Zabbix with PSK Encryption TLS write fatal alert "illegal parameter"

[lpossamai]

Hi all.

I'm trying to setup Encryption between Zabbix Server and Zabbix Agent, but I'm getting the following error:

107733:20220109:232027.488 failed to accept an incoming connection: from 10.0.2.166: TLS handshake set result code to 1: file ../ssl/statem/extensions.c line 1618: error:141FA0FD:SSL routines:tls_psk_do_binder:binder does not verify: TLS write fatal alert "illegal parameter"

The "Availability" shows as being active, but I can see those errors in the zabbix_agentd.log file for both of the hosts.


The zabbix_agentd.conf looks like this:

TLSConnect=psk
TLSAccept=psk
TLSPSKIdentity=PSK001
TLSPSKFile=/etc/zabbix/zabbix_agentd.psk
TLSCipherPSK13=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

The /etc/zabbix/zabbix_agentd.psk file was created like this:

openssl rand -hex 64 | sudo tee /etc/zabbix/zabbix_agentd.psk

The host configuration looks like this:


Openssl version:

ii libxmlsec1-openssl:amd64 1.2.28-2 amd64 Openssl engine for the XML security library
ii openssl 1.1.1f-1ubuntu2.10 amd64 Secure Sockets Layer toolkit - cryptographic utility
ii python3-openssl 19.0.0-1build1 all Python 3 wrapper around the OpenSSL library

List of TLS avaialble (openssl ciphers -v | awk '{print $2}' | sort | uniq)

SSLv3
TLSv1
TLSv1.2
TLSv1.3

Am I missing something?

Thanks in advance!

Edit:

Zabbix server version: 5.4.9
Zabbix agent version: 5.4.9

[lpossamai]

I've found the issue.

### Option: TLSPSKIdentity # Unique, case sensitive string used to identify the pre-shared key. # # Mandatory: no # Default: # TLSPSKIdentity=

I did not see that the TLSPSKIdentity parameter needs to be unique. I've made it unique across my hosts and everything is working now.

[lpossamai]

I've found the issue.

### Option: TLSPSKIdentity # Unique, case sensitive string used to identify the pre-shared key. # # Mandatory: no # Default: # TLSPSKIdentity=

I did not see that the TLSPSKIdentity parameter needs to be unique. I've made it unique across my hosts and everything is working now.

[stavros-k]

And how would you setup PSK autoregistration if this has to be unique? Autoregistration only have option for a single identity

[z0nk]

And how would you setup PSK autoregistration if this has to be unique? Autoregistration only have option for a single identity

same problem, any working solution?

When I changed PSK identity I have error anyway:

cannot find requested PSK identity "XYZ"

It is not possible to declare more PSK identity in Zabbix Server, especially in auto configuration. How solve this issue? All agents are active.