Web Monitor with SSL Certificate - Zabbix 3.4

[lpossamai]

Hi all,

I am trying to setup a Web Monitor for my API. It is a HTTPS connection which requires an SSL certificate.

Using the curl command, I do it this way:

curl --cert /etc/zabbix/certs/cert_prod.pem https://api.example.com/Ping/1.1

The output of that command will be in XML format:

<?xml version="1.0" encoding="UTF-8"?><ping><service name="FBcheckOnline" status="down"/><service name="APICheckOn" status="up"/></ping>

Here is how I am trying to do it using the Web Scenario feature:

1. Setting up the Web Scenario:


2. Setting ut the Authentication part:


3. Setting up the Steps:



The error that I get from the check is:

Step "Services" [1 of 1] failed: SSL connect error: NSS: client certificate not found: /usr/share/zabbix/ssl/certs/cert_prod.pem

What am I doing wrong?
Cheers


EDIT 1:

I had the certificate in the wrong directory. Fixed it and now I am getting the following error:

failed: Problem with the local SSL certificate: unable to load client cert: -8018 (SEC_ERROR_UNKNOWN_PKCS11_ERROR)

[kernbug]

Hi all,

I had the certificate in the wrong directory. Fixed it and now I am getting the following error:

failed: Problem with the local SSL certificate: unable to load client cert: -8018 (SEC_ERROR_UNKNOWN_PKCS11_ERROR)

Hello

Did you set the Zabbix user's permissions on the file /usr/share/zabbix/ssl/certs/cert_prod.pem including ssl and cert directory?

[jan.garaj]

I guess you need:
SSL certificate file
AND
SSL key file

And both of them must be in PEM format. It looks like you have a problem with format of the key. Maybe it's encrypted key (then use also SSL key password).

https://www.zabbix.com/documentation/3.4/manual/web_monitoring

[lpossamai]

I guess you need:
SSL certificate file
AND
SSL key file

And both of them must be in PEM format. It looks like you have a problem with format of the key. Maybe it's encrypted key (then use also SSL key password).

https://www.zabbix.com/documentation...web_monitoring

I am now trying with the SSL Key and Cert, as follow (It works when using Curl directly):

 
 curl --cert /etc/zabbix/certs/cert_prod.pem --key /etc/zabbix/certs/cert_key.key https://api.example.com/Ping/1.1

Getting the same error though:

 
 failed: Problem with the local SSL certificate: unable to load client cert: -8018 (SEC_ERROR_UNKNOWN_PKCS11_ERROR)

[lpossamai]

Hello

Did you set the Zabbix user's permissions on the file /usr/share/zabbix/ssl/certs/cert_prod.pem including ssl and cert directory?

Yup.. permissions look fine.

[jan.garaj]

Inspect your cert/key:

openssl x509 -in <pem cert/key> -noout -text

[lpossamai]

Inspect your cert/key:

openssl x509 -in <pem cert/key> -noout -text

For the cert it looks okay.

When doing it for the key I get the following error:

unable to load certificate
139628354000784:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE

EDIT 1:

Getting another error now:

failed: Problem with the local SSL certificate: unable to load client key: -8178 (SEC_ERROR_BAD_KEY)

However, again... with the CURL command, the key/cert works.

curl --cert /usr/share/zabbix/ssl/certs/cert_prod.pem --key /usr/share/zabbix/ssl/keys/key_prod.key -s https://api.example.com/Ping/1.1

[lpossamai]

Hi all,

I was able to get it working just by changing the zabbix_server.conf:

from:

SSLKeyLocation=${datadir}zabbix/ssl/keys

to:

SSLKeyLocation=/usr/share/zabbix/ssl/keys

It's working fine! Thanks!