Linux enrollment fails with certificate verification failed SSL errorSolved

Hello @annemie ,

This error usually means the Linux enrollment script is not receiving the expected public SSL certificate chain from the Hexnode server.

For Linux enrollment, the device must be able to reach the Hexnode cloud over HTTPS on TCP port 443 without SSL interception. If a corporate firewall, proxy, or security gateway performs SSL inspection/decryption, it may replace the public Hexnode certificate with an internal self-signed certificate. The CLI enrollment process will reject that certificate chain and fail with:

“[SSL: CERTIFICATE_VERIFY_FAILED] self signed certificate in certificate chain”

Recommended checks:

1. Confirm the device date, time, and timezone are correct.
2. Update the Linux CA certificate bundle.
   • For Ubuntu/Debian: sudo apt-get update && sudo apt-get install –only-upgrade ca-certificates
   • For Fedora/RHEL: sudo dnf upgrade ca-certificates
3. If the error persists after updating CA certificates, ask the network/firewall team to bypass SSL inspection or HTTPS decryption for Hexnode cloud traffic, including the Hexnode portal URL and required Hexnode service domains.

If the enrollment failed before completion, the Hexnode agent service may not be installed yet. In that case, seeing a message such as “Unit hexnode_<service> not loaded” is expected and does not indicate a separate agent issue.

Regards,
Simon Scott
Hexnode UEM