topic Re: Certificate Error on Miner Refresh in General Topics

Certificate Error on Miner Refresh

iheredia — Tue, 25 Jul 2017 22:50:09 GMT

Currently Running MineMeld Version 0.9.40 on Ubuntu 14.04. I am getting the following certificate error. I have tried updating the self-signed cert, restart, ubuntu reboot. with no change.

Re: Certificate Error on Miner Refresh

lmori — Tue, 25 Jul 2017 22:53:40 GMT

Are you doing SSL decryption ? The Miner is not able to validate the remote certificate of the ET server.

Re: Certificate Error on Miner Refresh

iheredia — Tue, 25 Jul 2017 22:58:41 GMT

Yes but I tried exempting the MineMeld server from SSL Decryption. I also added the Trusted Root CA to Minemeld.

Re: Certificate Error on Miner Refresh

lmori — Tue, 25 Jul 2017 23:01:03 GMT

Could you double check that MM is actually exempted from decryption ?
Another option is saving the Trusted CA certificate in /opt/minemeld/local/CA/site/ and then "sudo -u mm-cabundle-update"

Re: Certificate Error on Miner Refresh

iheredia — Tue, 25 Jul 2017 23:06:51 GMT

I will double check in the morning. I will first try to add the Root CA to /opt/minemeld/local/CA/site/ and then "sudo -u mm-cabundle-update"

Thank you for the quick reply @lmori

Re: Certificate Error on Miner Refresh

idelconsulting — Mon, 26 Mar 2018 21:19:25 GMT

Hi @lmori,

I tried that, but so far it didn't work.

First, shouldn't that be: sudo -u minemeld mm-cabundle-update ?

Second:

I exported my forward decryption certificate from my PA in PEM format and created a file

pa820SubCA.crt

/opt/minemeld/local/CA/site

Then I ran:

/opt/minemeld/local/certs$ sudo -u minemeld mm-cabundle-update
2018-03-26T23:14:19 (101237)cacert_merge.main INFO: config: {'cafile': ['/opt/minemeld/local/certs/site/'], 'dst': '/opt/minemeld/local/certs/bundle.crt', 'config': '/opt/minemeld/local/certs/cacert-merge-config.yml', 'no_merge_certifi': False}
WARNING: old python version (< 2.7.9) - certificate verification not performed

I'm seeing

/opt/minemeld/local/certs$ ls -la
total 312
drwxr-xr-x 4 minemeld minemeld 4096 Mar 26 22:50 .
drwxr-xr-x 9 minemeld minemeld 4096 Mar 26 23:00 ..
-rw------- 1 minemeld minemeld 296399 Mar 26 23:14 bundle.crt
drwxr-xr-x 3 minemeld minemeld 4096 Mar 26 22:38 CA
-rw-r--r-- 1 minemeld minemeld 25 Oct 2 14:17 cacert-merge-config.yml
drwxr-xr-x 2 minemeld minemeld 4096 Oct 2 14:18 site

I don't see my certificate getting added in bundle.crt

Did I miss anything?

Regards,

Andreas

Re: Certificate Error on Miner Refresh

idelconsulting — Tue, 27 Mar 2018 18:39:58 GMT

I got it working now.

Changes required:

Trusted CA PEM file needs to be in:

/opt/minemeld/local/certs/site

with the extension .crt

Then, after running

sudo -u minemeld mm-cabundle-update

you need to restart the engine from the System menu.

Now everything looks fine.

Regards,

Andreas