install log as well?

                          As requested:
                          InstallLogSuccess.png

                          1 Reply Last reply Reply Quote 0
                          • S
                            Sebastian Roth Moderator
                            last edited by

                            @jonhwood360 Thanks! I didn’t get to it over the weekend but hopefully will this upcoming week.

                            Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                            Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                            J 1 Reply Last reply Reply Quote 1
                            • J
                              jonhwood360 @Sebastian Roth
                              last edited by

                              @sebastian-roth

                              I look forward to it!

                              1 Reply Last reply Reply Quote 0
                              • A
                                AndreSilva @jonhwood360
                                last edited by

                                @jonhwood360 Thank’s for help!

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Sebastian Roth Moderator
                                  last edited by Sebastian Roth

                                  @jonhwood360 Ok, found the time to properly get this fixed in the code. As there are other things I need to work on before a next official release I decided to build and sign fixed installer binaries for you still as version 0.12.0.

                                  Find FOGService_fixed-tls.msi and SmartInstaller_fixed-tls.exe on https://github.com/FOGProject/fog-client/releases/tag/0.12.0

                                  As mentioned the binaries are signed so auto updating to the next future release will work seamlessly.

                                  Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                                  Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                                  J 1 Reply Last reply Reply Quote 0
                                  • J
                                    jonhwood360 @Sebastian Roth
                                    last edited by

                                    @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

                                    he next future release will work seamlessly.

                                    Is there a specific place on the fog server I should place these, or just manually distribute them to endpoint clients?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Sebastian Roth Moderator
                                      last edited by

                                      @jonhwood360 With this one your need to manually distribute it to the hosts or use some other way of distributed install. The next version will then auto update.

                                      I would suggest you test this on one of your machines - just to make sure I didn’t miss anything. After installation you want to keep an eye on the fog-client log (C:\fog.log by default) to see if communication works all fine. Then go ahead and install to the other machines.

                                      Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                                      Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                                      J 1 Reply Last reply Reply Quote 0
                                      • J
                                        jonhwood360 @Sebastian Roth
                                        last edited by

                                        @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

                                        @jonhwood360 With this one your need to manually distribute it to the hosts or use some other way of distributed install. The next version will then auto update.

                                        I would suggest you test this on one of your machines - just to make sure I didn’t miss anything. After installation you want to keep an eye on the fog-client log (C:\fog.log by default) to see if communication works all fine. Then go ahead and install to the other machines.

                                        Got it. Install worked fine. Is the superwebsocket defined in the fogservice.exe.config supposed to listen on localhost?

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          Sebastian Roth Moderator
                                          last edited by

                                          @jonhwood360 said in Fog client installation error - Cannot install CA certificate:

                                          Got it. Install worked fine. Is the superwebsocket defined in the fogservice.exe.config supposed to listen on localhost?

                                          Ok, fine. Communication also working I suppose?

                                          Yes the SuperWebSocket stuff is only used for inter process communication.

                                          Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                                          Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                                          J 1 Reply Last reply Reply Quote 0
                                          • J
                                            jonhwood360 @Sebastian Roth
                                            last edited by

                                            @sebastian-roth said in Fog client installation error - Cannot install CA certificate:

                                            @jonhwood360 said in Fog client installation error - Cannot install CA certificate:

                                            Got it. Install worked fine. Is the superwebsocket defined in the fogservice.exe.config supposed to listen on localhost?

                                            Ok, fine. Communication also working I suppose?

                                            Yes the SuperWebSocket stuff is only used for inter process communication.

                                            Yes communication is working.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 2 / 3
                                            • First post
                                              Last post

                                            256

                                            Online

                                            11.6k

                                            Users

                                            17.1k

                                            Topics

                                            154.6k

                                            Posts
                                            Copyright © 2012-2024 FOG Project