Cannot connect client to landscape server: certificate issue

Question

I've installed Landscape on a new install of Ubuntu 14.04, and I am trying to register clients with it. While attempting to register, I get the "cannot contact server" message and then it returns to a prompt.

I've determined that the issue is certificate based.
wget https://servername.domain.com fails with "encountered self signed certificate error", while
wget https://servername.domain.com --no-check-certificate works fine.

So, based on that, I followed the guide here: https://help.landscape.canonical.com/LDS/SSL and still get the same thing. I ran the update certs command, and it said it updated the one cert I added, but registration and wget still fails. What can I check next?

MORE INFO: Researching the issue I came across the command "openssl s_client -connect whateversite.com:443 -debug". Running it with the FQDN returns

gethostbyname failure
connect:errno=0

While running with the IP address returns a lot of information that I'm not sure what to do with. Something I noticed a couple of times is:

depth=0 CN = Landscape
verify error:num=18:self signed certificate
verify return:1

I've looked at the certificate I created using the guide above, and the output of the openssl command, and the first few digits of the certificate code are not the same. So, the machine I'm on and trying to register is using the wrong cert. I've tried using

landscap-config -k SSL_PUBLIC_KEY

where the public key pointed to the actual .crt file generated, but it's still not using that to verify the landscape servers identity.

I've tried to run:

sudo landscape-config --account-name standalone --url https://server.domain.com/message-system --ping-url http://server.domain.com/ping --ssl-public-key=/usr/local/share/ca-certificates/landscape_server_ca.crt

to manually point to the certificate, and it's still getting the same thing.

Tried wget and pointed to the cert:

landscape$ wget https://server.domain.com --certificate=/usr/local/share /ca-certificates/landscape_server_ca.crt
--2016-02-24 14:30:52--  https://server.domain.com 
OpenSSL: error:0906D06C:PEM routines:PEM_read_bio:no start line
OpenSSL: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
Disabling SSL due to encountered errors.

Answer 1

I will answer with the solution that worked for me, but it might be very specific. My problem was a machine-name problem. When I ran either "hostname" or "hostname -f" on the server, I got the response

servername

but I couldn't ping that server - ping servername fails. I had to ping servername.local to get a response (notice that local is NOT a placeholder. If my server was named "servername", the actually thing I'm typing is ping servername.local).

Anyway, the answer is to change servername to servername.local in all the landscape configuration files, as well as the SSL you created via those instructions. This includes the apache2 configuration files, and anywhere else in the landscape configuration files you specified the name of the server. Also, connect to servername.local from the Landscape clients.

(Again, it's possible this is a quirk of my local network, since I am not the manager and don't quite know how names are resolved on it. In any case, I was getting very similar error messages)

Answer 2

For me, the issue was using the Landscape server IP address in the landscape-client command.

I also could not immediately use the server hostname instead of the IP since DNS was not working.

After I added the Landscape server IP and hostname to /etc/hosts registration is successful.