Problem with intermediate certificates - they are ignored...

[adam1624a]

Hello
I tried to up an instance of MeshCental on one VM as PoC with this config file, but sadly this software ignores intermediate files for certificates even though I correctly created files (based on https://meshcentral.com/docs/MeshCentral2UserGuide.pdf page 5).

root@<<><><><>:/opt/meshcentral/meshcentral/meshcentral-data# ls -la webserver-cert-*
-rw-r--r-- 1 meshcentral meshcentral 1723 Jan 21 16:02 webserver-cert-chain1.crt
-rw-r--r-- 1 meshcentral meshcentral 1351 Jan 21 16:02 webserver-cert-chain2.crt
-rw-r--r-- 1 meshcentral meshcentral 1704 Jan 21 16:02 webserver-cert-private.key
-rw-r--r-- 1 meshcentral meshcentral 2285 Jan 21 16:02 webserver-cert-public.crt
root@m<<><><><>:/opt/meshcentral/meshcentral/meshcentral-data# pwd
/opt/meshcentral/meshcentral/meshcentral-data

When I try to add Host by installing an agent I get this error:

root@<<><><><>:~# (wget "https://<<><><><>/meshagents?script=1" -O ./meshinstall.sh || wget "https://<<><><><>/meshagents?script=1" --no-proxy -O ./meshinstall.sh) && chmod 755 ./meshinstall.sh && sudo -E ./meshinstall.sh https://<<><><><> 'x56NEdcc1xurmcmUhgd28NOKxC7GfmcqYLUnMFcaVgqCultsb8Z1j4IDqQ4T9X9Y' || ./meshinstall.sh https://<<><><><> 'x56NEdcc1xurmcmUhgd28NOKxC7GfmcqYLUnMFcaVgqCultsb8Z1j4IDqQ4T9X9Y' --no-check-certificate
--2025-01-21 14:51:33--  https://<<><><><>/meshagents?script=1
Resolving <<><><><> (<<><><><>)... <<><><><>
Connecting to m<<><><><> (<<><><><>)|<<><><><>|:443... connected.
ERROR: cannot verify <<><><><>'s certificate, issued by ‘CN=Certum Domain Validation CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL’:
  Unable to locally verify the issuer's authority.
To connect to meshcentralcpd.asseco.cloud insecurely, use `--no-check-certificate'.
--2025-01-21 14:51:33--  https://<<><><><>/meshagents?script=1
Resolving <<><><><> (<<><><><>)... <<><><><>
Connecting to <<><><><> (<<><><><>)|<<><><><>|:443... connected.
ERROR: cannot verify <<><><><>'s certificate, issued by ‘CN=Certum Domain Validation CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL’:
  Unable to locally verify the issuer's authority.
To connect to <<><><><> insecurely, use `--no-check-certificate'.
-bash: ./meshinstall.sh: Permission denied

So it simply doesn't deliver intermediate certificates and ends as blocked - every advice will be welcome.

My config:

{
    "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
    "settings": {
        "cert": "<<><><><>",
        "mongoDb": "mongodb://127.0.0.1:27017",
        "WANonly": true,
        "sessionTime": 540,
        "sessionKey": "<<><><><>",
        "sessionSameSite": "strict"
    },
    "port": 443,
    "webdav": {
        "url": "https://server/remote.php/dav/files/[email protected]/",
        "username": "user",
        "password": "pass",
        "folderName": "MeshCentral-Backups",
        "maxFiles": 10
    },
    "domains": {
        "": {
            "_siteStyle": 2,
            "title": "<<><><><>.<<><><><>",
            "title2": "CPD",
            "auth": "ldap",
            "ldapOptions": {
                "url": "ldaps://<<><><><>:636",
                "tlsOptions": {
                    "rejectUnauthorized": false
                },
                "bindDN": "CN=ldapmesh,OU=Konta Aplikacji,DC=<<><><><>,DC=<<><><><>,DC=<<><><><>",
                "bindCredentials": "<<><><><>",
                "searchBase": "OU=Pracownicy,DC=cpd,DC=<<><><><>,DC=<<><><><>",
                "searchFilter": "(sAMAccountName={{username}})",
                "reconnect": true
            },
            "ldapUserName": "sAMAccountName",
            "ldapUserEmail": "mail",
            "ldapUserRealname": "name"
        },
        "PreconfiguredScripts": [
            {
                "name": "Run NotePad as user",
                "file": "scripts/notepad.bat",
                "type": "bat",
                "runas": "user"
            },
            {
                "name": "Run NotePad as agent",
                "cmd": "notepad.exe",
                "type": "bat",
                "runas": "agent"
            },
            {
                "name": "Run echo",
                "cmd": "echo \"hello world\"",
                "type": "sh",
                "runas": "agent"
            },
            {
                "name": "Agent Update",
                "cmd": "agentupdate",
                "type": "agent"
            }
        ],
        "PreconfiguredRemoteInput": [
            {
                "name": "CompanyUrl",
                "value": "https://https://<<><><><>.<<><><><>.<<><><><>//"
            },
            {
                "name": "Any Text",
                "value": "Any text\r"
            },
            {
                "name": "Welcome",
                "value": "Default welcome text"
            }
        ],
        "myServer": {
            "Backup": false,
            "Restore": false,
            "Upgrade": false,
            "ErrorLog": false,
            "Console": false,
            "Trace": false,
            "Config": false
        },
        "passwordRequirements": {
            "min": 8,
            "max": 128,
            "upper": 1,
            "lower": 1,
            "numeric": 1,
            "nonalpha": 1,
            "reset": 90,
            "force2factor": true,
            "skip2factor": "127.0.0.1",
            "oldPasswordBan": 5,
            "banCommonPasswords": false,
            "twoFactorTimeout": 300,
            "duo2factor": true
        },
        "_twoFactorCookieDurationDays": 30,
        "_agentInviteCodes": true,
        "_agentNoProxy": true,
        "_lockAgentDownload": true,
        "_geoLocation": true,
        "_ipLocation": true,
        "_novnc": false,
        "_mstsc": false,
        "_ssh": true,
        "_WebEmailsPath": "/myserver/email-templates",
        "_consentMessages": {
            "title": "MeshCentral",
            "desktop": "{0} requesting remote desktop access. Grant access?",
            "terminal": "{0} requesting remote terminal access. Grant access?",
            "files": "{0} requesting remote files access. Grant access?",
            "consentTimeout": 30,
            "autoAcceptOnTimeout": false,
            "oldStyle": true
        },
        "sessionRecording": {
            "_onlySelectedUsers": true,
            "_onlySelectedUserGroups": true,
            "onlySelectedDeviceGroups": true,
            "filepath": "/opt/meshcentral/meshcentral/meshcentral-records",
            "index": true,
            "maxRecordings": 1000,
            "_maxRecordingDays": 15,
            "maxRecordingSizeMegabytes": 100,
            "__protocols__": "Is an array: 1 = Terminal, 2 = Desktop, 5 = Files, 100 = Intel AMT WSMAN, 101 = Intel AMT Redirection, 200 = Messenger",
            "protocols": [
                1,
                2,
                5
            ]
        }
    },
    "_smtp": {
        "host": "smtp.myserver.com",
        "port": 25,
        "from": "[email protected]",
        "__tls__": "When 'tls' is set to true, TLS is used immidiatly when connecting. For SMTP servers that use TLSSTART, set this to 'false' and TLS will still be used.",
        "tls": false,
        "___tlscertcheck__": "When set to false, the TLS certificate of the SMTP server is not checked.",
        "_tlscertcheck": false,
        "__tlsstrict__": "When set to true, TLS cypher setup is more limited, SSLv2 and SSLv3 are not allowed.",
        "_tlsstrict": true,
        "_emailDelaySeconds": 300
    }
}  

[adam1624a]

Ok it appears my certificate intermediate files were incorrect - after finding the second level certificate and replace in webserver-cert-chain1.crt all started working as expected sorry for this unrequited ticket...

root@<<><><><>:/opt/meshcentral/meshcentral/meshcentral-data# openssl verify -verbose -CAfile webserver-cert-chain1.crt webserver-cert-public.crt
Error loading file webserver-cert-chain1.crt
807BE4226F7F0000:error:05800088:x509 certificate routines:X509_load_cert_crl_file_ex:no certificate or crl found:../crypto/x509/by_file.c:251:

root@<<><><><>:/opt/meshcentral/meshcentral/meshcentral-data# openssl verify -verbose -CAfile webserver-cert-chain1.crt  webserver-cert-public.crt
webserver-cert-public.crt: OK