@Technolust

Have you configured your DHCP options in your DHCP server for the 340 VLAN scope?

@Sebastian-Roth

If I am installing FOG for the first time (as opposed to upgrading) and I enter the DNS name as part of the new installer and having the CA generate a cert with the DNS/hostname does HTTPS become the default.

@Sebastian-Roth
I saw the change in GitHub but didn’t dig too deep. If you fill out these values during a clean setup does it make default FOG to https?

@Tom-Elliott

I can always deploy a new client via GroupPolicy so that doesn’t scare me from making the change. I’ll probably hold off for now only because it’s not a huge issue to stay on http for me.

I think adding a hostname item would be great and it would make FOG much more portable and secure to make https the default

@Tom-Elliott

If I change that setting how do I force it to generate a new cert? Do I just run the installer again?

@Sebastian-Roth
Good to know. I’m using FOG with HTTP so it hasn’t been an issue (I’ve moved it several times as virtual environments shifted). It might be worth looking into adding a feature in the installer to ask for the DNS name of the machine so it can generate the cert with that as the CN rather than the machine’s IP.

@JimmyJ0516
Do yourself a favor and create a DNS record for your FOG server. That way if you ever change the IP of your server all it takes is updating the record to move all your clients over.

Nevermind. Found it (in my own post history no less…)

https://wiki.fogproject.org/wiki/index.php?title=BIOS_and_UEFI_Co-Existence#Using_Windows_Server_2012_.28R1_and_later.29_DHCP_Policy

I know there is an article about this but I can’t seem to find it. I want both the unionly and ipxe boot files available to my machines (I still have a couple old machines that aren’t configured for efi as well as my virtualbox and Xen VMs).

Can anyone send me that wiki link for the configuration?

Is the domain information you put at the top a copy and paste from your config? Because I see a comma misplaced.

AD DEFAULT OU	- OU=Imaged,DC=haw,DC=k,12DC=nj,DC=us

should read

AD DEFAULT OU	- OU=Imaged,DC=haw,DC=k12,DC=nj,DC=us

I make a golden (just OS and staged drivers) in virtual box for each major release we intend to deploy (we only did 1607 and 1803 so far) then incremental machine updates are handled by WSUS.

Rather than send you down a path full of frustration I will say that Imaging on Macs is dead. JAMF, Deploy Studio etc are all echoing this sentiment. NetInstall/Recovery+DEP/prestage+MDM is Apple’s vision of how you set up their machines. If you are sticking with 10.12.6 and earlier and using HFS+ for the drive format I would say you should probably look at Deploy Studio, but at the same time don’t invest too much effort there as this is not going to be the move going forward.

@tom-elliott

Would System Serial be more reliable, at least with major manufacturers?

Any chance 1.6 introduces unique identifier? This is the feature I’ve been most waiting on so I can stop dancing around with MAC address settings for hosts.

@tom-elliott

Using my key isn’t really a high priority as only I and the other admin will be using it so self signed is OK.

On the install process for self signed is it just -S and -c or is there something else I need to do for the installer to generate its own key?

@tom-elliott

So if I put my domain cert.key file in /opt/fog/snapins/ssl and use the -S and -c modifiers would that take my cert?

If that doesn’t work I’m OK with making my own conf file, I’m just trying to make this as hand-offable as possible so someone doesn’t need to know a ton of unique specifics to work with my environment.

-c    --ssl-file		Specify the ssl path
	               		defaults to /opt/fog/snapins/ssl

I see this in the --help does the cert need to have a particular name or will any *.crt be recognized?

@tom-elliott said in Web interface SSL:

https://github.com/FOGProject/fogproject/issues/120

Is there a way to add a cert post install that will survive updates or will I need to run the installer again to add my cert?

Does the modifier take both the .key and the .crt?

It would be helpful for the client to be able to pull and report inventory information on machines without needing them to reboot.

I am deploying the client to machines that are already out in the field to get them into my host list for later. Forcing a reboot is disruptive to the current users, and right now I can’t even use the PXE inventory task as they aren’t set for PXE to be their primary boot device. adding this feature to the client would be really helpful.

It would be great to add SSL for the web interface. Both self signed as a default and an option to add your own 3rd existing cert.