Getting 'transport: authentication handshake failed: x509: certificate signed by unknown authority' error on Manager

[ihuxn4hi]

Hi there,

I'm getting 'transport: authentication handshake failed: x509: certificate signed by unknown authority' errors on the Manager and not quite sure how to proceed.

I've got a valid cert and key issued by Let's Encrypt located in /etc/pki/managerssl.crt and /etc/pki/managerssl.key, respectively. In this post (#7759), @defensivedepth suggests to run the following:

salt-call state.apply ssl,nginx

And also:

so-nginx-restart --force

But neither of those resolved the issue. Does anyone have any suggestions?

Thanks!

[InfosecGoon]

Where are you seeing that error? Is it in a log file or are you seeing it in the browser when connecting to the Manager?

[ihuxn4hi]

Any idea on this one? I'd like to roll this out but can't while this error persists.

Thank you very much!

[InfosecGoon]

Can you share your global pillar? From the Manager, "sudo salt-call pillar.get global".

[ihuxn4hi]

You got it -- here you go:

# salt-call pillar.get global
local:
    ----------
    airgap:
        False
    dockernet:
        172.17.0.0
    fleet_custom_hostname:
        None
    fleet_hostname:
        so-manager.seceng.mydomain.com
    fleet_ip:
        10.0.210.159
    fleet_manager:
        True
    fleet_node:
        False
    fleet_packages-timestamp:
        2023-03-01-20:30
    fleet_packages-version:
        5
    hnmanager:
        10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
    ids:
        Suricata
    imagerepo:
        security-onion-solutions
    managerip:
        10.0.210.159
    mdengine:
        ZEEK
    pipeline:
        redis
    sensoronikey:
        weSsnQnA7D11YaMuHBKL
    soversion:
        2.3.220
    url_base:
        so-manager.seceng.mydomain.com
    wazuh:
        1

Thank you very much!

[ihuxn4hi]

Hi there! Just wanted to check in on this. I'm fine using the self signed cert on the Manager if necessary if it resolves the mismatch with the clients. I appreciate your guidance!

[ihuxn4hi]

Sorry, I don't want to be a pain but I'd really love to get this resolved.

Thank you again for all of your help!