1

I've installed Landscape on a new install of Ubuntu 16.04, and I am trying to register clients with it. We have created a CA and signed our certificate (https://help.landscape.canonical.com/LDS/SSL). We also added the certificate to the trusted certificates on the client.

Now we try to connect our client (Ubuntu 16.04) to the Server with the following command:

sudo landscape-config --computer-title "Agent" --account-name standalone  --url https://landskap/message-system --ping-url http://landskap/ping --ssl-public-key=/etc/ssl/certs/landscape_server_ca.pem

After the configuration dialog this error message appears:

The server's SSL information is incorrect, or fails signature verification! If the server is using a self-signed certificate, please ensure you supply it with the --ssl-public-key parameter.

Yes our server is called 'Landskap'...

We've checked on the client, if there is any additional information in /var/log/landscape/broker.log and found the following error entry.

PyCurlError: Error 60: server certificate verification failed. CAfile: /usr/local/share/ca-certificates/landscape_server_ca.crt CRLfile: none
2017-04-18 14:08:38,978 ERROR    [MainThread] Message exchange failed: server certificate verification failed. CAfile: /usr/local/share/ca-certificates/landscape_server_ca.crt CRLfile: none
2017-04-18 14:08:38,978 INFO     [MainThread] Message exchange failed.
2017-04-18 14:08:38,979 INFO     [MainThread] Message exchange completed in 0.17s.
2017-04-18 14:09:38,982 INFO     [MainThread] Starting urgent message exchange with https://landskap/message-system.
2017-04-18 14:09:39,149 ERROR    [PoolThread-twisted.internet.reactor-0] Error contacting the server at https://landskap/message-system.
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/landscape/broker/transport.py", line 71, in exchange
    message_api)
  File "/usr/lib/python2.7/dist-packages/landscape/broker/transport.py", line 45, in _curl
    headers=headers, cainfo=self._pubkey, curl=curl))
  File "/usr/lib/python2.7/dist-packages/landscape/lib/fetch.py", line 109, in fetch
    raise PyCurlError(e.args[0], e.args[1])

Please help us :(

0

5 Answers 5

2

Unable to test currently, but the Quick Start Guide suggests to add the certificate file to /etc/landscape/client.conf with this line:

ssl_public_key = /etc/landscape/server.pem
1
  • Thanks for your reply. The configuration command already added this line to the configuration file. The error still appears.
    – Jonas Mock
    Apr 19, 2017 at 5:53
1

I just went through this on a brand new installation of Landscape using the quickstart and a self signed cert.

The procedure I went through to fix it was

  1. Copy the certificate from /etc/ssl/certs/landscape_server_ca.crt on the landscape server to the client server and put it in /etc/landscape
  2. Edit /etc/landscape/client.conf and add the line: ssl_public_key = /etc/landscape/landscape_server_ca.crt
  3. Run the registration request again
0

We found out that the quickstarter installation already generates a certificate by himself. There is no need to generate another one. Simply copy the certificate from /etc/landscape/landscape_server.pem to the client's /etc/landscape/folder. The recommendation of @Grayson Kent was correct. Add the following line to the configuration file in /etc/landscape/client.conf ssl_public_key = /etc/landscape/landscape_server.pem

1
  • Now, using Landscape v19.10, the quickstarter installation doesn't put it in /etc/landscape/ but rather /etc/ssl/certs/ per @Mick Kerr's answer
    – jspinella
    Jan 29, 2022 at 6:59
0

I recently struggled with this problem as well. For me, however, the solution provided for the limited problem description was not the right path.

My problem for this exact same error code was that my SSL certificate expired. Please see my experience and troubleshooting steps to determine the problem on my blog at http://realworldnumbers.com/ubuntu-landscape-problems/ .

Essentially,

  1. Check broker logs on one of the client systems.

    tail -n 100 /var/log/landscape/broker.log | grep certificate
    
  2. If you see Error 60, try verifying the certificate using curl. Verify the certificate using a curl command to the IP address of the Landscape server. In my case this was:

    $ curl https://192.168.168.67/message-system
    curl: (60) server certificate verification failed.
    
  3. Use openSSL to verify the specific details about the certificate chain.

    openssl s_client -connect 192.168.168.67:443
    

    In my case, the important parts of this output that indicated expired certificate was:

    Verify return code: 10 (certificate has expired)
    verify error:num=10:certificate has expired
    notAfter=Sep 23 00:00:19 2017 GMT
    

So you'll have to generate and sign a new certificate using the instructions at the landscape help documentation. My recommendation here is to generate a 30 year CA and certificate. The default was 1 year and I can't imagine updating the cert on an annual basis. There doesn't seem to be a warning alert to this expiring certificate within Landscape itself.

4
  • You could improve your answer for future readers by summarizing the steps necessary to check and correct the problem.
    – J. Starnes
    Nov 6, 2017 at 0:11
  • Could - but then i'd just be repeating myself. Did this help you, or just lurkin? Nov 7, 2017 at 13:32
  • As a first answer the system placed your post the review queue. The Stack exchange system then let other users know that there were items that needed reviewed, I was one of those users. Based on the review guide lines for link only answers, I commented on your answer to suggest an improvement.
    – J. Starnes
    Nov 7, 2017 at 15:31
  • OK, cool. I'll be happy to update with a little more detail. Nov 9, 2017 at 2:16
0

My problem was that the IP under Landscape-Organisation-Settings was a default one, rather than my server. Just had to change to my server IP. When using the server IP in the browser rather than my domain name gave me https errors, so I went to my Domain Name Service and pointed it to my Landscape server IP and used my domain name instead of server IP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .