Windows 11 Fog Client install failing with HTTPS

[astrugatch]

Getting failed to pin cert on Windows 11 EDU (latest) when installing the client with HTTPS.

I’ve tried the MSI with a script and the smart installer.

Server is running 1.5.2495 on Ubuntu 22.04

[astrugatch]

@Tom-Elliott

I just installed with HTTPS off and it worked, but then my settings json had HTTPS set to 1 regardless. Is that intentional?

[Tom Elliott]

@astrugatch Thanks, I can reproduce this.

Cause: since 1.5.10.2253 the server signs its HTTPS certificate with a “FOG Web CA” intermediate under the FOG Server CA. The client installer only accepts an HTTPS certificate issued directly by “FOG Server CA” when it downloads ca.cert.der, so the download fails and the pin fails. The fix is in the client: https://github.com/FOGProject/zazzles/pull/48. It needs a new client release.

Workaround until then, either one:

• Trust the FOG CA before you install. Download http://<fog-server>/fog/management/other/ca.cert.der (plain HTTP works), then run certutil -addstore Root ca.cert.der as administrator. Then run the HTTPS install as before.
• Or install with HTTPS off. The client downloads the CA over HTTP, and the server redirects it to HTTPS after that.

[astrugatch]

@Tom-Elliott

I just installed with HTTPS off and it worked, but then my settings json had HTTPS set to 1 regardless. Is that intentional?

[Tom Elliott]

@astrugatch I don’t think it matters really. The issue was more about the initial pinning of the certificate during the install process. After it is pinned I think this is the correct expectation (it should only communicate to the FOG server over HTTPS).