• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login

    FOG Server : Certificate validation failed

    Scheduled Pinned Locked Moved Unsolved FOG Problems
    5 Posts 2 Posters 61 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fgaudin
      last edited by

      Hello,
      Just moved my FOG-server to version 1.5.10.2482 on Debian 13.5

      used “./installfog.sh -y -C”

      During installation/update the process was uncapable to generate new certificates , giving this kind of error-message “Cannot read Secure Boot signing file: /opt/fog/pki/secureboot/leaf/sign.key”

      The Google’s IA showed me a way to generate manually those certificates

      But now, the computer-stations still cannot communicate well with the server

      Middleware::Communication Download: http://fogserver/fog/management/other/ssl/srvpublic.crt
      Data::RSA FOG Server CA cert found
      Data::RSA ERROR: Certificate validation failed
      Data::RSA ERROR: Trust chain did not complete to the known authority anchor. Thumbprints did not match.
      Middleware::Authentication ERROR: Could not authenticate
      Middleware::Athentication ERROR: Certificate is not from FOG CA

      Also I noticed that folder /var/www/fog/management/other/ssl/ does not contain the file srvpublic.crt although downloading of that file works. Is it a redirection inside Apache configuration ?

      Should I completely destroy my server and build a new one to fix the problem ? Already spent many hours vannishing trying to fix it by myself.

      Tom ElliottT 1 Reply Last reply Reply Quote 0
      • Tom ElliottT
        Tom Elliott @fgaudin
        last edited by

        @fgaudin Do not rebuild the server. The -C flag caused this, and you can recover from it.

        -C means --recreate-CA. It deletes the FOG root CA and makes a new one. It also deletes the Secure Boot keys under /opt/fog/pki/secureboot. Each FOG Client stored the old CA when it was installed. The new server certificate is signed by a different CA, so the client says “Certificate is not from FOG CA”. This is expected after -C.

        Do these steps:

        1. Remove the certificates that you made by hand. They are not part of the FOG chain, and they add a second problem.
        2. Run the installer again without -C: ./installfog.sh -y. The installer makes the missing pieces from the new CA.
        3. On each Windows client, open certlm.msc. Go to Trusted Root Certification Authorities > Certificates. Delete “FOG Server CA”. Restart the FOGService. The client then gets the new CA from the server. If that does not work, reinstall the FOG Client on that computer.

        About srvpublic.crt: Apache does not redirect it. On Debian the web files are in /var/www/html/fog/. Look in /var/www/html/fog/management/other/ssl/.

        If step 2 shows “Cannot read Secure Boot signing file” again, post the full installer command and the log from bin/error_logs/ in your fogproject folder.

        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

        1 Reply Last reply Reply Quote 0
        • F
          fgaudin
          last edited by

          Thanks for your help,

          So

          • I restarted the installation ./installfog.sh -y
          • restarted the server after that
          • desinstalled the FOGclient
          • checked in certlm.msc (no more fog certificate)
          • re-installed the FOG client
          • manually downloaded “servpublic.crt” to check it : date from 21 may 2026 to 18 may 2036 (is the starting date normal ???)
          • started the Fog client

          still errors in fog.log.
          RSA ERROR: Certificate validation failed
          …
          Authentication error : certificatate is not from FOG CA

          Should I destroy the host in the web-console ?

          Tom ElliottT 1 Reply Last reply Reply Quote 0
          • Tom ElliottT
            Tom Elliott @fgaudin
            last edited by Tom Elliott

            @fgaudin Do not delete the host. The dates on srvpublic.crt show the problem.

            That certificate started on 21 May 2026. That is the date of your first install, so the installer did not issue it again. The root CA is new, but srvpublic.crt is still signed by the old root. The client checks it against the new root, and the check fails.

            Do these steps on the server:

            1. Run this check. It shows the mismatch:
              openssl verify -CAfile /var/www/html/fog/management/other/ca.cert.pem /var/www/html/fog/management/other/ssl/srvpublic.crt
            2. Run the installer with -K (--recreate-keys) : ./installfog.sh -y -K. This issues a new srvpublic.crt from the current root. It does not change the root CA.
            3. Run the check from step 1 again. It must say OK.

            On the client, restart the FOGService. You do not need to reinstall it again, because the client already has the current root.

            If step 2 fails, or step 3 does not say OK, post the output and the newest log from bin/error_logs/.

            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

            Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

            Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

            F 1 Reply Last reply Reply Quote 0
            • F
              fgaudin @Tom Elliott
              last edited by

              @Tom-Elliott
              Thanks for your helpful support, Tom.

              running “openssl verify” gives me some errors in return

              1rst line : CN=an old ip address X.Y.Z.87 that I was using as a transition few monthes ago
              2nd line : error 20 atcd erro 0 depth lookup: unable to get local issuer certificate
              3rd line : error /var/www/html/fog/management/other/ssl/srvpublic.crt: verification failed

              I can find this ip-address twice in the file /opt/fog/snapins/ssl/req.cnf~ (which is dated May 21)
              But the the file /opt/fog/snapins/ssl/req.cnf is OK (with the right ip address) (dated today)l

              So I guess one (the only ??? not sure) reason of the problem is because

              • the new ip of my server is not completely taken in account
              • or the process fails to replace an old certificate file (access rights problem ?)

              I deleted many files (including hidden files like .fogCA.key and .fogCA.pem for example) about certificates

              I restarted ./installfog -y -K
              Still the verifying process gives me the old ip-address in return

              Removing the installation folder.
              Re-creating the installation folder (from .tar file)
              starting again ./installfog.sh -y -K
              checking again…
              still old ip-address in the certificates , still exactly the same error-messages

              Some parts of file “fog_error_1.5.10.2482.log”
              Could not open file or uri for loading certificate from /opt/fog/pki/secureboot/ca/.fogSBCA.pem: No such file or directory
              …
              /usr/sbin/update-ca-certificates
              Updating certificates in /etc/ssl/certs…
              0 added, 0 removed; done.
              Running hooks in /etc/ca-certificates/update.d…
              done.

              some parts of file “foginstall.log”
              210: * Installing Secure Boot signing helper…/lib/common/functions.sh: ligne 6134: /etc/sudoers.d/fog-secureboot.tmp: Aucun fichier ou dossier de ce nom
              211: * Failed
              215: * Could not read /opt/fog/pki/secureboot/ca/.fogSBCA.pem as a certificate.
              220: * Publishing client communication certificate…OK
              221: * Creating auth pub key and cert…OK
              258: # intermediate, or a certificate for a new storage node. #

              folder “/opt/fog/pki/secureboot/ca” does not exist (folder “leaf” exists in that location)
              –> creating it manually
              restarting ./installfog.sh -y -K
              folder …/ca/ remains empty

              Where could it find that old IP-address X.Y.Z.87 from ?

              1 Reply Last reply Reply Quote 0
              • 1 / 1
              • First post
                Last post

              78

              Online

              12.8k

              Users

              17.7k

              Topics

              157.3k

              Posts
              Copyright © 2012-2026 FOG Project