• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login

    IPXE boot no longer works after upgrade to 1.6. Error code 0216eb

    Scheduled Pinned Locked Moved Unsolved FOG Problems
    12 Posts 2 Posters 90 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Tom ElliottT
      Tom Elliott @thesmj248
      last edited by

      @thesmj248 Your Secure Boot chain works. The shim, the signed snponly.efi, and autoexec.ipxe all load. The failure comes after that.

      Error 0216eb8f is iPXE’s “No usable certificates”. It is a TLS certificate check. Your boot.php request goes out over http://, so something on the server redirects it to https://. The signed iPXE binary cannot trust the FOG server’s own CA, so the HTTPS connection fails.

      A stock FOG 1.6 install with HTTP netboot does not redirect /fog/service/ipxe/. The redirect probably comes from a config left over from 1.5 or the FOGUefi changes.

      Please run this from another machine and post the output:

      curl -sI http://10.115.53.33/fog/service/ipxe/boot.php

      Then, on the FOG server, post the output of:

      grep -rniE "rewrite|redirect|return 30" /etc/apache2/sites-enabled/ /etc/httpd/conf.d/ /etc/nginx/conf.d/ 2>/dev/null

      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

      Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

      Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

      T 1 Reply Last reply Reply Quote 0
      • T
        thesmj248 @Tom Elliott
        last edited by

        @Tom-Elliott

        Ah that makes sense!

        Here’s what I get from the curl command:

        HTTP/1.1 302 Found
Date: Thu, 05 Nov 2026 14:25:17 GMT
Server: Apache/2.4.66 (Ubuntu)
Location: https://10.115.53.33//fog/service/ipxe/boot.php
Connection: close
Content-Type: text/html; charset=iso-8859-1

        The grep command on the server:

        /etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:9:    RewriteEngine On
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:10:    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:11:    RewriteRule .* - [F]
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:12:    RewriteRule /management/other/ca.cert.der$ - [L]
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:14:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:15:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:18:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:19:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:22:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:23:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:26:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:27:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:30:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:31:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:33:    RewriteCond %{HTTPS} off
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:34:    RewriteRule (.*) https://%{HTTP_HOST}/$1 [R,L]
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:57:    RewriteEngine On
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:58:    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:59:    RewriteRule .* - [F]
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:60:    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:61:    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-d
/etc/apache2/sites-enabled/001-fog.conf.bak_foguefi:62:    RewriteRule ^/fog/(.*)$ /fog/api/index.php [QSA,L]
/etc/apache2/sites-enabled/001-fog.conf:9:    RewriteEngine On
/etc/apache2/sites-enabled/001-fog.conf:10:    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
/etc/apache2/sites-enabled/001-fog.conf:11:    RewriteRule .* - [F]
/etc/apache2/sites-enabled/001-fog.conf:12:    RewriteRule /management/other/ca.cert.der$ - [L]
/etc/apache2/sites-enabled/001-fog.conf:14:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf:15:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf:18:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf:19:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf:22:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf:23:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf:26:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf:27:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf:30:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf:31:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf:34:RewriteRule /service/grub/grub.php$ - [L]        # Needed for GRUB (unable to fetch ressources HTTPS mode)
/etc/apache2/sites-enabled/001-fog.conf:35:RewriteRule /service/grub/tftp/.*$ - [L]        # Needed for GRUB
/etc/apache2/sites-enabled/001-fog.conf:37:    RewriteCond %{HTTPS} off
/etc/apache2/sites-enabled/001-fog.conf:38:    RewriteRule (.*) https://%{HTTP_HOST}/$1 [R,L]
/etc/apache2/sites-enabled/001-fog.conf:61:    RewriteEngine On
/etc/apache2/sites-enabled/001-fog.conf:62:    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
/etc/apache2/sites-enabled/001-fog.conf:63:    RewriteRule .* - [F]
/etc/apache2/sites-enabled/001-fog.conf:64:    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
/etc/apache2/sites-enabled/001-fog.conf:65:    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-d
/etc/apache2/sites-enabled/001-fog.conf:66:    RewriteRule ^/fog/(.*)$ /fog/api/index.php [QSA,L]
        Tom ElliottT 1 Reply Last reply Reply Quote 0
        • Tom ElliottT
          Tom Elliott @thesmj248
          last edited by

          @thesmj248 That output shows the cause. Your live sites-enabled/001-fog.conf is still the 1.5 vhost with the FOGUefi edits. Lines 37–38 redirect every HTTP request to HTTPS. The 1.6 installer writes its vhost to sites-available/001-fog.conf. I think FOGUefi turned the sites-enabled symlink into a regular file, so Apache never saw the new vhost.

          Please check:

          ls -l /etc/apache2/sites-enabled/

          If 001-fog.conf is a regular file and not a link to ../sites-available/001-fog.conf, run:

          sudo mv /etc/apache2/sites-enabled/001-fog.conf /root/001-fog.conf.foguefi
sudo mv /etc/apache2/sites-enabled/001-fog.conf.bak_foguefi /root/
sudo a2ensite 001-fog
sudo apachectl configtest && sudo systemctl reload apache2

          Then repeat the curl -sI command. It should return 200 OK, and the client should boot.

          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

          Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

          Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

          T 1 Reply Last reply Reply Quote 0
          • T
            thesmj248 @Tom Elliott
            last edited by

            @Tom-Elliott

            Ok! Now I do get 200 OK with the curl command. AND the client will boot, as long as secure boot is disabled.

            If secure boot is enabled, I get the following:

            1a7dcbe9-0062-4f57-9cfc-27c943fe23ae-image.png

            Tom ElliottT 1 Reply Last reply Reply Quote 0
            • Tom ElliottT
              Tom Elliott @thesmj248
              last edited by

              @thesmj248 Good, the redirect was the problem, and boot.php now loads.

              The new failure is expected on a Secure Boot client that has not enrolled this server’s key yet. FOG 1.6 signs bzImage and init.xz with the server’s own Secure Boot key. Shim accepts them only when that key is in the client’s MOK list. The key FOGUefi enrolled under 1.5 is a different key, so shim refuses the kernel with “Security Policy Violation”.

              Enroll the key once per machine, with Secure Boot still on:

              1. PXE boot the client to the FOG menu and choose “Enroll Secure Boot Key”.
              2. Be ready at the keyboard. MokManager gives up after about 10 seconds with no keypress.
              3. Choose “Enroll key from disk”, select MOK.der, and confirm the enrollment.
              4. Reboot.

              If MOK.der is not in the list, put it on a FAT-formatted USB stick and select it from there. You can download it from http://10.115.53.33/fog/service/secureboot/MOK.der.

              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

              Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

              Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

              T 1 Reply Last reply Reply Quote 0
              • T
                thesmj248 @Tom Elliott
                last edited by

                @Tom-Elliott

                Alright. Is there, or will there be a way to enroll the key without physical access to the machine? Perhaps if the client is installed and connected to the FOG server prior to the first attempt at imaging?

                Tom ElliottT 2 Replies Last reply Reply Quote 0
                • Tom ElliottT
                  Tom Elliott @thesmj248
                  last edited by

                  @thesmj248 No, while that sounds like it’d be a reasonable request, the nature of “Secure Boot” would be moot if you could just arbitrarily and remotely define these.

                  Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                  Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                  Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                  1 Reply Last reply Reply Quote 0
                  • Tom ElliottT
                    Tom Elliott @thesmj248
                    last edited by

                    @thesmj248 One addition. FOG can shorten the visit to each machine, but it cannot remove it.

                    Schedule the “Enroll Secure Boot” task for a host or a group. On the next boot, the task stages the MOK request. Someone at the machine then confirms it once in MOK Manager. The one-time password shows on the client screen, or you can set one password for the whole fleet with the sbmokpw kernel argument.

                    If the machine’s firmware is in Setup Mode (its Secure Boot keys cleared), the task enrolls the key by itself, with nobody at the keyboard.

                    Either way, the task needs Secure Boot off when it runs. A client that already enforces Secure Boot cannot boot FOS, because it does not trust the kernel yet. So turn Secure Boot off, run the task, confirm the key, then turn Secure Boot back on.

                    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                    Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                    Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                    T 1 Reply Last reply Reply Quote 0
                    • T
                      thesmj248 @Tom Elliott
                      last edited by

                      @Tom-Elliott

                      That may be an issue for us since our systems are headless and remote. In theory I could switch SB to setup mode, but I believe messing with that setting via HP’s utility will result in the system requiring a confirmation of the change using the keyboard upon the next boot. I know that’s the case for turning it off, but I’ll have to see what it does when switching it to Setup.

                      On the other hand, FOG 1.5.10 + FOGUefi just works. 😜

                      Tom ElliottT 1 Reply Last reply Reply Quote 0
                      • Tom ElliottT
                        Tom Elliott @thesmj248
                        last edited by

                        @thesmj248 Right, and here is why FOGUefi needed no visit. It boots Ubuntu’s kernel, shim, and GRUB, which Microsoft and Canonical already sign. FOG 1.6 boots its own FOS kernel, signed with your server’s key. So each client must trust that key once. That is the trade-off.

                        For headless machines, Setup Mode is the path to try. In Setup Mode, the “Enroll Secure Boot” task runs with nobody at the keyboard. It enrolls FOG’s key plus Microsoft’s certificates, so Windows still boots. Note that it also makes FOG’s key the machine’s Platform Key, in place of HP’s.

                        If HP’s utility can put a machine into Setup Mode without a keyboard confirmation, the whole process is remote: switch to Setup Mode, then schedule the task. When the task finishes, the machine leaves Setup Mode and trusts FOG’s kernels. Please post what HP’s utility does when you test it.

                        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                        T 1 Reply Last reply Reply Quote 0
                        • T
                          thesmj248 @Tom Elliott
                          last edited by

                          @Tom-Elliott

                          Hopefully I’ll have the answer to that question within the next two weeks!

                          1 Reply Last reply Reply Quote 0
                          • 1 / 1
                          • First post
                            Last post

                          124

                          Online

                          12.8k

                          Users

                          17.7k

                          Topics

                          157.4k

                          Posts
                          Copyright © 2012-2026 FOG Project