2

I am chainloading iPXE (undionly.kpxe) and using an embedded script wanting to boot from HTTPS.

The problem is the HTTPS server is connecting to the http server (a custom service) via stunnel using a self signed certificate created with:

openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem

When it tries to contact the server I get "Permission denied" errors. Yet the URL works correctly from a browser.

I've tried downloading http://ca.ipxe.org/ca.crt and recompiling undionly.kpxe with the TRUST=ca.crt option but this didn't work.

I'm not very familiar with certificate management. How do I get ipxe to trust the stunnel server?

0

You need to add your certificate to the CA used by ipxe.

Another solution would be to create a private CA (a root certificate that you will use to sign the host certificates), then configure ipxe to use this CA. See: http://ipxe.org/cfg/crosscert

The best solution is to sign your certificates by a public CA.

  • Thanks, yes I got it to work by using TRUST= from the stunnel.pem file. Which isn't terribly secure so I may try the cross signing option. – Matt May 30 '13 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.