• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login

    FOG Server : Certificate validation failed

    Scheduled Pinned Locked Moved Solved FOG Problems
    12 Posts 2 Posters 99 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fgaudin
      last edited by

      Thanks for your help,

      So

      • I restarted the installation ./installfog.sh -y
      • restarted the server after that
      • desinstalled the FOGclient
      • checked in certlm.msc (no more fog certificate)
      • re-installed the FOG client
      • manually downloaded “servpublic.crt” to check it : date from 21 may 2026 to 18 may 2036 (is the starting date normal ???)
      • started the Fog client

      still errors in fog.log.
      RSA ERROR: Certificate validation failed
      …
      Authentication error : certificatate is not from FOG CA

      Should I destroy the host in the web-console ?

      Tom ElliottT 1 Reply Last reply Reply Quote 0
      • Tom ElliottT
        Tom Elliott @fgaudin
        last edited by Tom Elliott

        @fgaudin Do not delete the host. The dates on srvpublic.crt show the problem.

        That certificate started on 21 May 2026. That is the date of your first install, so the installer did not issue it again. The root CA is new, but srvpublic.crt is still signed by the old root. The client checks it against the new root, and the check fails.

        Do these steps on the server:

        1. Run this check. It shows the mismatch:
          openssl verify -CAfile /var/www/html/fog/management/other/ca.cert.pem /var/www/html/fog/management/other/ssl/srvpublic.crt
        2. Run the installer with -K (--recreate-keys) : ./installfog.sh -y -K. This issues a new srvpublic.crt from the current root. It does not change the root CA.
        3. Run the check from step 1 again. It must say OK.

        On the client, restart the FOGService. You do not need to reinstall it again, because the client already has the current root.

        If step 2 fails, or step 3 does not say OK, post the output and the newest log from bin/error_logs/.

        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

        F 1 Reply Last reply Reply Quote 0
        • F
          fgaudin @Tom Elliott
          last edited by

          @Tom-Elliott
          Thanks for your helpful support, Tom.

          running “openssl verify” gives me some errors in return

          1rst line : CN=an old ip address X.Y.Z.87 that I was using as a transition few monthes ago
          2nd line : error 20 atcd erro 0 depth lookup: unable to get local issuer certificate
          3rd line : error /var/www/html/fog/management/other/ssl/srvpublic.crt: verification failed

          I can find this ip-address twice in the file /opt/fog/snapins/ssl/req.cnf~ (which is dated May 21)
          But the the file /opt/fog/snapins/ssl/req.cnf is OK (with the right ip address) (dated today)l

          So I guess one (the only ??? not sure) reason of the problem is because

          • the new ip of my server is not completely taken in account
          • or the process fails to replace an old certificate file (access rights problem ?)

          I deleted many files (including hidden files like .fogCA.key and .fogCA.pem for example) about certificates

          I restarted ./installfog -y -K
          Still the verifying process gives me the old ip-address in return

          Removing the installation folder.
          Re-creating the installation folder (from .tar file)
          starting again ./installfog.sh -y -K
          checking again…
          still old ip-address in the certificates , still exactly the same error-messages

          Some parts of file “fog_error_1.5.10.2482.log”
          Could not open file or uri for loading certificate from /opt/fog/pki/secureboot/ca/.fogSBCA.pem: No such file or directory
          …
          /usr/sbin/update-ca-certificates
          Updating certificates in /etc/ssl/certs…
          0 added, 0 removed; done.
          Running hooks in /etc/ca-certificates/update.d…
          done.

          some parts of file “foginstall.log”
          210: * Installing Secure Boot signing helper…/lib/common/functions.sh: ligne 6134: /etc/sudoers.d/fog-secureboot.tmp: Aucun fichier ou dossier de ce nom
          211: * Failed
          215: * Could not read /opt/fog/pki/secureboot/ca/.fogSBCA.pem as a certificate.
          220: * Publishing client communication certificate…OK
          221: * Creating auth pub key and cert…OK
          258: # intermediate, or a certificate for a new storage node. #

          folder “/opt/fog/pki/secureboot/ca” does not exist (folder “leaf” exists in that location)
          –> creating it manually
          restarting ./installfog.sh -y -K
          folder …/ca/ remains empty

          Where could it find that old IP-address X.Y.Z.87 from ?

          Tom ElliottT 1 Reply Last reply Reply Quote 0
          • Tom ElliottT
            Tom Elliott @fgaudin
            last edited by

            @fgaudin Thanks, that output finds the cause. It is a bug in the 1.5.10.2482 installer.

            The old IP address comes from /opt/fog/snapins/ssl/.srvpublic.crt, not from req.cnf. That file is the source of the published srvpublic.crt. When the file exists, the installer keeps it, even with -K. So -K made a new key, but it published the old certificate again. That certificate has the old IP address and the old CA. It also does not match the new key. FOG 1.6.0 fixes this: it removes a certificate that does not match the key.

            The /etc/sudoers.d/fog-secureboot.tmp error has a second cause: sudo is not installed on your server, so /etc/sudoers.d does not exist.

            Do these steps on the server:

            1. Install sudo: apt install sudo
            2. Remove the old certificate: rm /opt/fog/snapins/ssl/.srvpublic.crt
            3. Run the installer without flags: ./installfog.sh -y
            4. Run the check again. It must say OK:
              openssl verify -CAfile /var/www/html/fog/management/other/ca.cert.pem /var/www/html/fog/management/other/ssl/srvpublic.crt

            You deleted .fogCA.key and .fogCA.pem, so the server has a new CA again. On each client, delete “FOG Server CA” in certlm.msc again, then restart the FOGService.

            If step 4 does not say OK, post its output and the Creating client communication certificate lines from foginstall.log.

            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

            Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

            Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

            F 1 Reply Last reply Reply Quote 0
            • F
              fgaudin @Tom Elliott
              last edited by

              @Tom-Elliott

              I’ve been tryin many things meanwhile. I found that debian native certificates were wrong because I started this server with another hostname and IP (to organize a transition with old server) .
              I made corrections to the fqdn-hostname and put the right new ip address in /etc/hosts.
              I rebuilt the native debian certificate (snakeoil). This debian certificate is now OK.

              After that I had some troubles to restart Apache, but I finally fixed it.

              I rebuilt the keys end certificates about FOG , after manually deleted ALL (I hope so…) of them.
              So the date of the files is actual : november 04.
              But the content is bad : old IP address and start-date on 21 May. in file /var/www/html/fog/management/other/ssl/srvpublic.crt

              the file …/snapins/ssl/.srvpublic.crt does NOT exist

              Now I found your recent answer about the hidden file.
              The IP address inside srvpublic.crt is fine. The starting and ending date of the certificate are fine (nov 04 2026 to nov 01 2036)

              I restarted apache2.

              Unfortunately, it still does not match on the client.

              • RSA ERROR: Certificate validation failed
              • RSA ERROR : Truste chain did not complete to the known authority anchor. Error : …(NotSignatureValid).
              • Authentication error : could not authenticate
              • Authentication error : certificate is not from FOG CA

              I will try do desintall/resintall the client.

              no better

              Tom ElliottT 1 Reply Last reply Reply Quote 0
              • Tom ElliottT
                Tom Elliott @fgaudin
                last edited by

                @fgaudin Good, the new srvpublic.crt is correct now. The server and the client now have different “FOG Server CA” certificates.

                NotSignatureValid means this: the client found a “FOG Server CA” certificate, but that certificate did not sign srvpublic.crt. You made several CAs during these runs. The client can still hold one of the old ones. It can also download from a different server: your clients use the name fogserver, and you had a transition server.

                Please post the results of these four checks.

                On the server:

                1. openssl verify -CAfile /var/www/html/fog/management/other/ca.cert.pem /var/www/html/fog/management/other/ssl/srvpublic.crt
                2. openssl x509 -in /var/www/html/fog/management/other/ca.cert.pem -noout -fingerprint -sha1

                On one client:

                1. nslookup fogserver. It must give the IP address of the new server.
                2. Open certlm.msc. Look in Trusted Root Certification Authorities and in Intermediate Certification Authorities. Count every “FOG Server CA” certificate. For each one, open Details and copy the Thumbprint.

                If the result of check 1 is OK and check 3 gives the new IP address, delete every “FOG Server CA” certificate from check 4. Then restart the FOGService. The client then downloads the current CA. Its thumbprint must be the same as the fingerprint from check 2.

                Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                F 1 Reply Last reply Reply Quote 0
                • F
                  fgaudin @Tom Elliott
                  last edited by

                  @Tom-Elliott

                  So the result of the check on server-side is :
                  CN=(good IP) , O=FOG Project, OU=FOG Client Communication
                  error 20 at 0 depth lookup: unable to get local issuer certificate
                  error /var/www/html/fog/management/other/ssl/srvpublic.crt: verification failed

                  sha1 Fingerprint=90:81:0E:51:53:A0:38:56:D8:37:A9:B8:C1:6F:6E:1C:B6:C8:35:CF

                  on client-side
                  nslookup : ip of the server is OK

                  certlm.msc :
                  FOG PROJECT CA date from 29 dec 2019 to 30 dec 2029
                  FOG SERVER CA date from 04 nov 2026 to 27 oct 2056 fingerprint is same as sha1 fingerprint of server-file ca.cert.pem (…c8 35 cf)

                  Tom ElliottT 1 Reply Last reply Reply Quote 0
                  • Tom ElliottT
                    Tom Elliott @fgaudin
                    last edited by

                    @fgaudin Thanks, that shows the cause. Your client is correct now. The problem is on the server.

                    The client trusts the current CA, ...C8:35:CF. But openssl verify fails, so the current CA did not sign srvpublic.crt. An earlier installer run today made that certificate with an earlier CA. Then you deleted the CA files but kept .srvprivate.key. On the next run, the 1.5.10.2482 installer found the old certificate in the web folder or in its backup copy. The old certificate matched the key, so the installer used it again. The installer does not check which CA signed it. FOG 1.6.0 checks this and issues a new certificate.

                    “FOG Project CA” (2019 to 2029) comes with the FOG Client. Keep it.

                    Do these steps on the server:

                    1. Remove all copies of the old certificate:
                      rm -f /opt/fog/snapins/ssl/.srvpublic.crt /var/www/html/fog/management/other/ssl/srvpublic.crt
                    2. Remove the backup copies too:
                      find / -path '*fog_web_*.BACKUP/management/other/ssl/srvpublic.crt' -print -delete
                    3. Run the installer without flags: ./installfog.sh -y
                    4. Run the check again. It must say OK:
                      openssl verify -CAfile /var/www/html/fog/management/other/ca.cert.pem /var/www/html/fog/management/other/ssl/srvpublic.crt

                    Do not delete the CA files again. The client already trusts the current CA. After step 4 says OK, restart the FOGService on the client.

                    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                    Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                    Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                    F 1 Reply Last reply Reply Quote 0
                    • F
                      fgaudin @Tom Elliott
                      last edited by

                      @Tom-Elliott

                      so nice !!! Fantastic !!! So are so Great !!!

                      one last question : at this moment in .fogsettings, I put the line “secureboot=‘0’”
                      Do you suggest me to put it back to “1” ?
                      I am asking this beacause all of my computers now use UEFI bios.

                      Tom ElliottT 1 Reply Last reply Reply Quote 0
                      • Tom ElliottT
                        Tom Elliott @fgaudin
                        last edited by

                        @fgaudin Good to hear it works.

                        UEFI alone does not need secureboot=1. The setting is only for computers that have Secure Boot turned on in the firmware. With secureboot=0, FOG does not sign its boot files, and a computer with Secure Boot on refuses to boot them.

                        • If Secure Boot is off on your computers, keep secureboot='0'.
                        • If Secure Boot is on, set secureboot='1' and run ./installfog.sh -y. Do not use -C or -K. Each computer then enrolls the FOG key one time at its first PXE boot.

                        Install sudo before you set it to 1. The Secure Boot signing helper needs /etc/sudoers.d.

                        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                        1 Reply Last reply Reply Quote 0
                        • Tom ElliottT Tom Elliott has marked this topic as solved
                        • 1 / 1
                        • First post
                          Last post

                        68

                        Online

                        12.8k

                        Users

                        17.7k

                        Topics

                        157.4k

                        Posts
                        Copyright © 2012-2026 FOG Project