starred/tacticalrmm

Fork 0

mirror of https://github.com/amidaware/tacticalrmm.git synced 2026-04-26 15:05:57 +03:00

[GH-ISSUE #1786] Linux agent not connecting after Certificate change #3057

New issue

Closed

opened 2026-03-14 06:22:57 +03:00 by kerem · 11 comments

kerem commented

2026-03-14 06:22:57 +03:00

Owner

Originally created by @albindy on GitHub (Mar 5, 2024).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1786

Server Info (please complete the following information):

OS: Debian 12
Browser: chrome
RMM Version (as shown in top left of web UI): v0.17.5

Installation Method:

[ X] Standard
Docker

Agent Info (please complete the following information):

Agent version (as shown in the 'Summary' tab of the agent from web UI):Agent v2.6.2
Agent OS: Debian 12

Describe the bug
When changing the Certificate in nginx Linux Agents no longer connect.
No error in /opt/tacticalmesh/meshagent.log or /var/log/tacticalagent.log
Switching back to old Cert brings back the Agents online. Or reinstallation.
Result: Certificate Change is impossible for me. But I have to.
How can the change be done without reinstalling all Linux Agents.
To Reproduce
Steps to reproduce the behavior:

Go to '/etc/nginx/site-available/*.conf'
Change from Lets encrypt Zertificate to bought Cert
Restart Nginx
Linux Agents no longer connecting

Expected behavior
Agents should accept other active and valid certificates without reinstallation.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Originally created by @albindy on GitHub (Mar 5, 2024). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1786 **Server Info (please complete the following information):** - OS: Debian 12 - Browser: chrome - RMM Version (as shown in top left of web UI): v0.17.5 **Installation Method:** - [ X] Standard - [ ] Docker **Agent Info (please complete the following information):** - Agent version (as shown in the 'Summary' tab of the agent from web UI):Agent v2.6.2 - Agent OS: Debian 12 **Describe the bug** When changing the Certificate in nginx Linux Agents no longer connect. No error in /opt/tacticalmesh/meshagent.log or /var/log/tacticalagent.log Switching back to old Cert brings back the Agents online. Or reinstallation. Result: Certificate Change is impossible for me. But I have to. How can the change be done without reinstalling all Linux Agents. **To Reproduce** Steps to reproduce the behavior: 1. Go to '/etc/nginx/site-available/*.conf' 2. Change from Lets encrypt Zertificate to bought Cert 3. Restart Nginx 4. Linux Agents no longer connecting **Expected behavior** Agents should accept other active and valid certificates without reinstallation. **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** Add any other context about the problem here.

kerem closed this issue

2026-03-14 06:23:02 +03:00

kerem commented

2026-03-14 06:23:08 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 5, 2024):

Are you using code signing? Or any custom config?

Works fine for me after every change of cert and a lot of others.

@dinger1986 commented on GitHub (Mar 5, 2024): Are you using code signing? Or any custom config? Works fine for me after every change of cert and a lot of others.

kerem commented

2026-03-14 06:23:13 +03:00

Author

Owner

@albindy commented on GitHub (Mar 5, 2024):

Problems are meshcentral.conf and rmm.conf
When changing the Certificate there the Agents are no longer working.
Yes we use code signing.
"Code signing all agents"
No custom configs except the tried zertificate change.

@albindy commented on GitHub (Mar 5, 2024): Problems are meshcentral.conf and rmm.conf When changing the Certificate there the Agents are no longer working. Yes we use code signing. "Code signing all agents" No custom configs except the tried zertificate change.

kerem commented

2026-03-14 06:23:18 +03:00

Author

Owner

@wh1te909 commented on GitHub (Mar 5, 2024):

so windows agents connect fine with new cert?

can you run the linux agent in debug mode and see if any errors related to certs? don't paste the full output here because it contains sensitive info:

# stop service
sudo systemctl stop tacticalagent

# run in debug
tacticalagent -m rpc -log debug -logto stdout

# after done debugging, don't forget to start service back up
sudo systemctl start tacticalagent

@wh1te909 commented on GitHub (Mar 5, 2024): so windows agents connect fine with new cert? can you run the linux agent in debug mode and see if any errors related to certs? don't paste the full output here because it contains sensitive info: ``` # stop service sudo systemctl stop tacticalagent # run in debug tacticalagent -m rpc -log debug -logto stdout # after done debugging, don't forget to start service back up sudo systemctl start tacticalagent ```

kerem commented

2026-03-14 06:23:23 +03:00

Author

Owner

@albindy commented on GitHub (Mar 5, 2024):

SyncMesh: Post "https://api.*********/api/v3/syncmesh/": tls: failed to verify certificate: x509: certificate signed by unknown authority
But the cert is valid and an official wildcard working on several other systems.
Additional info, it is a wildcard Cert.
(CN) Sectigo RSA Domain Validation Secure Server CA
(O) Sectigo Limited

Yes Windows connects fine.

@albindy commented on GitHub (Mar 5, 2024): SyncMesh: Post "https://api.*********/api/v3/syncmesh/": tls: failed to verify certificate: x509: certificate signed by unknown authority But the cert is valid and an official wildcard working on several other systems. Additional info, it is a wildcard Cert. (CN) Sectigo RSA Domain Validation Secure Server CA (O) Sectigo Limited Yes Windows connects fine.

kerem commented

2026-03-14 06:23:28 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 5, 2024):

Did you follow this and update all files? https://docs.tacticalrmm.com/unsupported_scripts/#using-purchased-ssl-certs-instead-of-lets-encrypt-wildcards

You don't need to do the nats regen.

You need to use the fullchain which you maybe haven't

@dinger1986 commented on GitHub (Mar 5, 2024): Did you follow this and update all files? https://docs.tacticalrmm.com/unsupported_scripts/#using-purchased-ssl-certs-instead-of-lets-encrypt-wildcards You don't need to do the nats regen. You need to use the fullchain which you maybe haven't

kerem commented

2026-03-14 06:23:33 +03:00

Author

Owner

@albindy commented on GitHub (Mar 5, 2024):

Yes, followed the guide. Did the nats regen and worked like a charme.
But! Good hint, I'm trying fullchain actual using cert.

@albindy commented on GitHub (Mar 5, 2024): Yes, followed the guide. Did the nats regen and worked like a charme. But! Good hint, I'm trying fullchain actual using cert.

kerem commented

2026-03-14 06:23:38 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 5, 2024):

So it worked after a nats regen and restarting all services?

@dinger1986 commented on GitHub (Mar 5, 2024): So it worked after a nats regen and restarting all services?

kerem commented

2026-03-14 06:23:43 +03:00

Author

Owner

@albindy commented on GitHub (Mar 5, 2024):

Nats worked before.
Just to complete the picture. Problem was using cert instead of fullchain.
But Nats works with cert only and frontend too.
For rmm and meshcentral fullchain is mandatory to work.

Maybe a hint in the docu would help. But, yes I know it is unsupported.
Thanks for clearing things up and helping lightning fast!
Thanks for the great support!
All up and running now!

@albindy commented on GitHub (Mar 5, 2024): Nats worked before. Just to complete the picture. Problem was using cert instead of fullchain. But Nats works with cert only and frontend too. For rmm and meshcentral fullchain is mandatory to work. Maybe a hint in the docu would help. But, yes I know it is unsupported. Thanks for clearing things up and helping lightning fast! Thanks for the great support! All up and running now!

kerem commented

2026-03-14 06:23:48 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 5, 2024):

Did you not see this?

Nats doesnt actually need a cert anymore, glad its working now

@dinger1986 commented on GitHub (Mar 5, 2024): Did you not see this? ![image](https://github.com/amidaware/tacticalrmm/assets/7244447/74b419fa-bc09-4058-9875-87b4537b47cf) Nats doesnt actually need a cert anymore, glad its working now

kerem commented

2026-03-14 06:23:53 +03:00

Author

Owner

@albindy commented on GitHub (Mar 5, 2024):

OMG Sorry! Totally overlooked this note.
Thanks again!
Closing.

@albindy commented on GitHub (Mar 5, 2024): OMG Sorry! Totally overlooked this note. Thanks again! Closing.

kerem commented

2026-03-14 06:23:58 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 5, 2024):