can't install fog client 0.11.19 "Unable to install CA certificate"
-
@lebrun78 said in can't install fog client 0.11.19 "Unable to install CA certificate":
I can’t install my fog client using msi file.
Do you have other hosts with fog-client already installed from before the update? Do they still work properly?
Are you sure the installer script finished all the way to the end? Restarted the whole server after that (usually not needed but give it a try in this case).
Have you messed with the certificates on your FOG server at some point?
Please run the following commands to see if the certs are still fine - post output here:
grep -e pem -e key /etc/apache2/sites-available/*.conf md5sum /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/html/fog/management/other/ca.cert.pem openssl verify -verbose -CAfile /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/fog/management/other/ssl/srvpublic.crt echo -n | openssl s_client -CAfile /var/www/html/fog/management/other/ca.cert.pem -connect fogus.istic.univ-rennes1.fr:443 | head -
Hello Sebastian,
I 've just restart the serer.
On an old installation client I get------------------------------------------------------------------------------ --------------------------------Authentication-------------------------------- ------------------------------------------------------------------------------ 04/03/2020 11:45:48 Client-Info Version: 0.11.19 04/03/2020 11:45:48 Client-Info OS: Windows 04/03/2020 11:45:48 Middleware::Authentication Waiting for authentication timeout to pass 04/03/2020 11:45:48 Middleware::Communication Download: https://fogus/fog/management/other/ssl/srvpublic.crt 04/03/2020 11:45:48 Data::RSA FOG Server CA cert found 04/03/2020 11:45:48 Middleware::Authentication Cert OK 04/03/2020 11:45:48 Middleware::Authentication ERROR: Could not get security token 04/03/2020 11:45:48 Middleware::Authentication ERROR: Le chemin d’accès spécifié est introuvable. 04/03/2020 11:45:48 Middleware::Communication POST URL: https://fogus/fog/management/index.php?sub=requestClientInfo&authorize&newService 04/03/2020 11:45:48 Middleware::Response Success 04/03/2020 11:45:48 Middleware::Authentication Authenticated 04/03/2020 11:45:48 Middleware::Communication URL: https://fogus/fog/management/index.php?sub=requestClientInfo&configure&newService&json 04/03/2020 11:45:48 Middleware::Response Success 04/03/2020 11:45:48 Middleware::Communication URL: https://fogus/fog/management/index.php?sub=requestClientInfo&mac=52:54:00:CE:A1:DD&newService&json 04/03/2020 11:45:49 Middleware::Response Success 04/03/2020 11:45:49 Middleware::Communication URL: https://fogus/fog/service/getversion.php?clientver&newService&json 04/03/2020 11:45:49 Middleware::Communication URL: https://fogus/fog/service/getversion.php?newService&json 04/03/2020 11:45:49 Service Creating user agent cache 04/03/2020 11:45:49 Middleware::Response Success 04/03/2020 11:45:49 Middleware::Response Module is disabled globally on the FOG server 04/03/2020 11:45:49 Middleware::Response Success 04/03/2020 11:45:49 Service Initializing modules ------------------------------------------------------------------------------ ---------------------------------ClientUpdater-------------------------------- ------------------------------------------------------------------------------ 04/03/2020 11:45:49 Client-Info Client Version: 0.11.19 04/03/2020 11:45:49 Client-Info Client OS: Windows 04/03/2020 11:45:49 Client-Info Server Version: 1.5.8 04/03/2020 11:45:49 Middleware::Response Success ------------------------------------------------------------------------------It seems working even if I have this errors in thelog:
Middleware::Authentication ERROR: Could not get security token 04/03/2020 11:45:48 Middleware::Authentication ERROR: Le chemin d’accès spécifié est introuvable.On the server:
grep -e pem -e key /etc/httpd/conf.d/*.conf /etc/httpd/conf.d/fog.conf: SSLCertificateKeyFile /opt/fog/snapins/ssl//.srvprivate.key /etc/httpd/conf.d/fog.conf: SSLCACertificateFile /var/www/html/fog//management/other/ca.cert.pem /etc/httpd/conf.d/ssl.conf:# If the key is not combined with the certificate, use this /etc/httpd/conf.d/ssl.conf:# directive to point at the key file. Keep in mind that if /etc/httpd/conf.d/ssl.conf:# you've both a RSA and a DSA private key you can configure /etc/httpd/conf.d/ssl.conf:# ECC keys, when in use, can also be configured in parallel /etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.keymd5sum /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/html/fog/management/other/ca.cert.pem c5023563df0eeeac5186bd9b641426dc /opt/fog/snapins/ssl/CA/.fogCA.pem c5023563df0eeeac5186bd9b641426dc /var/www/html/fog/management/other/ca.cert.pemopenssl verify -verbose -CAfile /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/fog/management/other/ssl/srvpublic.crt /var/www/fog/management/other/ssl/srvpublic.crt: OKMay be the problem is here, initially the server name was fogus2, rename to fogus
with this command that you proposed to me, we find traces of fogus2echo -n | openssl s_client -CAfile /var/www/html/fog/management/other/ca.cert.pem -connect fogus.istic.univ-rennes1.fr:443 | head depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr verify error:num=19:self signed certificate in certificate chain verify return:1 depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr verify return:1 depth=0 C = US, O = Unspecified, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr verify return:1 CONNECTED(00000003) --- Certificate chain 0 s:C = US, O = Unspecified, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr i:C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr 1 s:C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr i:C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr --- Server certificate -----BEGIN CERTIFICATE----- DONE -
@lebrun78 Well, fairly clear. You seem to have a custom CA installed on your FOG server. While it’s fine to do it’s not supported by FOG yet and running the installer will mess things up. I am in the process of changing this but it needs a lot more work.
Please run
grep "SSLC" /etc/httpd/conf.d/*.confand post output here. -
Thank you for your help Sebastian, I’m not good at all in cert management !
grep “SSLC” /etc/httpd/conf.d/*.conf
/etc/httpd/conf.d/fog.conf: SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA /etc/httpd/conf.d/fog.conf: SSLCertificateFile /var/www/html/fog//management/other/ssl/srvpublic.crt /etc/httpd/conf.d/fog.conf: SSLCertificateKeyFile /opt/fog/snapins/ssl//.srvprivate.key /etc/httpd/conf.d/fog.conf: SSLCACertificateFile /var/www/html/fog//management/other/ca.cert.pem /etc/httpd/conf.d/ssl.conf:# Use "SSLCryptoDevice" to enable any supported hardware /etc/httpd/conf.d/ssl.conf:SSLCryptoDevice builtin /etc/httpd/conf.d/ssl.conf:#SSLCryptoDevice ubsec /etc/httpd/conf.d/ssl.conf:SSLCipherSuite PROFILE=SYSTEM /etc/httpd/conf.d/ssl.conf:# Point SSLCertificateFile at a PEM encoded certificate. If /etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt /etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key /etc/httpd/conf.d/ssl.conf:# Point SSLCertificateChainFile at a file containing the /etc/httpd/conf.d/ssl.conf:# the referenced file can be the same as SSLCertificateFile /etc/httpd/conf.d/ssl.conf:#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt /etc/httpd/conf.d/ssl.conf:#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt -
@lebrun78 I have a feeling that the hostname does not point to the server you think it should point to. Please run the following commands on your FOG server and post output here:
ping -c 1 fogus ping -c 1 fogus.istic.univ-rennes1.fr ping -c 1 fogus2.istic.univ-rennes1.fr ip a s -
Here are the result fo the command:
ping -c 1 fogus2.istic.univ-rennes1.fr ping: fogus2.istic.univ-rennes1.fr: Nom ou service inconnu [root@fogus ~]# ping -c 1 fogus.istic.univ-rennes1.fr PING fogus.istic.univ-rennes1.fr (148.60.4.1) 56(84) bytes of data. 64 bytes from fogus.istic.univ-rennes1.fr (148.60.4.1): icmp_seq=1 ttl=64 time=0.035 ms --- fogus.istic.univ-rennes1.fr ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.035/0.035/0.035/0.000 ms [root@fogus ~]# ping -c 1 fogus PING fogus.istic.univ-rennes1.fr (148.60.4.1) 56(84) bytes of data. 64 bytes from fogus.istic.univ-rennes1.fr (148.60.4.1): icmp_seq=1 ttl=64 time=0.051 ms --- fogus.istic.univ-rennes1.fr ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.051/0.051/0.051/0.000 ms [root@fogus ~]# ping -c 1 fogus2 ping: fogus2: Nom ou service inconnuip a s 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens2f0np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether b0:26:28:78:ce:d0 brd ff:ff:ff:ff:ff:ff inet 148.60.4.1/21 brd 148.60.7.255 scope global noprefixroute ens2f0np0 valid_lft forever preferred_lft forever inet6 fe80::b226:28ff:fe78:ced0/64 scope link valid_lft forever preferred_lft forever 3: eno1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether 4c:d9:8f:8e:41:0f brd ff:ff:ff:ff:ff:ff 4: ens2f1np1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether b0:26:28:78:ce:d1 brd ff:ff:ff:ff:ff:ff 5: eno2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether 4c:d9:8f:8e:41:10 brd ff:ff:ff:ff:ff:ff 6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000 link/ether 52:54:00:1e:69:b9 brd ff:ff:ff:ff:ff:ff inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0 valid_lft forever preferred_lft forever 7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000 link/ether 52:54:00:1e:69:b9 brd ff:ff:ff:ff:ff:ffI try to find fogus2 string in /etc:
grep -Ri fogus2 /etc/* grep: /etc/grub2.cfg: Aucun fichier ou dossier de ce type grep: /etc/httpd/run/cgisock.2085: Aucun périphérique ou adresse /etc/lvm/backup/cl:creation_host = "fogus2.istic.univ-rennes1.fr" # Linux fogus2.istic.univ-rennes1.fr 4.18.0-80.11.2.el8_0.x86_64 #1 SMP Tue Sep 24 11:32:19 UTC 2019 x86_64 /etc/lvm/archive/cl_00000-2032209725.vg:creation_host = "fogus2.istic.univ-rennes1.fr" # Linux fogus2.istic.univ-rennes1.fr 4.18.0-80.11.2.el8_0.x86_64 #1 SMP Tue Sep 24 11:32:19 UTC 2019 x86_64 /etc/mail/sendmail.cf:##### built by root@fogus2.istic.univ-rennes1.fr on ven. nov. 29 09:28:55 CET 2019 -
@lebrun78 DNS naming seems ok. fogus2* doesn’t exist and fogus* both point to the same IP which we see in
ip a sas well.But …
echo -n | openssl s_client -CAfile /var/www/html/fog/management/other/ca.cert.pem -connect fogus.istic.univ-rennes1.fr:443 | head
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify error:num=19:self signed certificate in certificate chain
verify return:1
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
depth=0 C = US, O = Unspecified, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
CONNECTED(00000003)This obviously tells us there are other certificates in place. Ahhhh… I just remembered seeing some weird issue with virtual host naming on Ubuntu one day. I can imagine this happening to you here as well, maybe different but still.
Run the following two commands and post full output here.
apachectl -S grep Server /etc/httpd/conf.d/* -
@Sebastian-Roth said in can't install fog client 0.11.19 "Unable to install CA certificate":
apachectl -S
grep Server /etc/httpd/conf.d/*[root@fogus ~]# apachectl -S
VirtualHost configuration: *:80 148.60.4.1 (/etc/httpd/conf.d/fog.conf:1) *:443 is a NameVirtualHost default server 148.60.4.1 (/etc/httpd/conf.d/fog.conf:14) port 443 namevhost 148.60.4.1 (/etc/httpd/conf.d/fog.conf:14) alias fogus port 443 namevhost fogus.istic.univ-rennes1.fr (/etc/httpd/conf.d/ssl.conf:40) ServerRoot: "/etc/httpd" Main DocumentRoot: "/var/www/html" Main ErrorLog: "/etc/httpd/logs/error_log" Mutex authdigest-opaque: using_defaults Mutex watchdog-callback: using_defaults Mutex proxy-balancer-shm: using_defaults Mutex rewrite-map: using_defaults Mutex ssl-stapling-refresh: using_defaults Mutex authdigest-client: using_defaults Mutex lua-ivm-shm: using_defaults Mutex ssl-stapling: using_defaults Mutex proxy: using_defaults Mutex authn-socache: using_defaults Mutex ssl-cache: using_defaults Mutex default: dir="/etc/httpd/run/" mechanism=default Mutex cache-socache: using_defaults PidFile: "/etc/httpd/run/httpd.pid" Define: DUMP_VHOSTS Define: DUMP_RUN_CFG User: name="apache" id=48 Group: name="apache" id=48[root@fogus ~]# grep Server /etc/httpd/conf.d/*
/etc/httpd/conf.d/fog.conf: ServerName 148.60.4.1 /etc/httpd/conf.d/fog.conf: ServerAlias fogus /etc/httpd/conf.d/fog.conf: ServerName 148.60.4.1 /etc/httpd/conf.d/fog.conf: ServerAlias fogus /etc/httpd/conf.d/fog.conf.org: ServerName 148.60.4.1 /etc/httpd/conf.d/fog.conf.org: ServerAlias fogus /etc/httpd/conf.d/fog.conf.org: ServerName 148.60.4.1 /etc/httpd/conf.d/fog.conf.org: ServerAlias fogus /etc/httpd/conf.d/README:This directory holds configuration files for the Apache HTTP Server; /etc/httpd/conf.d/ssl.conf:#ServerName www.example.com:443 /etc/httpd/conf.d/ssl.conf:# Server Private Key: /etc/httpd/conf.d/ssl.conf:# Server Certificate Chain: /etc/httpd/conf.d/ssl.conf:# Per-Server Logging: -
@lebrun78 said:
port 443 namevhost fogus.istic.univ-rennes1.fr (/etc/httpd/conf.d/ssl.conf:40)
Here we are I’d say. If you use hostname fogus.istic.univ-rennes1.fr you will be served by the certificate specified in ssl.conf instead of our fog.conf. I should have figured this out earlier, really.
Try using hostname fogus in your fog-client install and it should just work I’d say.
If you are really keen we can work through FOG’s certificate generation again and make it use the full qualified name instead.
-
Thank you for you answer Sebastian,
I should reinstall using : “./installfog.sh -W https://fogus.istic.univ-rennes1.fr -S” ?
I will wait for the end of the college year to resintall and generate a new certificate. -
@lebrun78 No, using the
-Wdoes not exactly do what you might expect it to do. The installer help text on this might be a bit confusing as the parameter should only be used to set the webroot - default is/fog/- but not the whole URL as in your example!Are you sure you want to use full qualified domain name from now on? I am just asking because one of the fog-client logs you posted shows that clients might use the short name fogus and they will break if you simply switch to full qualified, unless you edit
C:\Program Files (x86)\FOG\settings.jsonon all those machines.If you only want to go with full dns name I’d suggest you edit
/opt/fog/.fogsettingsand make sure the following three options are set correctly.hostname='fogus.istic.univ-rennes1.fr' webroot='/fog/' httpproto='https'Then re-run the installer without any command line options. That should re-generate the webserver cert and config for you (using the full qualified domain name). There should be no issue with the fog-clients being pinned to that server as the CA cert itself stays untouched. But as mentioned above you will probably need to change settings.json on all the existing clients.
The other option you have is to manually fiddle with the certificate stuff and add a second hostname (fogus.istic.univ-rennes1.fr and fogus). This is possible but needs manual file edit and calling commands and I don’t recommend it right now because the installer is not ready for it and will break your setup as soon as you run it again after the manual adjustments.
EDIT: Now that I think a bit more about it, we might even add short and full qualified dns name to the certificate by default in the installer as it might help others as well.
Give me a bit more time and I might add this todev-branchin the next couple of days. -
Thank you Sebastian for this explanation.
I actually use the short name but by default, I would have preferred to use the long name.
But the whole is currently configured as well, so I will stay on this configuration while waiting to update the posts with a new image at the end of the school year.