{"action":"created","issue":{"url":"https://api.github.com/repos/munkireport/munkireport-php/issues/506","repository_url":"https://api.github.com/repos/munkireport/munkireport-php","labels_url":"https://api.github.com/repos/munkireport/munkireport-php/issues/506/labels{/name}","comments_url":"https://api.github.com/repos/munkireport/munkireport-php/issues/506/comments","events_url":"https://api.github.com/repos/munkireport/munkireport-php/issues/506/events","html_url":"https://github.com/munkireport/munkireport-php/issues/506","id":165126819,"number":506,"title":"-0400 ERROR: Munkireport: The certificate for this server is invalid","user":{"login":"nlscott","id":3018699,"avatar_url":"https://avatars.githubusercontent.com/u/3018699?v=3","gravatar_id":"","url":"https://api.github.com/users/nlscott","html_url":"https://github.com/nlscott","followers_url":"https://api.github.com/users/nlscott/followers","following_url":"https://api.github.com/users/nlscott/following{/other_user}","gists_url":"https://api.github.com/users/nlscott/gists{/gist_id}","starred_url":"https://api.github.com/users/nlscott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nlscott/subscriptions","organizations_url":"https://api.github.com/users/nlscott/orgs","repos_url":"https://api.github.com/users/nlscott/repos","events_url":"https://api.github.com/users/nlscott/events{/privacy}","received_events_url":"https://api.github.com/users/nlscott/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-07-12T16:53:35Z","updated_at":"2016-07-13T16:47:28Z","closed_at":null,"body":"I just updated from version 2.4.2 to 2.85. My client is running munki 2.7.0.2753 on OS X 10.11.5\r\n\r\nWhen I run Managed Software Center on a client I get the following errors and client doesn't report back to MunkiReport.\r\n\r\n> Jul 12 2016 12:06:14 -0400 ERROR: Munkireport: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “munki.kenyon.edu” which could put your confidential information at risk.\r\n\r\nWhen I run \"sudo /usr/local/munki/managedsoftwareupdate -vvv\" I get this error and the client never reports back to MunkiReport:\r\n\r\n> Performing postflight tasks...\r\n>     postflight stdout:     Munkireport: # Executing scripts in postflight.d\r\n>     Munkireport: Requesting munkireport\r\n>     Munkireport: connection_willSendRequestForAuthenticationChallenge_\r\n>     Munkireport: Authentication challenge for Host: munki.kenyon.edu Realm: None AuthMethod: NSURLAuthenticationMethodServerTrust\r\n>     Munkireport: Allowing OS to handle authentication request\r\n>     Download error -1202: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “munki.kenyon.edu” which could put your confidential information at risk.\r\n>     Munkireport: SSL error detail: (-9813L, u'Cert chain not verified by root')\r\n>     Munkireport: Headers: None\r\n>     postflight stderr: 2016-07-12 11:52:55.799 Python[82823:4097913] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)\r\n> ERROR: Munkireport: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “munki.kenyon.edu” which could put your confidential information at risk.\r\n> Done.\r\n\r\n\r\nIf I run sudo /usr/local/munki/preflight --debug, I see this:\r\n\r\n  \r\n\r\n>   Munkireport: # Executing scripts in preflight_abort.d\r\n>     Munkireport: # Executing scripts in preflight.d\r\n>     Munkireport: Running submit.preflight\r\n>     Munkireport: submit.preflight Error: 2016-07-12 12:38:34.070 Python[3141:45326] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)\r\n> ERROR: Munkireport: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “munki.kenyon.edu” which could put your confidential information at risk.\r\n> \r\n\r\nIt seems to suggest that the certificate for the MunkiReport is invalid? I'm using a self-signed cert for https traffic that doesn't expire until 2018. I'm not using client certificates for munki.\r\n\r\nI don't get this error on my clients running MunkiReport 2.4.2. If I uninstall 2.8.5 and reinstall 2.4.2 my client goes back to checking into MunkiReport with no error messages. Any ideas on how I can troubleshoot this?"},"comment":{"url":"https://api.github.com/repos/munkireport/munkireport-php/issues/comments/232415569","html_url":"https://github.com/munkireport/munkireport-php/issues/506#issuecomment-232415569","issue_url":"https://api.github.com/repos/munkireport/munkireport-php/issues/506","id":232415569,"user":{"login":"nlscott","id":3018699,"avatar_url":"https://avatars.githubusercontent.com/u/3018699?v=3","gravatar_id":"","url":"https://api.github.com/users/nlscott","html_url":"https://github.com/nlscott","followers_url":"https://api.github.com/users/nlscott/followers","following_url":"https://api.github.com/users/nlscott/following{/other_user}","gists_url":"https://api.github.com/users/nlscott/gists{/gist_id}","starred_url":"https://api.github.com/users/nlscott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nlscott/subscriptions","organizations_url":"https://api.github.com/users/nlscott/orgs","repos_url":"https://api.github.com/users/nlscott/repos","events_url":"https://api.github.com/users/nlscott/events{/privacy}","received_events_url":"https://api.github.com/users/nlscott/received_events","type":"User","site_admin":false},"created_at":"2016-07-13T16:47:28Z","updated_at":"2016-07-13T16:47:28Z","body":"Client is OSX 10.11.5. But I have about 40 other machines on 10.11.5 that are checking in. And about 250 clients in total.\r\n\r\nIt's strange because it's not a new cert. it got renewed in May of this year. So it's been in use for over 2 years and I've never had an issue with it. \r\n\r\nReading some post about munki, there was a conversation about moving from curl to NSURLSession, and how the checking for NSURLSession is stricter when it comes to certs?\r\n\r\nSince I'm not using the cert for client authentication for munki, only to secure web traffic to munkireport. At some point I can blow the cert away and create a new one. But that may take me a couple weeks.\r\n\r\n"}}
{"actor":{"display_login":"nlscott"}}