MeshCentral certificate issue (locally?) + export logs?

[Skyline643]

Hello everyone,

I am currently busy to setup a MeshCentral server, with a dynDNS script running for DNS updates.
The translation of the DNS is ok, the hostname is pointing to my WAN address.
But when I follow the Youtube guides and several posts on Github to let the connection with Let'sEncrypt work, I have issues.

My browser keeps telling that the certificate is not valid. But when I tried, I saw the staging message. I already deleted both (production and staging cert) under the letsencrypt certs folder en they renew...

Checks seem to be ok as well (just changed the DNS-name and path of the cert for posting here):

LE
{
"configOk": true,
"leDomains": [
"my dyn DNS"
],
"challenges": {},
"production": true,
"webServer": true,
"certPath": "some-path/meshcentral-data/letsencrypt-certs",
"skipChallengeVerification": false,
"cert": "Present",
"daysLeft": 89
}
LECHECK
CertOK
LEEVENTS
8/8/2024 12:58:07 PM - Getting certs from local store (Production)
8/8/2024 12:58:07 PM - Reading certificate files
8/8/2024 12:58:07 PM - Setting LE cert for default domain.
8/8/2024 12:58:13 PM - Certificate has 89 day(s) left.
8/8/2024 12:58:13 PM - Certificate is ok.
8/8/2024 1:15:25 PM - Certificate has 89 day(s) left.
8/8/2024 1:15:25 PM - Certificate is ok.

Port 80, 443 and default 4433 are open on the server. 4433 and 80 are also open on router and firewall.
When installing (or try to installing...) the agent I got this message:

Resolving somehostname.org (.......org)... 178.X.X.X, 2a02...............................
Connecting to somehostname.org (somehostname.org)|178.X.X.X|:4433... connected.
WARNING: cannot verify somehostname.org's certificate, issued by ‘C=unknown,O=unknown,CN=MeshCentralRoot-643b86’:
Unable to locally verify the issuer's authority.
HTTP request sent, awaiting response... 404 OK
2024-08-08 15:01:22 ERROR 404: OK.

This is the config.json:

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "mariadb": {"host": "localhost","user": "theadminguy", "password": "verysecretpassword"},
    "cert": "somehostname.org",
    "TrustedCert": false,
    "WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "port": 443,
    "aliasPort": 4433,
    "redirPort": 80,
    "_redirAliasPort": 80
  },
  "domains": {
    "": {
      "title": "SomeTitle",
      "title2": "by MeshCentral",
      "_titlePicture": "welcome_1.jpg",
      "welcomePicture": "background.jpg",
      "welcomePictureFullScreen": true,
      "welcomeText": "thecompany",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true,
      "allowedOrigin": true
    }
  },
  "letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "mail@hostname",
    "names": "somehostname.org",
    "skipChallengeVerification": false,
    "rsaKeySize": 3072,
    "production": true,
    "_lib": "acme-client"
  }
}

So I hope someone can help me to find what's the issue. Node version is V16.20.2 running on an Ubuntu 22.04.4 server on a Proxmox host. MeshCentral version is the latest one with a separate mariadb database because the hardware wasn't supporting mongodb.

[si458]

try removing "TrustedCert": false and restarting meshcentral

[Skyline643]

Ok, so I left the virtual machine (with MeshCentral) about 3 days out of service to have no issues with Letsencrypt.

I changed the config file again after booting, staging was ok, changed the config file again and received production certs in the folder.
Certificate seems to be ok, but is not valid again.

LEEVENTS gives me the following output:

> LEEVENTS
8/12/2024 2:16:31 PM - Getting certs from local store (Production)
8/12/2024 2:16:31 PM - Reading certificate files
8/12/2024 2:16:31 PM - Setting LE cert for default domain.
8/12/2024 2:16:36 PM - Certificate has 89 day(s) left.
8/12/2024 2:16:36 PM - Certificate is ok.
8/12/2024 2:17:38 PM - Certificate has 89 day(s) left.
8/12/2024 2:17:38 PM - Certificate is ok.
8/12/2024 2:17:50 PM - Certificate has 89 day(s) left.
8/12/2024 2:17:50 PM - Certificate is ok.
8/12/2024 2:17:50 PM - Certificate has 89 day(s) left.
8/12/2024 2:17:50 PM - Certificate is ok.
8/12/2024 2:19:02 PM - Certificate has 89 day(s) left.
8/12/2024 2:19:02 PM - Certificate is ok.
8/12/2024 2:19:30 PM - Failed to respond to challenge, token: letsdebug-test, table: {}.
8/12/2024 2:19:31 PM - Failed to respond to challenge, token: 6_ogl2JgQT_rBBWqneLOk10ZJbHC3zFQ3zirIN38awo, table: {}.

When I browse to the IP or dynDNS address of the server (outside my organisation, with mobile phone) I'm redirected from 80 to 4433 (where the agents log on). I get a message to choose a cert on my phone (2 options), but none of both seems to be accepted.

[si458]

you shouldnt be asked to pick a certificate on your mobile device, something isnt right with your mobile device or setup
for starters, can u pick a different aliasPort?
4433 shouldnt be used as thats the AMT port and that requires certificates etc so you might be hitting this port by mistake!

also whats your config.json look like now?

if you visit http://mymeshdomain.com it should get redirected to https://mymeshdomain.com:4443
(port be different if you change it now)
try it in your private window again and see what SSL cert you get

[Skyline643]

My config looks now like:

"settings": {
"mariadb": {"host": "localhost","user": "myadmin", "password": "something"},
"cert": "mychosendns.freeddns.org",
"WANonly": true,
"_LANonly": true,
"_sessionKey": "MyReallySecretPassword1",
"port": 8443,
"aliasPort": 9443,
"_redirPort": 80,
"_redirAliasPort": 80
},

When I try to browse to http://ipofmyserver:80 I'm redirected to https://ipofmyserver:9443
A simple telnet to the IP or DNS name on port 80 opens the terminal, so port 80 must be open.

[si458]

is ur firewall router/nat now port forwarding TCP/80 to TCP/80 meshcentral ip and TCP/9443 to TCP/8443 meshcentral ip ?

and what is the SSL you now get when you private browse to your dns name?

[Skyline643]

In the router I did a forward from 80 to 80 (both TCP and UDP) and also from TCP 9443 to TCP 8443. I can access MeshCentral locally on 8443 but not remote with the dynDNS address on 9443.

If i do a simple telnet, only port 80 seems to be open. It seems like the server with MeshCentral is not opening some ports. The firewall on the server is completely disabled. I don't get it anymore...

[Skyline643]

Ok, after a long time of searching, trying, ... I found the issue. The problem was port 4433 that wasn't reachable for Letsencrypt. I changed the ports and re-entered all port forwarding. Everything is working now.

I only have two questions:

• Only the remote website (reachable from WAN or with dynDNS address has the certificate). When I browse locally, the connection is unsafe? Do I need to add my local IP to the config file as well?
• Is there a way to export a daily list (CLI or GUI) from all devices that are offline?

We use this to monitor/remote access camera NVR's. It should be great if I could combine Mesh with other tools. To do ping tests to camera's, monitor the disk state, device state (online/offline), etc.
All recommendations are welcome :-)

[si458]

how are you browsing locally? (what url)
you should be access it using the DNS/port number you use externally
you cant use an internal dns name with letsencrypt as they cant verifiy you own it

as for the offline, wow thats a very unique case! not sure how you access the NVRs,
unless u are installing the meshagent directly onto them haha

you can use the meshctrl.js and ListDevices to get a list of all your devices then u can sort which are offline/online etc
https://ylianst.github.io/MeshCentral/meshctrl/

[Skyline643]

Ok thanks. Most devices are running on Ubuntu, so no problem to reach them.
I tried also to run the agent on an Teltonika RUT241 but that's not allowed (because the router can't read the syntax in the meshagent file I think). I thought it should work because the routers are OpenWRT based, but unfortunately...

Another thing: the agents are connecting to a central server. But should it be possible to use the meshagent as well to set up a monitoring system. Let's say, use them as a kind of proxy to reach the devices and other devices which are running in the same LAn network. This will be a very difficult setup, but I'm looking for something like that.

[si458]

@Skyline643 you should look into the meshcmd https://ylianst.github.io/MeshCentral/meshcmd/
it allows port forwarding from remote devices and devices on different networks