Page 1 of 1
[RESOLVED] Certificate issue when upgrading from 2.4 to 2.5
Published: February 12, 2024 - 5:37 PM
by Max.R
- Installed WAPT version: 2.5.3
- Server OS: Windows Server 2019
- Administration/package creation machine OS: Windows 11
Hello,
I updated WAPT from version 2.4 to 2.5.3, but I'm encountering a certificate problem.
A "Warning: Potential security risk" pop-up appears when I try to configure the WAPT console.
I'm using a self-signed certificate, and when I click "Trust," it just restarts the security warning window in a loop.
There is a link to a tutorial about certificate pinning, but I get a 404 error when I try to follow it.
Is there a link to a tutorial on how to validate my self-signed certificate?
Sincerely
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 12, 2024 - 5:47 PM
by sfonteneau
Did you enter a name or an IP address in the console?
This happens when the name you're using doesn't match the name in the certificate.
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 12, 2024 - 5:53 PM
by Max.R
It's a name, I performed an upgrade without changing anything.
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 12, 2024 - 5:59 PM
by sfonteneau
And previously, did you verify the HTTPS certificate?
(look at the wapt-get.ini file) in "C:\Program Files (x86)\wapt" and check the value of verify_cert
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 12, 2024 - 6:09 PM
by Max.R
For [Global] verify_cert=0, for [wapt-templates] verify_cert=1.
However, looking in the ini file, I saw that the server is pointed to via its IP address.
I checked the warning message, and the certificate I'm being asked to trust is linked to the IP address and not the server name.
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 13, 2024 - 9:25 AM
by sfonteneau
So historically you do not verify the https certificate.
The only thing that changed in 2.5 is that now the "verify https certificate" box is checked by default.
In your case, we suggest "Trust" (verify the certificate in pinning mode) but this will only work if the name in the certificate matches.
At the end of the postconf session, the certificate data will be displayed:
Code: Select all
Waptserver certificate
Subject: {'commonName': 'srvwapt.testsf.lan'}
Issuer : CN=srvwapt.testsf.lan
Altnames: ['srvwapt.testsf.lan', IPv4Address('10.11.6.235')]
SHA1: e8274087ccec6d0239866ec5920c76488303a954
SHA256: 88ad24feabb5e1e36c2176fb0e0b9fcc33d415e7508ab6cfd706d3d9b457272b
In my case, in Altnames, you can perform HTTPS certificate verification with srvwapt.testsf.lan or the IP address 10.11.6.235
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 13, 2024 - 1:39 PM
by Max.R
Hello,
I disabled automatic verification and was then able to connect to the console.
However, it switched me to "Discovery" mode even though I'm on an "Enterprise" server with an empty workstation inventory (probably because the client couldn't be updated on the workstations?). The private repository is working fine.
So I tried to re-import my license key, but I'm getting an "Error activating license" message.
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 15, 2024 - 4:46 PM
by dcardon
Hello Maxime,
could you please try upgrading to the latest version 2.5.4.15337 to see if you still have the problem?
Regarding disabling HTTPS, it's recommended to push a package to reconfigure the WaptServer URL on the clients and then re-enable it.
Regards,
Denis
Re: Certificate problem when upgrading from 2.4 to 2.5
Published: February 19, 2024 - 6:17 PM
by Max.R
Hello,
I've finally opted for a rollback to version 2.4.
I'll upgrade to 2.5 when I have a bit more time to dedicate to it.
In any case, thank you to your team for your help.