Cockpit: [Debian] fresh install of cockpit, gnutls_handshake failed, prevents loading dashboard

[t3chn0m4g3]

Cockpit version: 214
OS: Debian (SID), x64
Page: Dashboard

Trying to login into cockpit succeeds, however the dasboard page does not load and after the while an error appears telling to check journalctl -u cockpit. A refresh of the page then leads to the authentication page again.

Reproduction is possible, however sometimes it does work. Please give it a couple of tries.

Relevant parts of the system log are also useful:
journalctl -u cockpit -b:

Mar 06 09:21:03 electricalsculpture systemd[1]: Starting Cockpit Web Service...
Mar 06 09:21:03 electricalsculpture systemd[1]: Started Cockpit Web Service.
Mar 06 09:21:03 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:21:04 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:21:29 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:21:29 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:21:29 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:21:29 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:00 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:01 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:01 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:13 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:42 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:42 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:42 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:42 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:22:42 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:23:12 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:23:12 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:23:12 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:23:43 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:36 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:37 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:37 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:49 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:49 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:49 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:49 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:49 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:25:50 electricalsculpture cockpit-tls[5599]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:29:32 electricalsculpture systemd[1]: Stopping Cockpit Web Service...
Mar 06 09:29:32 electricalsculpture systemd[1]: cockpit.service: Succeeded.
Mar 06 09:29:32 electricalsculpture systemd[1]: Stopped Cockpit Web Service.
Mar 06 09:29:32 electricalsculpture systemd[1]: Starting Cockpit Web Service...
Mar 06 09:29:32 electricalsculpture systemd[1]: Started Cockpit Web Service.
Mar 06 09:29:33 electricalsculpture cockpit-tls[30891]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:31:40 electricalsculpture systemd[1]: cockpit.service: Succeeded.
Mar 06 09:41:39 electricalsculpture systemd[1]: Starting Cockpit Web Service...
Mar 06 09:41:39 electricalsculpture systemd[1]: Started Cockpit Web Service.
Mar 06 09:41:39 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:41:40 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:41:40 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:42:03 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:42:03 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:42:03 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:42:03 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:42:03 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Mar 06 09:42:33 electricalsculpture cockpit-tls[42073]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.

cockpit-ws complains about a missing certificate, which is odd, expectation is the default certificate should be generated upon installation of the cockpit package:

Mar 06 09:21:04 electricalsculpture systemd[1]: Started Cockpit Web Service https instance e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
Mar 06 09:21:04 electricalsculpture cockpit-ws[5604]: cockpit-ws: Failed to open certificate file /run/cockpit/tls/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: No such file or directory
Mar 06 09:21:08 electricalsculpture cockpit-ws[5604]: cockpit-ws: Failed to open certificate file /run/cockpit/tls/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: No such file or directory
Mar 06 09:21:28 electricalsculpture cockpit-ws[5604]: cockpit-ws: Failed to open certificate file /run/cockpit/tls/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: No such file or directory

[wolffstarr]

Also getting this on Debian Buster with v217 of Cockpit from buster-backports. Effectively the same logs and behavior as @t3chn0m4g3 reported.

[thiagolinhares]

--EDIT --
It turns out I was trying to access it the wrong way.
I'm using NGINX in front of cockpit, as reverse proxy.
When accessing http://cockpit.example.com it would throw this error.
Adding httpS://cockpit.example.com fixed the issue.

---

Same here.
Centos 8
Error happens after login-attempt
cockpit-ws[398557]: cockpit-ws: Failed to open certificate file /run/cockpit/tls/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: No such file or directory
cockpit-session[398916]: pam_ssh_add: Failed adding some keys

[Diak]

Same problem here after login :
Aug 29 22:53:57 XXX cockpit-ws[29457]: cockpit-ws: Failed to open certificate file /run/cockpit/tls/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: No such file or directory

# cat /etc/redhat-release
CentOS Linux release 8.2.2004 (Core)

# dnf info cockpit
Last metadata expiration check: 2:41:59 ago on Sat 29 Aug 2020 08:16:04 PM CEST.
Installed Packages
Name         : cockpit
Version      : 211.3
Release      : 1.el8
Architecture : x86_64
Size         : 53 k
Source       : cockpit-211.3-1.el8.src.rpm
Repository   : @System
From repo    : BaseOS
Summary      : Web Console for Linux servers
URL          : https://cockpit-project.org/
License      : LGPLv2+
Description  : The Cockpit Web Console enables users to administer GNU/Linux servers using a
             : web browser.
             :
             : It offers network configuration, log inspection, diagnostic reports, SELinux
             : troubleshooting, interactive command-line sessions, and more.

[digitalformula]

Same issue here after installing cockpit-226. Worked fine with cockpit-211.

I'm on CentOS 8.2.2004, cockpit-226 built from source. Issue is present on CentOS 8.2.2004, doesn't happen on Ubuntu 20.04.

HTTP and HTTPS both have the same issue.

[XenoBIT78]

New Install of ubuntuserver 20.04.1 and cockpit version 215-1

cockpit-tls[2718]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.

edit* just updated to 227-1 and same problem, had the same problem on a Fedora32 server yesterday

[tophee]

I am also getting the behaviour reported in the OP on OpenMediaVault 5 (Debian 10.6)

[XenoBIT78]

make your own certificates from lets encrypt using acme.sh or certbot or other... and use certs with cockpit..

[snakehead007]

Im also getting the same error logs on ubuntu 20.04

[Alion548]

Im also getting the same error logs on Fedora 33
https://github.com/cockpit-project/cockpit/issues/14705

[AlexH0661]

Also getting this error on RHEL8.2

[eringuet]

I'm trying to figure out where that string is coming from since it's the same for all of us:
/run/cockpit/tls/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
I would expect cockpit-tls to use /run/cockpit/tls and nothing else.

edit: seems to be the instance ID:
Starting Socket for Cockpit Web Service https instance e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.

Documentation says:

The cockpit-tls program expects the RUNTIME_DIRECTORY environment variable to be set to an empty directory (preferably in /run/) that is only accessible by the system user under which it is running. This contains the Unix sockets for communicating with the cockpit-ws instances, and in the future, state information about client certificates. This variable is normally set by the cockpit.service systemd unit.

cockpit.service on ubuntu:

[Service]
RuntimeDirectory=cockpit/tls
# systemd ≥ 241 sets this automatically
Environment=RUNTIME_DIRECTORY=/run/cockpit/tls
ExecStartPre=/usr/sbin/remotectl certificate --ensure --user=root --group=cockpit-ws --selinux-type=
ExecStart=/usr/lib/cockpit/cockpit-tls
PermissionsStartOnly=true
User=cockpit-ws
Group=cockpit-ws

looks like the service wants to run as cockpit-ws but the folder is owned by root.

chown -R cockpit-ws:cockpit-ws /run/cockpit allows me to login and the service seems to work.

Not sure what that means bug-wise but that's all I can contribute with my skill level.

[snakehead007]

looks like the service wants to run as cockpit-ws but the folder is owned by root.

chown -R cockpit-ws:cockpit-ws /run/cockpit allows me to login and the service seems to work.

Not sure what that means bug-wise but that's all I can contribute with my skill level.

I will try that out! huge help, if it will work. thanks!

[gstlouisgit]

the above from @snakehead007 did not work for me. IF I refresh several times after login I can see the UI but when clicking anywhere nothing shows up.
journalctl still says :
Dec 02 15:54:14 mainoffice systemd[1]: Starting Cockpit motd updater service...
Dec 02 15:54:14 mainoffice systemd[1]: Starting Cockpit Web Service...
Dec 02 15:54:14 mainoffice systemd[1]: Started Cockpit Web Service.
Dec 02 15:54:14 mainoffice systemd[1]: Started Cockpit motd updater service.
Dec 02 15:54:19 mainoffice cockpit-tls[4555]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Dec 02 15:54:21 mainoffice cockpit-ws[4535]: cockpit-ws: Failed to open certificate file /run/cockpit/tls/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: No such file or directory
Dec 02 15:54:21 mainoffice cockpit-tls[4555]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.

on centos 8 4.18.0-193.28.1.el8_2.x86_64
selinux is disabled

[sharkyP]

i'm also having the same issue on a new install

[LordSimal]

I got it working with an NGINX Reverse proxy.
Basically follow https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-nginx

The only MAIN difference I changed is, that I added

AllowUnencrypted = true

to the /etc/cockpit/cockpit.conf and added a HTTPS Redirect via NGINX
Seems like the HTTPS Redirect from Cockpit doesnt seem to work internally when there is no valid certificate present in /etc/cockpit/ws-certs.d

Of course with that change cockpit is accessible via only HTTP in your local network.