Setting up trusted SSL certificate

[Malte Will]

I was tasked with setting up a FOG server in our companies installation network.
I installed FOG 1.5.7 on a ubuntu server 18.04 vm located on our local ESXi server.
I used the -S option to enforce https on the web-interface.
Now I am trying to use our companies internal trusted wildcard-certificate.
I tried modifying the apache2 site configuration located at /etc/apache2/sites-enabled/001-fog.conf.
When I change the paths of the ssl certificate files I am no longer able to boot over PXE.
Trying to boot over PXE I get following error:
https://<fogserverip>/fog/service/ipxe/boot.php… No such file or directory (http://ipxe.org/2d0c618e)

I am thinking I need to change the certificate path in another file, too.
If this is true, what file do I need to manipulate?

[Sebastian Roth]

@Malte-Will said in Setting up trusted SSL certificate:

I am thinking I need to change the certificate path in another file, too.
If this is true, what file do I need to manipulate?

The certificate will need to be compiled into the iPXE binaries. You can do this by running the following commands:

cd /path/to/source/of/fogproject/code/utils/FOGiPXE
./buildipxe.sh /path/to/your/wildcard/certificate.pem
rsync -av /path/to/source/of/fogproject/code/tftp/ /tftpboot/

Please be aware that there is an issue with certificates from some certificate authorities: https://forums.fogproject.org/topic/12768/not-able-to-tftp-boot-invalid-argument-error

[Malte Will]

This post is deleted!

[Malte Will]

This post is deleted!

[Malte Will]

@Sebastian-Roth
I found the tftp directory you specified in the rsync command in the packages folder in the fogproject code directory.

After executing the commands I am still stuck with the same problem.

[Sebastian Roth]

@Malte-Will said in Setting up trusted SSL certificate:

After executing the commands I am still stuck with the same problem.

What was the output of the second command?? Any errors??

[Malte Will]

@Sebastian-Roth
I got no error messages by executing the commands.
This is the output of the buildscript: output.txt
This is the output from rsync: rsync-out.txt
Am I missing anything.

[Sebastian Roth]

@Malte-Will Hmmm, my fault, sorry!!

The command ./buildipxe.sh /path/to/your/wildcard/certificate.pem should have been ./buildipxe.sh /path/to/the/CA/cert/of/your/wildcard/certificate.pem

What that means is, you need to compile iPXE with the certificate authority’s (CA) certificate included that was used to sign your wildcard cert. If you don’t know what that means you might want to tell us more about where you got the certificate from

One more thing I missed to tell you. In case you want to use the fog-client software as well you will run into issues with your custom certificate. If you need to know more about this, I can give you the details.

[Malte Will]

@Sebastian-Roth
I tried compiling iPXE with our CAs certificate but still got the same result.
We got two certificates in the cert-file, is that a problem?

[Sebastian Roth]

@Malte-Will From what I see I think you should use the Intermediate #2 certificate found here: https://support.comodo.com/index.php?/Knowledgebase/Article/View/978/108/organization-validation-sha-2
(direct link)

[Malte Will]

@Sebastian-Roth
I solved the problem. In the end, the last thing i forgot was to change the ip of the fog server to the fqdn in the ipxe file.
We also needed to set the WEB HOST setting in the FOG Configuration to the FQDN.
I checked the certificates you send with the ones we have and verified that they are identical.

Thanks for your help!

[symrex]

@Malte-Will said in Setting up trusted SSL certificate:

@Sebastian-Roth
I solved the problem. In the end, the last thing i forgot was to change the ip of the fog server to the fqdn in the ipxe file.

Could you please explain in more detail, which ipxe file do you mean?
/opt/fog/.fogsettings first line?
ipaddress=…

We also needed to set the WEB HOST setting in the FOG Configuration to the FQDN.

Done.

My problem is that after my CA was changed and ipxe was rebuild; iPXE still trying to connect to the bare IP not to the FQDN.

[cul3r0]

@sebastian-roth said in Setting up trusted SSL certificate:

One more thing I missed to tell you. In case you want to use the fog-client software as well you will run into issues with your custom certificate. If you need to know more about this, I can give you the details.

i’d love to know more details about this. Thank you.