mobileconfig file generator

[cyb3rz3us]

AdGuard Home version: Docker image v0.107.6
OS: Rocky Linux 8.5

Hello AdGuard Community - I have two instances of AGH with the same Docker image & base OS (see above) yet only one shows the mobileconfig configurator app.

Are there any dependencies that are required to enable the configurator to be available via the Setup Guide?

[cyb3rz3us]

I think I figured this out. The AGH server where the configurator did not work was for internal testing use only and consequently, I did not setup a DNS record for it. I thought about it a bit and wondered if maybe that was causing this issue so I created an A-record and suddenly BAM!!! The configurator was available.

Is this expected behavior?

[cyb3rz3us]

Thanks @ainar-g - question. Isn't using a self-singed cert still considered a valid encryption config? If so, then I had that working fine as both DoT and DoH worked perfectly. The config tool UI did not become available until I added a DNS entry for server.

[ainar-g]

I'm not sure that we have such logic programmed anywhere. If you can reproduce that reliably on the Edge channel, you can file an issue about that.

[cyb3rz3us]

Well, before I go forward with filing an issue, can we get clarification on whether or not AGH is supposed to allow a self-signed certificate chain? If it should, then it looks like there is a defect and I will reproduce for further investigation.

[ainar-g]

@cyb3rz3us, as long as the certificate is recognized by the OS as valid, AdGuard Home must too. That is, the custom Certificate Authority key and certificate must be added to the OS certificate storage.

[cyb3rz3us]

Hi @ainar-g - The CA key as well? My understanding is only the self-signed root-cert needs to be installed with the CA key being secured safely away and only used to generate new root-certs. Also, the client browser does consider the cert chain as valid - it is only the AGH server side GUI that says the chain is invalid.