fleet Change APNs validation at startup to use HTTP/HTTPS instead of TCP+TLS

Change APNs validation at startup to use HTTP/HTTPS instead of TCP+TLS

Open ddribeiro opened this issue 1 year ago • 6 comments

Fleet version: 4.54.1

💥 Actual behavior

A customer whose Fleet server is behind a proxy is unable to start their server after inserting their APNS certificate in their configuration file to enable Apple MDM features. It appears the HTTP_PROXY and HTTPS_PROXY environment variables are not being used when communicating with Apple servers.

The following error appears:

Failed to start: validate authentication with Apple APNs certificate: TLS dial: dial tcp 17.188.143.66:443: i/o timeout

@lucasmrod: Yeah, it seems our checks at startup do not use HTTPS_PROXY/HTTP_PROXY because to verify connection we just do a TCP+TLS connection, no HTTP. We should instead do a HTTP/HTTPS just like we do when communicating with Apple servers after the startup.

🧑‍💻 Steps to reproduce

Insert values for mdm.apple_apns_* and mdm.apple_scep* in the Fleet server configuration file.
With the Fleet server behind a proxy and HTTP_PROXY and HTTPS_PROXY environment variables correctly set, start the Fleet server.
Observe the Fleet server is unable to start due to an error validating authentication with the APNs certificate.

🕯️ More info (optional)

N/A

Aug 29 '24 19:08 ddribeiro

Related to a Slack conversation

Aug 29 '24 19:08 JoStableford

@georgekarrv this is not just workflow blocking, but blocking the entire MDM setup flow (can't start Fleet server with the existing APNS cert). i would like to push for this to be a p1 - is this something you can review and confirm if your team can tackle sooner?

@lukeheath fyi

Aug 29 '24 20:08 zayhanlon

Also it seems the connection test uses https://api.sandbox.push.apple.com, maybe it should use https://api.push.apple.com (production endpoint)?

Aug 29 '24 20:08 lucasmrod

rationale for using the sandbox endpoint here https://github.com/fleetdm/fleet/pull/8730/files#r1028145802 (not saying it can't be changed! just adding historical context)