<div dir="ltr">Here is a message sent to the mailing list but without you in the CC: <a href="http://lists.ipxe.org/pipermail/ipxe-devel/2016-November/005271.html">http://lists.ipxe.org/pipermail/ipxe-devel/2016-November/005271.html</a><div>""""<br><div><span style="font-size:12.8px">You may want to trying trusting your certificate chain by adding `TRUST=/path/to/chain.crt` to the make command. I just did that for the first time the other day and it's working out well for me.</span><br style="font-size:12.8px"><br style="font-size:12.8px"><span style="font-size:12.8px">--</span><br style="font-size:12.8px"><span style="font-size:12.8px">Erik</span><br></div></div><div><span style="font-size:12.8px">""""</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">I'm guessing you are using an embedded script, you might want to first try and only type it out.</span></div><div><span style="font-size:12.8px">my reason for saying this is that the script must start with</span></div><div><span style="font-size:12.8px">#!ipxe (the # is missing in your example but i guess that is just a typo)</span></div><div><span style="font-size:12.8px">you can test that a script is detected correctly by running imgstat, it should then say [script] for script files.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="color:rgb(31,73,125);font-family:calibri,sans-serif;font-size:14.6667px">sync ; exit 1</span><span style="font-size:12.8px"><br></span></div><div><br></div><div><span style="font-size:12.8px">seems to be a typo, it will always exit or just fail.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">If you still get the weird 0000001 error then try and compile with DEBUG=script to get details about what the scripts does so that we can see exactly which command that fails.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">For debuging a https issue here is a old email about how to debug it</span></div><div><span style="font-size:12.8px"><a href="http://lists.ipxe.org/pipermail/ipxe-devel/2013-January/002201.html">http://lists.ipxe.org/pipermail/ipxe-devel/2013-January/002201.html</a></span></div><div><span style="font-size:12.8px"> </span><span style="color:rgb(0,0,0);white-space:pre-wrap">make bin/<whatever> DEBUG=tls,x509,ocsp</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">so to combine you might want something like make bin/ipxe.usb DEBUG=tls,x509,ocsp,script</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">/Christian</span></div><div><span style="font-size:12.8px"><br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 23, 2016 at 2:41 PM, Blatt, Andrew C <span dir="ltr"><<a href="mailto:andrew.blatt@bankofamerica.com" target="_blank">andrew.blatt@bankofamerica.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_4511933209751370299WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I copied <a href="http://ca.ipxe.org" target="_blank">ca.ipxe.org</a> to internal webserver to see if that would resolve my problem, however, I still get an error:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Could not boot: Error 0x00000001 (<a href="http://ipxe.org/00000001" target="_blank">http://ipxe.org/00000001</a>)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I’m pointing to local copy in the ipxe file I’m loading:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">!ipxe<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">set crosscert <a href="http://webserver/ca.ipxe.org/" target="_blank">http://webserver/ca.ipxe.org/</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">sync ; exit 1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">:crosscert_ok<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">#sleep 10<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">ifstat net0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">imgfetch -n kernel <a href="https://webserver/pxelinux.cfg/01-$%7Bnet0/mac:hexhyp%7D" target="_blank">https://webserver/pxelinux.<wbr>cfg/01-${net0/mac:hexhyp}</a> && goto image_ok || goto discovery_image<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">sleep 10<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Blatt, Andrew C
<br>
<b>Sent:</b> Tuesday, November 22, 2016 6:23 PM<br>
<b>To:</b> 'Christian Nilsson'<br>
<b>Cc:</b> <a href="mailto:ipxe-devel@lists.ipxe.org" target="_blank">ipxe-devel@lists.ipxe.org</a><br>
<b>Subject:</b> RE: [ipxe-devel] trying to leverage https address but not with certificates.<u></u><u></u></span></p>
</div>
</div><span class="">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Thanks, I will use config/local/general.h going forward. As for downloading certchain from <a href="http://ca.ipxe.org" target="_blank">ca.ipxe.org</a>, I do not have access to the internet.. Is there anyway
to disable that feature? Was hoping “set crosscert x-invalid://” would do it? Trying to leverage https but with –insecure (like with curl/wget).<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</span><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Christian Nilsson [<a href="mailto:nikize@gmail.com" target="_blank">mailto:nikize@gmail.com</a>]
<br>
<b>Sent:</b> Tuesday, November 22, 2016 6:11 PM</span></p><div><div class="h5"><br>
<b>To:</b> Blatt, Andrew C<br>
<b>Cc:</b> <a href="mailto:ipxe-devel@lists.ipxe.org" target="_blank">ipxe-devel@lists.ipxe.org</a><br>
<b>Subject:</b> Re: [ipxe-devel] trying to leverage https address but not with certificates.<u></u><u></u></div></div><p></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Then i must suggest to read that <a href="http://ipxe.org" target="_blank">ipxe.org</a> url, and also include it so that it easier for others to help you.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">By default ipxe https implementation downloads the certchain from
<a href="http://ca.ipxe.org" target="_blank">ca.ipxe.org</a> (if i'm not missremembering)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">so to double check this i would strongly suggest that you test with internet access available first so you know that testcase works and then go on to the next step to make it internal only.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">again, please use config/local/general.h, and don't redefine something that is already defined by default (This will make it easier for you when there is any updates, and will minimize the risk for any future builds of ipxe to fail.)<u></u><u></u></p>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Tue, Nov 22, 2016 at 11:53 PM, Blatt, Andrew C <<a href="mailto:andrew.blatt@bankofamerica.com" target="_blank">andrew.blatt@bankofamerica.<wbr>com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">It gets an error and
<a href="http://ipxe.org" target="_blank">ipxe.org</a> error, it does not hang, then fails to access the
<a href="https://webserver" target="_blank">https://webserver</a> url. There is no network access to the internet, and I had even tried to disable that by adding:</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">set crosscert x-invalid:// && goto crosscert_ok || echo Setting crosscert failed</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">sync ; exit 1</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">:crosscert_ok</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Not sure where I found the above example to disable crosscert check, but I gave it a try anyway.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">> grep HTTP config/general.h</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">#define DOWNLOAD_PROTO_HTTP /* Hypertext Transfer Protocol */</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">#define DOWNLOAD_PROTO_HTTPS /* Secure Hypertext Transfer Protocol */</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Christian Nilsson [mailto:<a href="mailto:nikize@gmail.com" target="_blank">nikize@gmail.com</a>]
<br>
<b>Sent:</b> Tuesday, November 22, 2016 5:47 PM<br>
<b>To:</b> Blatt, Andrew C<br>
<b>Cc:</b> <a href="mailto:ipxe-devel@lists.ipxe.org" target="_blank">ipxe-devel@lists.ipxe.org</a><br>
<b>Subject:</b> Re: [ipxe-devel] trying to leverage https address but not with certificates.</span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Do you get a error and a
<a href="http://ipxe.org" target="_blank">ipxe.org</a> error URL or does it just hang?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Does the network have access to the internet (for possible download of the certificate chain)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">the proper way to enable functions is to add the just needed ones to the proper config/local file, in this case adding<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">#define DOWNLOAD_PROTO_HTTPS /* Secure Hypertext Transfer Protocol */<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">into src/config/local/general.h<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">note the #define instead of $define (which should cause compilation error i hope)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">/Christian<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">On Tue, Nov 22, 2016 at 5:59 PM, Blatt, Andrew C <<a href="mailto:andrew.blatt@bankofamerica.com" target="_blank">andrew.blatt@bankofamerica.<wbr>com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Hi,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I’m trying to access a pxelinux.cfg file over HTTPS instead of HTTP:<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">#!ipxe<u></u><u></u></p>
<p class="MsoNormal"># Disable automated download of certificates since it is done against<u></u><u></u></p>
<p class="MsoNormal"># unauthenticated host which may lead to exploits<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">ifstat net0<u></u><u></u></p>
<p class="MsoNormal">imgfetch -n kernel
<a href="https://WEBSERVER/pxelinux.cfg/01-$%7Bnet0/mac:hexhyp%7D" target="_blank">
https://WEBSERVER/pxelinux.<wbr>cfg/01-${net0/mac:hexhyp}</a> && goto image_ok || goto discovery_image<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">:discovery_image<u></u><u></u></p>
<p class="MsoNormal">ifstat net0<u></u><u></u></p>
<p class="MsoNormal">imgfetch -n kernel
<a href="https://WEBSERVER/pxelinux.cfg/default" target="_blank">https://WEBSERVER/pxelinux.<wbr>cfg/default</a> || echo ${net0/mac}:${ip} - Boot Failed<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">:image_ok<u></u><u></u></p>
<p class="MsoNormal">imgload kernel<u></u><u></u></p>
<p class="MsoNormal">boot kernel<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I’ve tried compiling ipxe-fd95c78 and updated config/general.h to include $define DOWNLOAD_PROTO_HTTPS but it still fails to access the URL, if I change it back to
<a href="http://WEBSERVER" target="_blank">http://WEBSERVER</a>, it works.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Any advice?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Thank you.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Andrew<u></u><u></u></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal">This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms
and conditions available at <a href="http://www.bankofamerica.com/emaildisclaimer" target="_blank">
http://www.bankofamerica.com/<wbr>emaildisclaimer</a>. If you are not the intended recipient, please delete this message.<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>_________________<br>
ipxe-devel mailing list<br>
<a href="mailto:ipxe-devel@lists.ipxe.org" target="_blank">ipxe-devel@lists.ipxe.org</a><br>
<a href="https://lists.ipxe.org/mailman/listinfo.cgi/ipxe-devel" target="_blank">https://lists.ipxe.org/<wbr>mailman/listinfo.cgi/ipxe-<wbr>devel</a><u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
<div>
<div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal">This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at
<a href="http://www.bankofamerica.com/emaildisclaimer" target="_blank">http://www.bankofamerica.com/<wbr>emaildisclaimer</a>. If you are not the intended recipient, please delete this message.<u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div><div><div class="h5">
<hr>This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at <a href="http://www.bankofamerica.com/emaildisclaimer" target="_blank">http://www.bankofamerica.com/<wbr>emaildisclaimer</a>. If you are not the intended recipient, please delete this message.<br>
</div></div></div>
</blockquote></div><br></div>