So, our brand new JSS has been blessed with a proper certificate from Terena.
Since Terena is an intermediate, I had to import the certificate chain in the Tomcat configuration.
There is no problem connecting to the JSS via for example Safari, it is content with the chain supplied.
What seems to be the problem is that the jamf binary does not fully like a certificate chain.
Trying
jamf checkJSSConnectivity
on a client gives a green light and I can do a recon fine, but it refuses to get any polices with the error "could not connect to the JSS".
Am I barking up the wrong tree or has anybody else seen this?
I am thinking about maybe one thing I could have done differently;
when importing the certificates in the keystore, I imported the certificate and the chain, not the individual certificates in the chain (to the root keystore).
From what I've gathered in the jungle called certificates, the chain is just one file containing all the certs needed.
When doing a tcpdump on the client I can tell that the chain is supplied to the client, but it seems like it doesn't like it.
Patrik Sonestad
sysadm Lund university
