Meschcentral multidomain problem with certificate file #6355

GaunterOddim · 2024-09-02T11:04:08Z

GaunterOddim
Sep 2, 2024

Hello,

How would it be possible to solve this warning: "WARNING: File "webserver-strawberry-cert-public.crt" missing, domain "strawberry" will not work correctly."?
Because the strawberry domain really dose not work. But https://t1.cloud.eu and https://t2.cloud.eu - works perfectly.

In front of meshcentral there is a nginx or haproxy server. I have tried both, but meshcentral shows the same warning. They handle all the SSL certificates.

config.json:

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are igno>
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "t1.cloud.eu",
    "WANonly": true,
    "port": 4443,
    "_aliasPort": 443,
    "redirPort": 0,
    "_redirAliasPort": 80,
    "manageAllDeviceGroups": ["user//test"],
    "manageCrossDomain": ["user//test"],
    "tlsoffload": "172.16.4.11"
  },
  "domains": {
    "": {
      "title": "MAIN MyServer",
      "_title2": "Servername",
      "certUrl": "https://t1.cloud.eu:4443",
    },
    "t2": {
        "title": "T2",
        "newAccounts": false,
        "dns": "t2.cloud.eu",
        "certUrl": "https://t2.cloud.eu:4443"
    },
    "strawberry": {
        "title": "strawberry IT",
        "newAccounts": false,
        "dns": "strawberry.dev.example.com",
        "certUrl": "https://strawberry.dev.example.com:4443"
    }
  },
  "_letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "[email protected]",
    "names": "myserver.mydomain.com",
    "skipChallengeVerification": true,
    "production": false
  }
}

Meshcentral debug:

WARNING: File "webserver-strawberry-cert-public.crt" missing, domain "strawberry" will not work correctly.
MeshCentral v1.1.27, WAN mode.
DISPATCH: AddEventDispatch [ 'server-shareremove' ]
CERT: loadCertificate() - Loading certificate from t1.cloud.eu:4443, Hostname: t1.cloud.eu...
CERT: loadCertificate() - Loading certificate from t2.cloud.eu:4443, Hostname: t2.cloud.eu...
CERT: loadCertificate() - Loading certificate from strawberry.dev.example.com:4443, Hostname: strawberry.dev.example.com...
DISPATCH: AddEventDispatch [ '*' ]
DISPATCH: DispatchEvent [ '*' ]
MAIN: Server started
MeshCentral Intel(R) AMT server running on t1.cloud.eu:4433.
AUTHLOG: Server listening on 0.0.0.0 port 4433.
Server strawberry has no users, next new account will be site administrator.
MeshCentral HTTP server running on port 4443.
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t1.cloud.eu:4443", host: "t1.cloud.eu"
  SHA384 cert hash: 3bb7c74f2be51ed5627398fb7b5bcd7ae8574954022e57d8c9cf4aaa5bffda1e257cddb9252373619ee7ad7e02bafe06
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t2.cloud.eu:4443", host: "t2.cloud.eu"
  SHA384 cert hash: 8f35c79c151eee71d4acd16dbfc1a2c827f3a23d60bcb7c5ab45cc18e718653aaf4c580e731c97f3fa0a4202961649c4
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://strawberry.dev.example.com:4443", host: "strawberry.dev.example.com"
  SHA384 cert hash: b2a56b409c4a1265a55130f13dd28a3693950d8f08d83f9acdbf9761d34c642a9e3625161f6099d23e410433883faba2

si458 · 2024-09-02T13:01:19Z

si458
Sep 2, 2024
Collaborator

the message WARNING: File "webserver-strawberry-cert-public.crt" missing, domain "strawberry" will not work correctly.
only appears IF the file webserver-strawberry-cert-public.crt doesnt exists inside your meshcentral-data folder
AND you have tlsoffload set to true or an ip address (which you have)

have you checked you can actually visit https://strawberry.dev.example.com:4443 from your meshcentral server?
you can check with curl -v https://strawberry.dev.example.com:4443

0 replies

GaunterOddim · 2024-09-02T13:44:23Z

GaunterOddim
Sep 2, 2024
Author

For the security reasons IP and domains are changed.
It opens form the meshcentral server and shows the default domain page (I also tried with the new fresh install of proxy and meshcentral servers):

Trying 1.2.3.4:4443...
Connected to strawberry.dev.example.com (1.2.3.4) port 4443 (#0)
ALPN: offers h2,http/1.1
TLSv1.3 (OUT), TLS handshake, Client hello (1):
CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
TLSv1.3 (IN), TLS handshake, Certificate (11):
TLSv1.3 (IN), TLS handshake, CERT verify (15):
TLSv1.3 (IN), TLS handshake, Finished (20):
TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
TLSv1.3 (OUT), TLS handshake, Finished (20):
SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
ALPN: server accepted h2
Server certificate:
subject: CN=strawberry.dev.example.com
start date: Aug 14 17:45:29 2024 GMT
expire date: Nov 12 17:45:28 2024 GMT
subjectAltName: host "strawberry.dev.example.com" matched cert's "strawberry.dev.example.com"
issuer: C=US; O=Let's Encrypt; CN=E6
SSL certificate verify ok.
using HTTP/2
h2h3 [:method: GET]
h2h3 [:path: /]
h2h3 [:scheme: https]
h2h3 [:authority: strawberry.dev.example.com:4443]
h2h3 [user-agent: curl/7.88.1]
h2h3 [accept: /]
Using Stream ID: 1 (easy handle 0x585f1186bce0)

GET / HTTP/2
Host: strawberry.dev.example.com:4443
user-agent: curl/7.88.1
accept: /

TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
old SSL session ID is stale, removing
< HTTP/2 200
< referrer-policy: no-referrer
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff
< content-security-policy: default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' wss://strawberry.dev.example.com:4443; img-src 'self' blob: data: data:; style-src 'self' 'unsafe-inline'; frame-src 'self' blob: mcrouter:; media-src 'self'; form-action 'self'; manifest-src 'self'
< x-frame-options: sameorigin
< strict-transport-security: max-age=63072000
< cache-control: no-store
< content-type: text/html; charset=utf-8
< content-length: 73703
< etag: W/"11fe7-WtDHGAUzuoQd2zHX93aUEn4ssok"
< set-cookie: xid=e30=; path=/; samesite=lax; httponly
< set-cookie: xid.sig=QBqroBQ8FbE1p5TOAH9v7iHEE0fQ-fKqNOFfu2I19jeoWSpCGLqnp30jVb2JaY7h; path=/; samesite=lax; httponly
< vary: Accept-Encoding
< date: Mon, 02 Sep 2024 13:12:20 GMT
<

... and so on ...

I made a strawberry the main domain in config.json. Then it works without warnings.
True, in meshcentral-data folder there is no webserver-strawberry-cert-public.crt even after changes in the default domain.
There are only t1 and t2 key and crt files.

1 reply

si458 Sep 2, 2024
Collaborator

ok very weird as your config looks all correct to begin with?
have you tried stopping meshcentral, changing config.json back to what u listed above, then restart meshcentral?
does it still show the error?
does the webserver-strawberry-cert-public.crt appear in meshcentral-data ?

GaunterOddim · 2024-09-02T16:36:00Z

GaunterOddim
Sep 2, 2024
Author

Ok, I switched back to the first config. Where strawberry is not the default domain.

First restart of meshcentral and debug info:

MAIN: Core module linux-tiny is 6305 bytes.
Error: t1.cloud.eu does not match name in TLS certificate: strawberry.dev.example.com, localhost
Generating certificates, may take a few minutes...
Generating HTTPS certificate...
Generating Intel AMT MPS certificate...
MeshCentral v1.1.27, WAN mode.
MAIN: Code signing with arguments: {"out":"/opt/meshcentral/meshcentral-data/signedagents/MeshService.exe","desc":"MAIN MyServer","url":"https://t1.cloud.eu:4443/","time":"http://timestamp.comodoca.com/authenticode","proxy":null}
MAIN: Code signing with arguments: {"out":"/opt/meshcentral/meshcentral-data/signedagents/MeshService64.exe","desc":"MAIN MyServer","url":"https://t1.cloud.eu:4443/","time":"http://timestamp.comodoca.com/authenticode","proxy":null}
MAIN: Code signing with arguments: {"out":"/opt/meshcentral/meshcentral-data/signedagents/MeshServiceARM64.exe","desc":"MAIN MyServer","url":"https://t1.cloud.eu:4443/","time":"http://timestamp.comodoca.com/authenticode","proxy":null}
MAIN: Code signing with arguments: {"out":"/opt/meshcentral/meshcentral-data/signedagents/MeshCmd.exe","desc":"MAIN MyServer","url":"https://t1.cloud.eu:4443/","time":"http://timestamp.comodoca.com/authenticode","proxy":null}
MAIN: Code signing with arguments: {"out":"/opt/meshcentral/meshcentral-data/signedagents/MeshCmd64.exe","desc":"MAIN MyServer","url":"https://t1.cloud.eu:4443/","time":"http://timestamp.comodoca.com/authenticode","proxy":null}
MAIN: Code signing with arguments: {"out":"/opt/meshcentral/meshcentral-data/signedagents/MeshCmdARM64.exe","desc":"MAIN MyServer","url":"https://t1.cloud.eu:4443/","time":"http://timestamp.comodoca.com/authenticode","proxy":null}
Code signed MeshCmd64.exe.
Code signed MeshServiceARM64.exe.
Code signed MeshService.exe.
Code signed MeshService64.exe.
Code signed MeshCmd.exe.
Code signed MeshCmdARM64.exe.
DISPATCH: AddEventDispatch [ 'server-shareremove' ]
CERT: loadCertificate() - Loading certificate from t1.cloud.eu:4443, Hostname: t1.cloud.eu...
CERT: loadCertificate() - Loading certificate from t2.cloud.eu:4443, Hostname: t2.cloud.eu...
CERT: loadCertificate() - Loading certificate from strawberry.dev.example.com:4443, Hostname: strawberry.dev.example.com...
DISPATCH: AddEventDispatch [ '' ]
DISPATCH: DispatchEvent [ '' ]
MAIN: Server started
MeshCentral Intel(R) AMT server running on t1.cloud.eu:4433.
AUTHLOG: Server listening on 0.0.0.0 port 4433.
Server strawberry has no users, next new account will be site administrator.
MeshCentral HTTP server running on port 4443.
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t1.cloud.eu:4443", host: "t1.cloud.eu"
SHA384 cert hash: 3bb7c74f2be51ed5627398fb7b5bcd7ae8574954022e57d8c9cf4aaa5bffda1e257cddb9252373619ee7ad7e02bafe06
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://strawberry.dev.example.com:4443", host: "strawberry.dev.example.com"
SHA384 cert hash: b2a56b409c4a1265a55130f13dd28a3693950d8f08d83f9acdbf9761d34c642a9e3625161f6099d23e410433883faba2
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t2.cloud.eu:4443", host: "t2.cloud.eu"
SHA384 cert hash: 8f35c79c151eee71d4acd16dbfc1a2c827f3a23d60bcb7c5ab45cc18e718653aaf4c580e731c97f3fa0a4202961649c4

Second restart of meshcentral and debug info:

MAIN: Core module linux-tiny is 6305 bytes.
WARNING: File "webserver-strawberry-cert-public.crt" missing, domain "strawberry" will not work correctly.
MeshCentral v1.1.27, WAN mode.
DISPATCH: AddEventDispatch [ 'server-shareremove' ]
CERT: loadCertificate() - Loading certificate from t1.cloud.eu:4443, Hostname: t1.cloud.eu...
CERT: loadCertificate() - Loading certificate from t2.cloud.eu:4443, Hostname: t2.cloud.eu...
CERT: loadCertificate() - Loading certificate from strawberry.dev.example.com:4443, Hostname: strawberry.dev.example.com...
DISPATCH: AddEventDispatch [ '' ]
DISPATCH: DispatchEvent [ '' ]
MAIN: Server started
MeshCentral Intel(R) AMT server running on t1.cloud.eu:4433.
AUTHLOG: Server listening on 0.0.0.0 port 4433.
Server strawberry has no users, next new account will be site administrator.
MeshCentral HTTP server running on port 4443.
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t2.cloud.eu:4443", host: "t2.cloud.eu"
SHA384 cert hash: 8f35c79c151eee71d4acd16dbfc1a2c827f3a23d60bcb7c5ab45cc18e718653aaf4c580e731c97f3fa0a4202961649c4
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://strawberry.dev.example.com:4443", host: "strawberry.dev.example.com"
SHA384 cert hash: b2a56b409c4a1265a55130f13dd28a3693950d8f08d83f9acdbf9761d34c642a9e3625161f6099d23e410433883faba2
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t1.cloud.eu:4443", host: "t1.cloud.eu"
SHA384 cert hash: 3bb7c74f2be51ed5627398fb7b5bcd7ae8574954022e57d8c9cf4aaa5bffda1e257cddb9252373619ee7ad7e02bafe06

I have checked the folder, but as we see from the warning, there are no webserver-strawberry-cert-public.crt file in the folder.
It is quite an interesting problem, but it happens on two different meshcentral servers.

0 replies

GaunterOddim · 2024-09-03T13:15:49Z

GaunterOddim
Sep 3, 2024
Author

I have deleted all webserver-*-cert-public.crt files from meshcentral-data folder.
Restarted the server. In meshcentral-data folder there were no any new crt files created.
In this case, only the default domain was working.

So it could be the problem that for some reason meshcentral is not creating a new crt files.
How would it be possible to find out what is the problem?

The interesting point is that in some way, some time ago there were created 2 crt files for 2 domains.

3 replies

si458 Sep 3, 2024
Collaborator

ive rechecked the code and if you are using tlsoffload and certurl then certificates wont get generated
this is correct as it uses your certificates and not its own!
but it still doesnt explain why the main domain and ur t1 works, but the t2 doesnt?
if the maybe some differences between ur t1 reverse proxy and t2 reverse proxy configs?

GaunterOddim Sep 3, 2024
Author

It feels like at first meshcentral is looking for the crt files.
All other domains are not working, because meshcentral can't find crt files. The same warning like in first post.
First meshcentral can't find crt files, but latter it loads all three web certificates from the proxy.
Maybe the certificates are different and it is not the same what for meshcentral are looking?

Anyway, haproxy.cfg:

global
	log /dev/log	local0
	log /dev/log	local1 notice
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
	stats timeout 30s
	user haproxy
	group haproxy
	daemon

	# Default SSL material locations
	ca-base /etc/ssl/certs
	crt-base /etc/ssl/private

	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
	log	global
	mode	http
	option	httplog
	option	dontlognull
        timeout connect 5000ms
        timeout client  50000ms
        timeout server  50000ms
	errorfile 400 /etc/haproxy/errors/400.http
	errorfile 403 /etc/haproxy/errors/403.http
	errorfile 408 /etc/haproxy/errors/408.http
	errorfile 500 /etc/haproxy/errors/500.http
	errorfile 502 /etc/haproxy/errors/502.http
	errorfile 503 /etc/haproxy/errors/503.http
	errorfile 504 /etc/haproxy/errors/504.http

# Frontend for SSL passthrough and termination
frontend https-in-termination
    bind *:443 ssl crt haproxy_br_cert.pem crt /etc/letsencrypt/live/t1.cloud.eu/haproxy_cert.pem crt /etc/letsencrypt/live/t2.cloud.eu/haproxy_cert.pem
    mode http
    option forwardfor
    http-request add-header X-Forwarded-Proto https

    acl host_t1 hdr_dom(host) -i t1.cloud.eu
    acl host_t2 hdr_dom(host) -i strawberry.dev.example.com
    acl host_t3 hdr_dom(host) -i t2.cloud.eu

    use_backend meshcentral-backend if host_t1 or host_t2 or host_t3

# Backend definition to serve as a fallback for SSL termination
backend https-in-termination-backend
    mode http
    server localhost 127.0.0.1:7443

backend meshcentral-backend
    mode http
    server meshcentral_server 172.16.6.10:4443 check

GaunterOddim Sep 4, 2024
Author

It seems I have found a workaround.

You have to disable tlsoffload. Start the meshcentral service. Missing crt files will be created. All domains are not working ofcourse.

Debug info:

...
MAIN: Core module linux-tiny is 6305 bytes.
Generating certificates, may take a few minutes...
Generating HTTPS certificate for t2...
Generating HTTPS certificate for strawberry...
MeshCentral v1.1.27, WAN mode.
DISPATCH: AddEventDispatch [ 'server-shareremove' ]
CERT: loadCertificate() - Loading certificate from t1.cloud.eu:4443, Hostname: t1.cloud.eu...
CERT: loadCertificate() - Loading certificate from t2.cloud.eu:4443, Hostname: t2.cloud.eu...
CERT: loadCertificate() - Loading certificate from strawberry.dev.example.com:4443, Hostname: strawberry.dev.example.com...
DISPATCH: AddEventDispatch [ '*' ]
DISPATCH: DispatchEvent [ '*' ]
MAIN: Server started
MeshCentral Intel(R) AMT server running on t1.cloud.eu:4433.
AUTHLOG: Server listening on 0.0.0.0 port 4433.
Server strawberry has no users, next new account will be site administrator.
HTTPS: Server listening on 0.0.0.0 port 4443.
MeshCentral HTTPS server running on t1.cloud.eu:4443.
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t2.cloud.eu:4443", host: "t2.cloud.eu"
  SHA384 cert hash: 8f35c79c151eee71d4acd16dbfc1a2c827f3a23d60bcb7c5ab45cc18e718653aaf4c580e731c97f3fa0a4202961649c4
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t1.cloud.eu:4443", host: "t1.cloud.eu"
  SHA384 cert hash: 3bb7c74f2be51ed5627398fb7b5bcd7ae8574954022e57d8c9cf4aaa5bffda1e257cddb9252373619ee7ad7e02bafe06
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://strawberry.dev.example.com:4443", host: "strawberry.dev.example.com"
  SHA384 cert hash: b2a56b409c4a1265a55130f13dd28a3693950d8f08d83f9acdbf9761d34c642a9e3625161f6099d23e410433883faba2

You have to enable tlsoffload. Restart the meshcentral server. All domains are working.

Debug info:

...
MAIN: Core module linux-tiny is 6305 bytes.
MeshCentral v1.1.27, WAN mode.
DISPATCH: AddEventDispatch [ 'server-shareremove' ]
CERT: loadCertificate() - Loading certificate from t1.cloud.eu:4443, Hostname: t1.cloud.eu...
CERT: loadCertificate() - Loading certificate from t2.cloud.eu:4443, Hostname: t2.cloud.eu...
CERT: loadCertificate() - Loading certificate from strawberry.dev.example.com:4443, Hostname: strawberry.dev.example.com...
DISPATCH: AddEventDispatch [ '*' ]
DISPATCH: DispatchEvent [ '*' ]
MAIN: Server started
MeshCentral Intel(R) AMT server running on t1.cloud.eu:4433.
AUTHLOG: Server listening on 0.0.0.0 port 4433.
Server strawberry has no users, next new account will be site administrator.
MeshCentral HTTP server running on port 4443.
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t2.cloud.eu:4443", host: "t2.cloud.eu"
  SHA384 cert hash: 8f35c79c151eee71d4acd16dbfc1a2c827f3a23d60bcb7c5ab45cc18e718653aaf4c580e731c97f3fa0a4202961649c4
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://t1.cloud.eu:4443", host: "t1.cloud.eu"
  SHA384 cert hash: 3bb7c74f2be51ed5627398fb7b5bcd7ae8574954022e57d8c9cf4aaa5bffda1e257cddb9252373619ee7ad7e02bafe06
CERT: loadCertificate() - TLS connected, got certificate.
Loaded web certificate from "https://strawberry.dev.example.com:4443", host: "strawberry.dev.example.com"
  SHA384 cert hash: b2a56b409c4a1265a55130f13dd28a3693950d8f08d83f9acdbf9761d34c642a9e3625161f6099d23e410433883faba2

It seems it is just a workaround. It would be nice to find the real problem or bug.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Meschcentral multidomain problem with certificate file #6355

{{title}}

Replies: 4 comments 4 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Meschcentral multidomain problem with certificate file #6355

GaunterOddim Sep 2, 2024

Replies: 4 comments · 4 replies

si458 Sep 2, 2024 Collaborator

GaunterOddim Sep 2, 2024 Author

si458 Sep 2, 2024 Collaborator

GaunterOddim Sep 2, 2024 Author

GaunterOddim Sep 3, 2024 Author

si458 Sep 3, 2024 Collaborator

GaunterOddim Sep 3, 2024 Author

GaunterOddim Sep 4, 2024 Author

GaunterOddim
Sep 2, 2024

Replies: 4 comments 4 replies

si458
Sep 2, 2024
Collaborator

GaunterOddim
Sep 2, 2024
Author

si458 Sep 2, 2024
Collaborator

GaunterOddim
Sep 2, 2024
Author

GaunterOddim
Sep 3, 2024
Author

si458 Sep 3, 2024
Collaborator

GaunterOddim Sep 3, 2024
Author

GaunterOddim Sep 4, 2024
Author