Hello, I’m upgrading our self-hosted server from 2.6.x to 3.2.1. I believe we’re running into issues due to changes in how the certificates/private keys are generated. If I use the keygen script to generate a brand new set of keys, everything works fine i.e. the website loads and I can see our exi…

I’m afraid I cannot think of a workaround, because pinning the device to a specific server certificate is normally reserved for non-production setups or ones where it’s easy to change them. For production, you would normally add the CA cert (self-signed CA cert or 3rd party if not already in ca-cer…

I think the problem is due to the fact that the single certificate/key that is currently used now has a subject alternative name that includes a wildcard (e.g. *.mycomain.com). Presumably, some of the services have been changed to point to a subdomain. If this is true, it sounds like a pretty break…

Are you using self signed certificate for server in LAN production? if you are I would recommend also generating your own self signed CA cert and create your server certificates signed by the CA cert. then you only need to install the public part of your CA cert on your devices. Then you are free to…

One thing that has to be noted is that Mender needs the certificate to have filled the DNS part of Alternative Names in the certificate that is stored in the traefik container. You can see this using the following command. openssl x509 -in CERTIFICATE -text Look at the DNS part in the example bel…

Thanks for the reply. However, the questions remains is that is there a direct upgrade path to 3.2.1? From what I can tell it looks like there isn’t and it is necessary to update the devices to change the certificates before the server is upgraded to 3.2.1, after which the server upgrade can take pl…

Are you using self-signed certificates?

Certificate issue when upgrading server from 2.6 to 3.2.1

General Discussions

spratesi April 22, 2022, 9:04am 5

I think this is related Is key rotation made mandatory by 3.1 update?

Topic		Replies	Views
Is key rotation made mandatory by 3.1 update? General Discussions	2	460	February 18, 2022
Secure mender-open source or on prim server General Discussions	19	778	August 1, 2020
"ServerCertificate" key not set by mender-convert --server-cert General Discussions mender-convert	5	1085	September 18, 2019
Certifiacte for Mender server General Discussions	1	252	March 31, 2020
Using an already existing certificate while installing Mender General Discussions	9	1262	June 27, 2019

Certificate issue when upgrading server from 2.6 to 3.2.1

Related topics