@Tom-Elliott

so nice !!! Fantastic !!! So are so Great !!!

one last question : at this moment in .fogsettings, I put the line “secureboot=‘0’”
Do you suggest me to put it back to “1” ?
I am asking this beacause all of my computers now use UEFI bios.

@Tom-Elliott

So the result of the check on server-side is :
CN=(good IP) , O=FOG Project, OU=FOG Client Communication
error 20 at 0 depth lookup: unable to get local issuer certificate
error /var/www/html/fog/management/other/ssl/srvpublic.crt: verification failed

sha1 Fingerprint=90:81:0E:51:53:A0:38:56:D8:37:A9:B8:C1:6F:6E:1C:B6:C8:35:CF

on client-side
nslookup : ip of the server is OK

certlm.msc :
FOG PROJECT CA date from 29 dec 2019 to 30 dec 2029
FOG SERVER CA date from 04 nov 2026 to 27 oct 2056 fingerprint is same as sha1 fingerprint of server-file ca.cert.pem (…c8 35 cf)

@Tom-Elliott

I’ve been tryin many things meanwhile. I found that debian native certificates were wrong because I started this server with another hostname and IP (to organize a transition with old server) .
I made corrections to the fqdn-hostname and put the right new ip address in /etc/hosts.
I rebuilt the native debian certificate (snakeoil). This debian certificate is now OK.

After that I had some troubles to restart Apache, but I finally fixed it.

I rebuilt the keys end certificates about FOG , after manually deleted ALL (I hope so…) of them.
So the date of the files is actual : november 04.
But the content is bad : old IP address and start-date on 21 May. in file /var/www/html/fog/management/other/ssl/srvpublic.crt

the file …/snapins/ssl/.srvpublic.crt does NOT exist

Now I found your recent answer about the hidden file.
The IP address inside srvpublic.crt is fine. The starting and ending date of the certificate are fine (nov 04 2026 to nov 01 2036)

I restarted apache2.

Unfortunately, it still does not match on the client.

• RSA ERROR: Certificate validation failed
• RSA ERROR : Truste chain did not complete to the known authority anchor. Error : …(NotSignatureValid).
• Authentication error : could not authenticate
• Authentication error : certificate is not from FOG CA

I will try do desintall/resintall the client.

no better

@Tom-Elliott
Thanks for your helpful support, Tom.

running “openssl verify” gives me some errors in return

1rst line : CN=an old ip address X.Y.Z.87 that I was using as a transition few monthes ago
2nd line : error 20 atcd erro 0 depth lookup: unable to get local issuer certificate
3rd line : error /var/www/html/fog/management/other/ssl/srvpublic.crt: verification failed

I can find this ip-address twice in the file /opt/fog/snapins/ssl/req.cnf~ (which is dated May 21)
But the the file /opt/fog/snapins/ssl/req.cnf is OK (with the right ip address) (dated today)l

So I guess one (the only ??? not sure) reason of the problem is because

• the new ip of my server is not completely taken in account
• or the process fails to replace an old certificate file (access rights problem ?)

I deleted many files (including hidden files like .fogCA.key and .fogCA.pem for example) about certificates

I restarted ./installfog -y -K
Still the verifying process gives me the old ip-address in return

Removing the installation folder.
Re-creating the installation folder (from .tar file)
starting again ./installfog.sh -y -K
checking again…
still old ip-address in the certificates , still exactly the same error-messages

Some parts of file “fog_error_1.5.10.2482.log”
Could not open file or uri for loading certificate from /opt/fog/pki/secureboot/ca/.fogSBCA.pem: No such file or directory
…
/usr/sbin/update-ca-certificates
Updating certificates in /etc/ssl/certs…
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d…
done.

some parts of file “foginstall.log”
210: * Installing Secure Boot signing helper…/lib/common/functions.sh: ligne 6134: /etc/sudoers.d/fog-secureboot.tmp: Aucun fichier ou dossier de ce nom
211: * Failed
215: * Could not read /opt/fog/pki/secureboot/ca/.fogSBCA.pem as a certificate.
220: * Publishing client communication certificate…OK
221: * Creating auth pub key and cert…OK
258: # intermediate, or a certificate for a new storage node. #

folder “/opt/fog/pki/secureboot/ca” does not exist (folder “leaf” exists in that location)
–> creating it manually
restarting ./installfog.sh -y -K
folder …/ca/ remains empty

Where could it find that old IP-address X.Y.Z.87 from ?

Thanks for your help,

So

• I restarted the installation ./installfog.sh -y
• restarted the server after that
• desinstalled the FOGclient
• checked in certlm.msc (no more fog certificate)
• re-installed the FOG client
• manually downloaded “servpublic.crt” to check it : date from 21 may 2026 to 18 may 2036 (is the starting date normal ???)
• started the Fog client

still errors in fog.log.
RSA ERROR: Certificate validation failed
…
Authentication error : certificatate is not from FOG CA

Should I destroy the host in the web-console ?

Hello,
Just moved my FOG-server to version 1.5.10.2482 on Debian 13.5

used “./installfog.sh -y -C”

During installation/update the process was uncapable to generate new certificates , giving this kind of error-message “Cannot read Secure Boot signing file: /opt/fog/pki/secureboot/leaf/sign.key”

The Google’s IA showed me a way to generate manually those certificates

But now, the computer-stations still cannot communicate well with the server

Middleware::Communication Download: http://fogserver/fog/management/other/ssl/srvpublic.crt
Data::RSA FOG Server CA cert found
Data::RSA ERROR: Certificate validation failed
Data::RSA ERROR: Trust chain did not complete to the known authority anchor. Thumbprints did not match.
Middleware::Authentication ERROR: Could not authenticate
Middleware::Athentication ERROR: Certificate is not from FOG CA

Also I noticed that folder /var/www/fog/management/other/ssl/ does not contain the file srvpublic.crt although downloading of that file works. Is it a redirection inside Apache configuration ?

Should I completely destroy my server and build a new one to fix the problem ? Already spent many hours vannishing trying to fix it by myself.