CFEngine 3.24.1 installation fails due to too long host FQDN

[0lmi]

Initially the issue was noticed during latest LTS installation in Azure.

How to reproduce: create a VM in Azure with name poc-cfengine-test and try to install hub using cf-remote as the following

$ cf-remote install --hub hub --bootstrap <private_ip>

<username>@<public_ip>
OS            : Ubuntu 24
Architecture  : x86_64
CFEngine      : Not installed
Policy server : None
Binaries      : dpkg, apt

Copying: '/home/<username>/.cfengine/cf-remote/packages/cfengine-nova-hub_3.24.1-1.ubuntu24_amd64.deb' to 'username@<public_ip>'
[<public_ip>]:+ /home/<username>/.cfengine/cf-remote/packages/cfengine-nova-hub_3.24.1-1.ubuntu24_amd64.deb -> cfengine-nova-hub_3.24.1-1.ubuntu24_amd64.deb
Installing: 'cfengine-nova-hub_3.24.1-1.ubuntu24_amd64.deb' on '<username>@<public_ip>'
Selecting previously unselected package cfengine-nova-hub.
(Reading database ... 67379 files and directories currently installed.)
Preparing to unpack cfengine-nova-hub_3.24.1-1.ubuntu24_amd64.deb ...
Unpacking cfengine-nova-hub (3.24.1-1.ubuntu24) ...
Setting up cfengine-nova-hub (3.24.1-1.ubuntu24) ...

dpkg: error processing package cfengine-nova-hub (--install):
 installed cfengine-nova-hub package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 cfengine-nova-hub

[ERROR] Sudo command unexpectedly exited: 'dpkg -i "cfengine-nova-hub_3.24.1-1.ubuntu24_amd64.deb"' [1]
[ERROR] Installation failed on '<username>@<public_ip>'
[ERROR] 1 error encountered while installing hub packages, aborting...

Logs:

root@poc-cfengine-test:/var/log# tail -n3 CFEngine-Install-2024-12-09_10\:46\:12_UTC.log 
+ /var/cfengine/bin/openssl req -utf8 -sha256 -nodes -new -subj /CN=poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloudapp.net -key /var/cfengine/httpd/ssl/private/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloudapp.net.key -out /var/cfengine/httpd/ssl/csr/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloudapp.net.csr -config /var/cfengine/ssl/openssl.cnf
803B8D24E67A0000:error:06800097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long::0:maxsize=64
req: Error adding subject name attribute "/CN=poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloudapp.net"

Workaround: rename the host to hub (hostnamectl hostname hub or, initially, name the VM like this)

[craigcomstock]

Hello,

I am working on reproducing the issue, created a ticket, CFE-4469, and if I can reproduce it look into a fix. Also saw your other issue and will look into that after this one.

Thanks for the report!

[craigcomstock]

I am not able to reproduce this initially.

I set the hostname with hostnamectl set-hostname poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud and then install. The install succeeds and the seemingly exact same command that failed for you succeeds for me.

+ printf [SAN]\nsubjectAltName=DNS:poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud,DNS:localhost,IP:127.0.0.1,IP:10.145.10.23
+ /var/cfengine/bin/openssl x509 -req -days 3650 -in /var/cfengine/httpd/ssl/csr/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud.csr -signkey /var/cfengine/httpd/ssl/private/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud.key -out /var/cfengine/httpd/ssl/certs/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud.cert -extensions SAN -extfile /var/cfengine/httpd/ssl/conf/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud.conf
Certificate request self-signature ok
subject=CN=poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud
+ ln -sf /var/cfengine/httpd/ssl/certs/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloud.cert /var/cfengine/ssl/cert.pem

oddly, if I try a similar command after successful install I get your error and I agree that your error is "valid" and that if the hostname is longer than the limit of 64 characters we need to do something different during the install.

Leaving out the key that is no longer there:

/var/cfengine/bin/openssl req -utf8 -sha256 -nodes -new -subj /CN=poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloudapp.net -out /var/cfengine/httpd/ssl/csr/poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloudapp.net.csr -config /var/cfengine/ssl/openssl.cnf

And after much ascii art during generation I get the error:

801B6D4F81760000:error:06800097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long::0:maxsize=64
req: Error adding subject name attribute "/CN=poc-cfengine-test.hppzr1wrhp0ednbudbgifmw05c.oslx.internal.cloudapp.net"
root@ubu24:/home/ubuntu# echo $?
1

[craigcomstock]

Can I assume that if you run hostname aka hostname -s to be more specific (short host name) that you get poc-cfengine-test. We could use the short host name for CN and keep the proper FQDN for the subjectAltName as we do later in our install scriptlet:

printf "[SAN]\nsubjectAltName=DNS:$CFENGINE_LOCALHOST,DNS:localhost,IP:127.0.0.1,$CFENGINE_LOCALIP" >> $CFENGINE_MP_SSLCONF

I will try this and can likely provide a test package for you to check.

[craigcomstock]

I didn't have a chance to test this build/package yet, but maybe you can try: https://github.com/cfengine/buildscripts/actions/runs/12244892565/artifacts/2296556865