2

I am chainloading iPXE (undionly.kpxe) and using an embedded script wanting to boot from HTTPS.

The problem is the HTTPS server is connecting to the http server (a custom service) via stunnel using a self signed certificate created with:

openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem

When it tries to contact the server I get "Permission denied" errors. Yet the URL works correctly from a browser.

I've tried downloading http://ca.ipxe.org/ca.crt and recompiling undionly.kpxe with the TRUST=ca.crt option but this didn't work.

I'm not very familiar with certificate management. How do I get ipxe to trust the stunnel server?

Improve this question
0

1 Answer 1

Reset to default
0

You need to add your certificate to the CA used by ipxe.

Another solution would be to create a private CA (a root certificate that you will use to sign the host certificates), then configure ipxe to use this CA. See: http://ipxe.org/cfg/crosscert

The best solution is to sign your certificates by a public CA.

Improve this answer
3
  • Thanks, yes I got it to work by using TRUST= from the stunnel.pem file. Which isn't terribly secure so I may try the cross signing option.
    – hookenz
    May 30, 2013 at 4:52
  • Is there a way to keep iPXE's root certificate when adding your own certificate to trust?
    – CMCDragonkai
    Nov 21, 2019 at 8:43
  • Concatenate all of them.
    – Mircea Vutcovici
    Nov 21, 2019 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.