HTTPS SSL Key is missing from new/clean install of XCP-ng v8

[LoVoltage]

Issue: After installing XCP-ng v8 new or clean, no HTTPS SSL cert is present

Confirming the Issue:

• At the XCP-ng server console, selecting "Status DIsplay" , the SSL key fingerprints are displayed.
• HTTPS key is not present
• SSH key is present
• From a local web browser, enter the IP of the XCP-ng server, the landing page is not displayed
• Cannot connect from XCP-ng Center
• Cannot connect from Xen Orchestra Applicance (XOA) or Xen Orchestra Community Edition (XOCE)

XCP-ng Center Errors: Windows 7 and Server 2008 R2

• Error message “Unable to connect to the server {server IP address}. Could not create secure SSL/TLS channel"
• When opening the XCP-ng Center, an error is displayed after a long delay

Windows 10

• XCP-ng center cannot connect to the designated server with the error message “Unable to connect to server {server IP address}. Could not find a server on {server IP address}. Check that XCP-ng is configured correctly on {server IP address} and try again."
• When opening the XCP-ng Center, an error is displayed after a long delay

Workaround: Installed XCP-ng 7.6, applied latest updates, then upgraded to v8 and applied latest updates. HTTPS SSL is present on the XCP-ng server and no errors when using XCP-ng Center.

XCP-ng Server Installation:

• Dell Poweredge R710
• XCP-ng v8 obtained from main XCP-ng site
• Verified hash
• Written to USB flash drive
• HDDs with no existing partitions including no Dell utility partition
• Static IP for management interface
• Installation completes without error messages, hangs or other issues

Troubleshooting:

• Verified ability for connectivity from the XCP-ng server to the XCP-ng Center host
• No firewall rules were impeding traffic using server FQDN or IP address
• Installing various versions of XCP-ng Center did not correct the issue
• Reinstallation of XCP-ng v8 did not correct the issue; Issue duplication From the XCP-ng console, commands to recreate the SSL certificate and restart the service failed

It seems the issue is with XCP-ng v8 when installing new or clean

[agador]

Did you update to the latest XCP-ng Center?

Did you disable the SSL Checks for your new XCP-ng 8 server? (I had a similar issue with XOA until I turned off SSL Certificate checking).

Just a couple of quick thoughts.

Jim

[olivierlambert]

Please open the issue in XCP-ng Center repo :wink:

https://github.com/xcp-ng/xenadmin/

[LoVoltage]

Did you update to the latest XCP-ng Center?

Did you disable the SSL Checks for your new XCP-ng 8 server? (I had a similar issue with XOA until I turned off SSL Certificate checking).

Just a couple of quick thoughts.

Jim

Yes, we updated to the latest version of XCP-ng Center.

Our troubleshooting began when with 4 XCP-ng servers

• 3 servers were existing XCP-ng installs that had been successfully upgraded from 7.6 to 8.0 (in-place upgrades) and XCP-ng Center functioned correctly following the upgrades
• 1 server was a new build with no previously installed OS and had a new clean install of XCP-ng 8 but XCP-ng Center was not able to establish the connection
• Following the issue discovered on the new install server, we began troubleshooting
  1. We could connect to the (3) upgraded servers from the existing XCP-ng Center installs but not the new server
  2. Installing older versions of Center, we could connect to the upgraded servers but not the new server
  3. Installing the newest versions of Center we could connect to the upgraded servers but not to the new install
  4. On the new server we attempted to run commands from the console to restart the tools stack with errors
  5. On the new server we attempted to run commands from the console to recreate the local SSL cert, but failed with errors
  6. We suspected some type of corruption during the new server install so we reinstalled using the the following process a. Wiped all the drives and did a full test of the system - All devices and tests passed b. Downloaded XCP-ng v8 from the main site and verified size and hash c. Wrote the image to multiple flash drives of different brands from different flash drive imaging utilities and compared the image size and file integrity with no issues d. Clean installed XCP-ng v8 on (3) Dell R710 servers of similar configuration; minor differences in memory size and CPU speed using default settings e. Preformed installation media verification during the installation process with no issues f. Tested XCP-ng Center from known good systems with all (3) servers, with all failing to establish connection with the (3) clean install test systems

We believe the issue is not with XCP-ng Center but with XCP-ng itself, specifically tasks related to installation. The workaround of upgrading from v7.6 to v8 of an existing installation seems to support our theory.

[olivierlambert]

Does it work with Xen Orchestra?

[LoVoltage]

Does it work with Xen Orchestra?

Theses systems belong to clients that do not use XO. As a result we did not test with XO. We suspect the issue lies in XCP-ng and not Center and therefore assume XO would have issues connecting.

If time allows, we will try to test with XO.

[olivierlambert]

Please try with XO, which is the most (and only professionally) supported client for XCP-ng.

[LoVoltage]

Issue opened at https://github.com/xcp-ng/xenadmin/issues/175

[LoVoltage]

Confirmed this does not work from XOCE or XOA

[LoVoltage]

@olivierlambert the HTTPS SSL key is missing on the XCP server. Updated this post to reflect the issue. Thanks for looking into this.

Q: During install, what is the relationship between the generation of the SSL key generation and local machine time/NTP?

• Looking into the local machine time/NTP service at the affected locations as it was not configured correctly

[stormi]

Can you try to find what happened in the installation logs? I don't know how to reproduce locally.

Location: /var/log/installer/

[LoVoltage]

@stormi Will drop the logs when workload allows. Any particular phrases or areas in the log that we should look for? We can parse for the usual stuff, but if we can focus the process, we could get meaningful info out faster.

[stormi]

I don't know, since it's the first time such an issue is reported. The most interesting (and bigger) file is /var/log/installer/install-log. It's got almost everything in it. I can send you my own from a nested test server if you want to compare.

[ghost]

It is not related to this issue but when I searched for my issue, I landed here. So I am linking this thread for people who will be in the same case as me when upgrading from 8.0 to 8.1 via yum (the ISO will be patched by the XCP-ng team soonish as I understood) https://xcp-ng.org/forum/topic/2797/xcp-ng-8-1-clean-install-missing-stunnel4/62

[stormi]

Hi @LoVoltage. Looks like you didn't find time for sharing logs, and I didn't give much attention to this issue either. If you can try with XCP-ng 8.1's installer, I'd like to know if the issue still occurs for you.

[stormi]

Closing due to the absence of needed feedback (logs), and since XCP-ng 8.0 is now EOL. Feel free to reopen with more elements from a supported release of XCP-ng.