On Fresh Install Using Config Backup, SSL/TLS Certificate Install Failed
Description
Problem/Justification
Impact
relates to
Activity
John T Davis December 14, 2024 at 3:32 PM
Hello! Thanks for looking into this for me, and the advice to create the new SSL certificate. I’ll look into how to do that. I have to admit that at this point I’m just wondering if I shouldn’t clean install TrueNAS to fix this. It might be easier, as I’m just starting out.
I really appreciate y’all looking into adding an option to wipe the encrypted fields.
Bug Clerk December 13, 2024 at 5:20 PM
This issue has now been closed. Comments made after this point may not be viewed by the TrueNAS Teams. Please open a new issue if you have found a problem or need to re-engage with the TrueNAS Engineering Teams.
Bug Clerk December 13, 2024 at 5:20 PM
Thanks for the ticket. Unfortunately there isn’t much for us to do here because this isn’t a bug. In your situation, you would need to create a new SSL certificate and then attach that to the UI. However, we have opened up a related ticket to add a new feature to the UI that allows the user to wipe all encrypted fields in the database without wiping the entire config. Unfortunately, that would be a non-trivial change and will require careful design and consideration before we move forward. The ticket is linked to here if you’d like to follow progress of it. Otherwise, we’re closing this one for now.
John T Davis November 25, 2024 at 6:19 PM
@William Gryzbowski , yes, I figured out that was the problem pretty quickly.
I made the report because there’s nothing in the UI or the docs that I was able to find to figure out how to fix it. At the moment my install is partially broken and I can’t figure out what to do.
I know I can’t restore the original secret, but I’d at least like to be able to reinstall TrueNAS' default TLS certificate. I know I could use a self-signed CA and certificate from that, but (1) I don’t understand enough about certificates to understand how to do that; (2) that adds a level of complexity I think I should be able to avoid, as it should be possible to repair a damaged default TLS certificate.
William Gryzbowski November 25, 2024 at 6:11 PM
That seems to be expected since you forgot to include secrets, no?
Hello,
I recently had to do a fresh install of TrueNAS Scale (Dragonfish), and used a configuration backup during setup. The configuration file did not include the encryption secret, which I didn't notice until later.
It all seemed to work fine, except that the UI's "truenas_default" TLS certificate failed to install correctly. I got the following message in my notifications.
"Web UI HTTPS certificate setup failed."
By the time I was able to start diagnosing this, Electric Eel had released. I upgraded, hoping it would fix the issue, but the damaged/missing TLS certificate persists. I'm still getting the same error.
Symptoms:
(1) I have no HTTPS access to the web GUI. The login screen warns me to switch to HTTPS, but trying to load the web UI via HTTPS fails completely.
(2) I cannot adjust which interfaces are bound to the web GUI, as attempting to do so throws an error relating to the missing/damaged TLS certificate.
(3) Related to the above, I presently have the web GUI bound to the wrong interface and cannot fix it.
(4) I can't find any reference in the docs or TrueNAS itself to how to repair or replace the TLS certificate.
Session ID: 87e93368-c6ec-740f-cd54-fe030fb05be3