https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi there, is anyone experiencing new `bad certific...
# fleet
g
Hi there, is anyone experiencing new 
bad certificate
issues on MacOS? In August suddenly our MacOs devices within the company started to report following problem (I removed subbed personal data with X): 
Aug 29 09:41:11 <http://sub.domain.com|sub.domain.com> fleet[5X78X3]: 2024/08/29 09:41:11 http: TLS handshake error from XX.XX.XXX.65:XXXXX: remote error: tls: bad certificate
Background: We use our own SSL certificate for signing. But there are no issues from this SSL certificate if we run SSLlabs tests on it it just suddenly started happening. This certificate also works on other services.
On the device logs I get: 
Post \"<https://sub.domain.com:443>\": tls: failed to verify certificate: x509: certificate is valid for *.<http://domain.com|domain.com>, <http://domain.com|domain.com>, not <http://sub.domain.com:443|sub.domain.com:443>
r
@Grigory Emelianov Hey! Can you verify that you're using sub.domain.com rather than sub.sub.domain.com?
g
Thank you @Rebecca Cowart , this is correct
Any update @Rebecca Cowart? We have an audit soon
r
@Grigory Emelianov Thank you for clarifying! I'm looking into this and will get back to you with more info soon.
@Grigory Emelianov Are you using a self-signed certificate?
@Grigory Emelianov Also, what version of Fleet are you running?
g
@Rebecca Cowart yes, we are using self-signed certificate from GoDaddy with EV verification. Note: • The certificate worked for multiple month without any issues. • Other factors: ◦ We renewed a certificate 3 months. ◦ New Sysadmin joined. Now I am getting the certificate re-keyed to exclude possible issues with it. But it would be strange since in the past month we didn't get any issues. • Something random happened once as well: My employee who had this error re-installed the MacOs agent and suddenly she stopped getting this error.
@Rebecca Cowart another question I have is would the sync with fleet server work if I have a simple domain validation SSL certificate instead or will MacOs agent always require EV/OV SSL certificate on the server for communication?
r
@Grigory Emelianov Thank you for the info. What version of Fleet are you running on the device that is still facing the error? Also, Fleet does work with DV SSL certs. 🙂
g
It’s a bit outdated, 4.8.0 or 4.8.1 I think
Great to know about certificates! I thought MacOs agents needed EV/OV, that’s the only reason our sysadmin suggested those
r
@Grigory Emelianov Our latest version is 4.60.0. Can you check your Fleet version number again?
@Grigory Emelianov Our most recent Fleet version is 4.60.1*
g
No, this is correct, we didn’t update in a while 😅
r
@Grigory Emelianov We recommend you upgrade to the latest version of Fleet. This would help us troubleshoot the issue effectively.
g
Do you have any SSL certificate caching on the agent side? Why I am asking: When we uninstall and re-install the agent again on the MacOs, it starts working and the error message is no longer shown in logs. But I cannot run after each employee to update reinstall again every year, it's difficult to achieve 🙂
Update: ❌ Got a new OV SSL certificate, installed new certificate - didn't help. Still get the same problem. On the server side error: 
Dec 16 18:36:43 <http://sub1.domain.com|sub1.domain.com> fleet[XXXXXX]: 2024/12/16 18:36:43 http: TLS handshake error from XX.XX.XXX.65:XXXXX: remote error: tls: bad certificate
On the agent side error: 
"Post \"<https://sub1.domain.com:443>\": tls: failed to verify certificate: x509: certificate is valid for *.<http://domain.com|domain.com>, <http://domain.com|domain.com>, not <http://sub1.domain.com:443|sub1.domain.com:443>"
Also now tried to clean DNS with 
sudo killall -HUP mDNSResponder
on the device - didn't help, still not syncing with the Mac device... Would love to hear if there is any info about caching of SSL certificates @Rebecca Cowart
r
@Grigory Emelianov Is it possible that the expiry on your cert is too long? Apple has restrictions on their lifecycles now. I will have more info on SSL caching tomorrow!
g
@Rebecca Cowart It's the standard 1 year expiration. Right now we updated to new OV SSL that expires in Jan 2026. Even if I buy it for 3 years, we have to renew annually. New observation: We noticed that all of MacOs agents are still reporting back whenever the osquery version is 5.9.1 (2023) but most of 5.14.1 agents stopped reporting back around beginning of December 2024. I need to check how they became updated to new version but I assume it's the auto-update.
r
@Grigory Emelianov Looking back at this statement, I am confused. Is your certificate self-signed, or is it an EV certificate?
we are using self-signed certificate from GoDaddy with EV verification
g
Sorry for confusion, it’s OV certificate by Godaddy, not self-signed. I mean we are using own certificate. Did you see any other cases where the error is „…:443“? I couldn’t find anything similar online. We even tried to create dedicated certificate just for that server but it still comes out with :443 in logs
10 Views
Open in Slack
PreviousNext
Powered by