starred/tacticalrmm

Fork 0

mirror of https://github.com/amidaware/tacticalrmm.git synced 2026-04-26 15:05:57 +03:00

[GH-ISSUE #196] Internal server certs #2062

New issue

Closed

opened 2026-03-14 02:19:26 +03:00 by kerem · 8 comments

kerem commented

2026-03-14 02:19:26 +03:00

Owner

Originally created by @Uzzi on GitHub (Nov 30, 2020).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/196

HI, I wanto to deploy RMM into internal server, no external exposure, than install.sh notify me: The server will not issue certificates for the identifier :: Error creating new order :: Cannot issue for "*.DOMAIN.intranet": Domain name does not end with a valid public suffix (TLD)

How can I fix it?
Thank you

Originally created by @Uzzi on GitHub (Nov 30, 2020). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/196 HI, I wanto to deploy RMM into internal server, no external exposure, than install.sh notify me: The server will not issue certificates for the identifier :: Error creating new order :: Cannot issue for "*.DOMAIN.intranet": Domain name does not end with a valid public suffix (TLD) How can I fix it? Thank you

kerem closed this issue

2026-03-14 02:19:31 +03:00

kerem commented

2026-03-14 02:19:37 +03:00

Author

Owner

@Uzzi commented on GitHub (Nov 30, 2020):

I've created certs by: sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/selfsigned.key -out /etc/ssl/selfsigned.crt

I've edited install.sh and modifyed certs sections.

But now I cannot login. Error: Bad credentials

@Uzzi commented on GitHub (Nov 30, 2020): I've created certs by: sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/selfsigned.key -out /etc/ssl/selfsigned.crt I've edited install.sh and modifyed certs sections. But now I cannot login. Error: Bad credentials

kerem commented

2026-03-14 02:19:42 +03:00

Author

Owner

@wh1te909 commented on GitHub (Nov 30, 2020):

Hi, self signed certs will no longer work since we switched to NATS which is why I removed them from the install script.

You can still get a free let's encrypt cert for internal use, you don't need to open any ports. If you don't have a domain just get a free one from freenom.com

@wh1te909 commented on GitHub (Nov 30, 2020): Hi, self signed certs will no longer work since we switched to NATS which is why I removed them from the install script. You can still get a free let's encrypt cert for internal use, you don't need to open any ports. If you don't have a domain just get a free one from freenom.com

kerem commented

2026-03-14 02:19:47 +03:00

Author

Owner

@meyerje commented on GitHub (Nov 30, 2020):

Does this remove support for an internal root CA as well?

On Mon, Nov 30, 2020 at 11:11 AM Tragic Bronson notifications@github.com
wrote:

Hi, self signed certs will no longer work since we switched to NATS which
is why I removed them from the install script.

You can still get a free let's encrypt cert for internal use, you don't
need to open any ports. If you don't have a domain just get a free one from
freenom.com

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/wh1te909/tacticalrmm/issues/196#issuecomment-735919197,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ADLS2ID4WF3HZETVVVNXFX3SSPG3NANCNFSM4UHNTSRA
.

@meyerje commented on GitHub (Nov 30, 2020): Does this remove support for an internal root CA as well? On Mon, Nov 30, 2020 at 11:11 AM Tragic Bronson <notifications@github.com> wrote: > Hi, self signed certs will no longer work since we switched to NATS which > is why I removed them from the install script. > > You can still get a free let's encrypt cert for internal use, you don't > need to open any ports. If you don't have a domain just get a free one from > freenom.com > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <https://github.com/wh1te909/tacticalrmm/issues/196#issuecomment-735919197>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ADLS2ID4WF3HZETVVVNXFX3SSPG3NANCNFSM4UHNTSRA> > . >

kerem commented

2026-03-14 02:19:52 +03:00

Author

Owner

@wh1te909 commented on GitHub (Nov 30, 2020):

@meyerje no that should still be fine cuz yours is a proper cert, NATS just doesn't like ghetto ones generated by openssl. Will DM you on discord cuz I need to you test.

@wh1te909 commented on GitHub (Nov 30, 2020): @meyerje no that should still be fine cuz yours is a proper cert, NATS just doesn't like ghetto ones generated by openssl. Will DM you on discord cuz I need to you test.

kerem commented

2026-03-14 02:19:57 +03:00

Author

Owner

@Uzzi commented on GitHub (Nov 30, 2020):

Can I configure Tactical to work only with interna domain and ask let's encrypt cert for other public domain?
I've let's encrypt certs for other public domain, can I use its?

@Uzzi commented on GitHub (Nov 30, 2020): Can I configure Tactical to work only with interna domain and ask let's encrypt cert for other public domain? I've let's encrypt certs for other public domain, can I use its?

kerem commented

2026-03-14 02:20:02 +03:00

Author

Owner

@wh1te909 commented on GitHub (Nov 30, 2020):

@Uzzi yea so NATS needs a valid certificate, which doesn't necessarily have to be the same cert used for the rmm website so I guess you could use the self signed cert for everything except NATS, and then use a letsencrypt cert just for NATS.

I'll be releasing an update soon with that option, so I will follow up with you then with instructions.

@wh1te909 commented on GitHub (Nov 30, 2020): @Uzzi yea so NATS needs a valid certificate, which doesn't necessarily have to be the same cert used for the rmm website so I guess you could use the self signed cert for everything except NATS, and then use a letsencrypt cert just for NATS. I'll be releasing an update soon with that option, so I will follow up with you then with instructions.

kerem commented

2026-03-14 02:20:07 +03:00

Author

Owner

@Uzzi commented on GitHub (Dec 1, 2020):

@wh1te909 during agents installation, I've certification x509 error.

@Uzzi commented on GitHub (Dec 1, 2020): @wh1te909 during agents installation, I've certification x509 error.

kerem commented

2026-03-14 02:20:12 +03:00

Author

Owner

@wh1te909 commented on GitHub (Dec 2, 2020):

@Uzzi im not familiar at all with certs but i think prolly you have to add the cert in the agent's trusted cert store or something. Which is why I recommend you just do letsencrypt or get a proper cert and you wont have any of these errors.

I did some optional settings in the latest release in 0.2.4 for using custom certs though if you want to try

you can add the 2 following variables to the bottom of /rmm/api/tacticalrmm/tacticalrmm/local_settings.py

CERT_FILE = "/path/to/your/fullchain.pem"
KEY_FILE = "/path/to/your/privkey.pem"

then do a sudo systemctl restart rmm and from the web interface, go to Tools > Server Maintenance > Reload Nats
then check sudo systemctl status nats and see if there are any certificate errors or just try installing an agent again
Note that these custom certs are only for NATS, not for nginx. You can read more about the NATS cert requirements here: https://docs.nats.io/nats-server/configuration/securing_nats/tls#certificate-authorities

For nginx you should still be able to use a ghetto cert generated by openssl

edit: forgot to add make sure the path to those 2 certs are owned by whatever linux user you installed the rmm as or that they have at least read access so do a chmod 755 on them. do not edit or create anything as root, always from same user you installed rmm.

@wh1te909 commented on GitHub (Dec 2, 2020): @Uzzi im not familiar at all with certs but i think prolly you have to add the cert in the agent's trusted cert store or something. Which is why I recommend you just do letsencrypt or get a proper cert and you wont have any of these errors. I did some optional settings in the latest release in 0.2.4 for using custom certs though if you want to try you can add the 2 following variables to the bottom of `/rmm/api/tacticalrmm/tacticalrmm/local_settings.py` ``` CERT_FILE = "/path/to/your/fullchain.pem" KEY_FILE = "/path/to/your/privkey.pem" ``` then do a `sudo systemctl restart rmm` and from the web interface, go to Tools > Server Maintenance > Reload Nats then check `sudo systemctl status nats` and see if there are any certificate errors or just try installing an agent again Note that these custom certs are only for NATS, not for nginx. You can read more about the NATS cert requirements here: https://docs.nats.io/nats-server/configuration/securing_nats/tls#certificate-authorities For nginx you should still be able to use a ghetto cert generated by openssl edit: forgot to add make sure the path to those 2 certs are owned by whatever linux user you installed the rmm as or that they have at least read access so do a `chmod 755` on them. do not edit or create anything as root, always from same user you installed rmm.

kerem referenced this issue

2026-03-14 06:54:14 +03:00

[GH-ISSUE #2062] Fix "Unknown Make/Model" #3227