• Recent
  • Unsolved
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Register
  • Login
  • Recent
  • Unsolved
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Register
  • Login

Installing FOG Client with HTTPS, unable to install CA Certificate from Server

Scheduled Pinned Locked Moved Solved
Bug Reports
4
19
4.2k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • H
    hancocza
    last edited by Feb 9, 2018, 6:22 PM

    Hello,

    I’m running FOG 1.5.0-RC 12 with Ubuntu 16.04 LTS. When i upgraded, the server pushed out the update to 11.13 for the FOG client. I assume when it tried to install the new version, it was unable to since the clients could not install the CA certificate and as such I now have no client on any of my hosts. From wireshark, I found that they install the CA Certificate over port 80. In our network setup, we use HTTPS instead of HTTP, and as such we block communication on port 80. Is there any way that if the server and clients are installed with the HTTPS options selected, if the client could also search for the CA Certificate over HTTPS as opposed to HTTP?

    1 Reply Last reply Reply Quote 0
    • J
      Joe Schmitt Senior Developer
      last edited by Feb 14, 2018, 5:54 PM

      @hancocza let me remote in and debug the issue. The installer had a bug which prevented it from pinning a server over https if port 80 was blocked. This has been fixed in v0.11.14, which will be released with the next server RC.

      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

      1 Reply Last reply Reply Quote 1
      • J
        Joe Schmitt Senior Developer
        last edited by Joe Schmitt Feb 9, 2018, 4:31 PM Feb 9, 2018, 10:31 PM

        @hancocza The issue here is that the client will only connect with SSL if the https certificate is trusted by the computer – which in your case its not, but once the client installs, then the SSL cert will be trusted. This is something I’ve been considering changing, but honestly there’s a much easier solution for you: exclude the ca.cert.der file from the SSL redirect in your apache config

        Here’s an example, that should work, if not you should be able to get the general idea from it:

        <VirtualHost *:80>
          DocumentRoot /var/www/html/
          ServerName xxx.xxx.xxx.xxx
          # Your other lines #
        
          RewriteEngine On
          RewriteCond %{HTTPS} !=on
          RewriteCond %{REQUEST_URI} !=(/fog/management/other/ca.cert.der)
          RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
        </VirtualHost> 
        

        @Tom-Elliott maybe we should include the exemption in the default Apache files if ssl-only is selected on install?

        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

        1 Reply Last reply Reply Quote 0
        • T
          Tom Elliott
          last edited by Feb 10, 2018, 1:50 AM

          These are the exact lines that are added for http/https mode.

          echo "NameVirtualHost *:80" > "$etcconf"
          echo "NameVirtualHost *:443" >> "$etcconf"
          echo "<VirtualHost *:80>" >> "$etcconf"
          echo "    ServerName $ipaddress" >> "$etcconf"
          echo "    RewriteEngine On" >> "$etcconf"
          echo "    RewriteRule /management/other/ca.cert.der$ - [L]" >> "$etcconf"
          echo "    RewriteCond %{HTTPS} off" >> "$etcconf"
          echo "    RewriteRule (.*) https://%{HTTP_HOST}/\$1 [R,L]" >> "$etcconf"
          echo "</VirtualHost>" >> "$etcconf"
          

          This would produce a https install of FOG beginning with:

          NameVirtualHost *:80
          NameVirtualHost *:443
          <VirtualHost *:80>
              ServerName <fogip/hostname>
              RewriteEngine On
              RewriteRule /management/other/ca.cert.der$ - [L]
              RewriteCond %{HTTPS} off
              RewriteRule (.*) https://%{HTTP_HOST}/$1 [R,L]
          </VirtualHost>
          

          This should do the same thing as what @Joe-Schmitt Suggested, though maybe something is off here? I don’t play too much with https side of things during installation, I manually handle my stuff to more quickly develop the GUI.

          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

          Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

          Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

          1 Reply Last reply Reply Quote 0
          • H
            hancocza
            last edited by Feb 12, 2018, 1:45 PM

            Hey Guys,

            Thanks for answering. Would this be the sites-enabled config? I tried changing that but still am getting the unable to install CA certificate issue, even after restarting the apache server.

            T 1 Reply Last reply Feb 12, 2018, 4:38 PM Reply Quote 0
            • T
              Tom Elliott @hancocza
              last edited by Feb 12, 2018, 4:38 PM

              @hancocza if I read the issue correctly, the problem is your network doesn’t allow port 80 at all, correct?

              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

              Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

              Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

              H 1 Reply Last reply Feb 12, 2018, 11:06 PM Reply Quote 0
              • H
                hancocza @Tom Elliott
                last edited by Feb 12, 2018, 11:06 PM

                @tom-elliott Correct. So i have edited the web server to redirect to https and that works fine, its just that the fog client cannot reach the certificate when installing on host computers.

                1 Reply Last reply Reply Quote 0
                • J
                  Joe Schmitt Senior Developer
                  last edited by Feb 13, 2018, 7:25 PM

                  @hancocza are you using the default SSL cert generated by the FOG server?

                  Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                  H 1 Reply Last reply Feb 13, 2018, 7:34 PM Reply Quote 0
                  • H
                    hancocza @Joe Schmitt
                    last edited by Feb 13, 2018, 7:34 PM

                    @joe-schmitt For the apache web server? No. We use a custom one. From what I understood though was that the installer is just looking for the srvpublic.crt, which is still in it’s original place.

                    1 Reply Last reply Reply Quote 0
                    • J
                      Joe Schmitt Senior Developer
                      last edited by Feb 13, 2018, 7:35 PM

                      @hancocza does the computer you’re trying to install the client on trust that SSL certificate? (e.g. if you go to your fog server in a browser, is there a certificate error?).

                      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                      H 1 Reply Last reply Feb 13, 2018, 7:37 PM Reply Quote 0
                      • H
                        hancocza @Joe Schmitt
                        last edited by Feb 13, 2018, 7:37 PM

                        @joe-schmitt Yes. I go to the browser and it doesn’t throw any warnings. The address bar has the green secure lock on it.

                        1 Reply Last reply Reply Quote 0
                        • J
                          Joe Schmitt Senior Developer
                          last edited by Feb 13, 2018, 7:38 PM

                          @hancocza alright, then this is definitely a client bug. The functions we created to download files did not adhere to redirect requests. I’m working on patching that now.

                          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                          1 Reply Last reply Reply Quote 0
                          • J
                            Joe Schmitt Senior Developer
                            last edited by Joe Schmitt Feb 13, 2018, 1:46 PM Feb 13, 2018, 7:45 PM

                            @hancocza Can you try installing this build: https://build.jbob.io/Client/nightly/02-13-downloadredirect-01/SmartInstaller.exe ? It should follow your SSL redirect.

                            Please note that it is a nightly build and so should not be used in production, as the binaries are unsigned and can cause unforeseen issues.

                            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                            H 1 Reply Last reply Feb 13, 2018, 8:01 PM Reply Quote 0
                            • H
                              hancocza @Joe Schmitt
                              last edited by Feb 13, 2018, 8:01 PM

                              @joe-schmitt Do you have an MSI version of it? If not, do you know what the parameter is to install this with https?

                              1 Reply Last reply Reply Quote 0
                              • J
                                Joe Schmitt Senior Developer
                                last edited by Joe Schmitt Feb 13, 2018, 2:02 PM Feb 13, 2018, 8:02 PM

                                @hancocza

                                You can browse all the files here: https://build.jbob.io/Client/nightly/02-13-downloadredirect-01/

                                Here is the MSI: https://build.jbob.io/Client/nightly/02-13-downloadredirect-01/FOGService.msi

                                Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                                H 1 Reply Last reply Feb 13, 2018, 8:15 PM Reply Quote 1
                                • H
                                  hancocza @Joe Schmitt
                                  last edited by Feb 13, 2018, 8:15 PM

                                  @joe-schmitt Hey Joe,

                                  Just tried to install it with the HTTPS switch. Still getting the Unable to install CA Certificate issue.

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    Joe Schmitt Senior Developer
                                    last edited by Feb 13, 2018, 8:28 PM

                                    @hancocza Can you try again with this build? https://build.jbob.io/Client/release-candidate/0.11.14-RC-03/FOGService.msi

                                    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                                    H 1 Reply Last reply Feb 13, 2018, 8:36 PM Reply Quote 0
                                    • H
                                      hancocza @Joe Schmitt
                                      last edited by Feb 13, 2018, 8:36 PM

                                      @joe-schmitt Still a no go. Still trying to reach over 80.

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        Sebastian Roth Moderator
                                        last edited by Feb 13, 2018, 11:08 PM

                                        Moved to bug reports as it seems to be one. Thanks @Joe-Schmitt for looking into this!

                                        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                                        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          Joe Schmitt Senior Developer
                                          last edited by Feb 14, 2018, 5:54 PM

                                          @hancocza let me remote in and debug the issue. The installer had a bug which prevented it from pinning a server over https if port 80 was blocked. This has been fixed in v0.11.14, which will be released with the next server RC.

                                          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                                          1 Reply Last reply Reply Quote 1
                                          • 1 / 1
                                          1 / 1
                                          • First post
                                            1/19
                                            Last post

                                          227

                                          Online

                                          12.0k

                                          Users

                                          17.3k

                                          Topics

                                          155.2k

                                          Posts
                                          Copyright © 2012-2024 FOG Project