[RESOLVED] Certificate issue when upgrading from 2.4 to 2.5

[Max.R]

- Installed WAPT version: 2.5.3
- Server OS: Windows Server 2019
- Administration/package creation machine OS: Windows 11

Hello,

I updated WAPT from version 2.4 to 2.5.3, but I'm encountering a certificate problem.
A "Warning: Potential security risk" pop-up appears when I try to configure the WAPT console.
I'm using a self-signed certificate, and when I click "Trust," it just restarts the security warning window in a loop.
There is a link to a tutorial about certificate pinning, but I get a 404 error when I try to follow it.

Is there a link to a tutorial on how to validate my self-signed certificate?

Sincerely

[sfonteneau]

Did you enter a name or an IP address in the console?

This happens when the name you're using doesn't match the name in the certificate.

[Max.R]

It's a name, I performed an upgrade without changing anything.

[sfonteneau]

And previously, did you verify the HTTPS certificate?

(look at the wapt-get.ini file) in "C:\Program Files (x86)\wapt" and check the value of verify_cert

[Max.R]

For [Global] verify_cert=0, for [wapt-templates] verify_cert=1.

However, looking in the ini file, I saw that the server is pointed to via its IP address.

I checked the warning message, and the certificate I'm being asked to trust is linked to the IP address and not the server name.

[sfonteneau]

So historically you do not verify the https certificate.

The only thing that changed in 2.5 is that now the "verify https certificate" box is checked by default.

In your case, we suggest "Trust" (verify the certificate in pinning mode) but this will only work if the name in the certificate matches.

At the end of the postconf session, the certificate data will be displayed:

Code: Select all

Waptserver certificate
 Subject:   {'commonName': 'srvwapt.testsf.lan'}
    Issuer :   CN=srvwapt.testsf.lan
    Altnames:  ['srvwapt.testsf.lan', IPv4Address('10.11.6.235')]
    SHA1:      e8274087ccec6d0239866ec5920c76488303a954
    SHA256:    88ad24feabb5e1e36c2176fb0e0b9fcc33d415e7508ab6cfd706d3d9b457272b

In my case, in Altnames, you can perform HTTPS certificate verification with srvwapt.testsf.lan or the IP address 10.11.6.235

[Max.R]

Hello,

I disabled automatic verification and was then able to connect to the console.

However, it switched me to "Discovery" mode even though I'm on an "Enterprise" server with an empty workstation inventory (probably because the client couldn't be updated on the workstations?). The private repository is working fine.

So I tried to re-import my license key, but I'm getting an "Error activating license" message.

[dcardon]

Hello Maxime,

could you please try upgrading to the latest version 2.5.4.15337 to see if you still have the problem?

Regarding disabling HTTPS, it's recommended to push a package to reconfigure the WaptServer URL on the clients and then re-enable it.

Regards,

Denis

[Max.R]

Hello,

I've finally opted for a rollback to version 2.4.

I'll upgrade to 2.5 when I have a bit more time to dedicate to it.

In any case, thank you to your team for your help.