zabbix server and zabbix proxy TLS cert connection

[batchen_regev]

Hey,

im using zabbix 4.0.4
and have passive proxy connected with a client connected to the proxy.
im trying to do a TLS secured connection unsuccessfully..


i this i did succeed with the server and the proxy BUT proxy and client arnt communicating,
here is the err i see on proxy logs :

33852:20190716:071417.568 no active checks on server [xxxxxxxx]: connection of type "TLS with certificate" is not allowed for host "client"
7964:20190716:071420.324 failed to accept an incoming connection: from proxy_server: unencrypted connections are not allowed

proxy settings:

Adminitsrtion -> proxies -> encryption -> certificate & no encryption.
proxy agent at hosts -> encryption -> certificate& encryption
proxy_conf :
TLSConnect=cert
TLSAccept=cert
TLSCAFile=/etc/zabbix/keys/zabbix-ca.crt
TLSCertFile=/etc/zabbix/keys/zabbix-server.crt
TLSKeyFile=/etc/zabbix/keys/zabbix-server.key

proxy_agent_conf:TLSConnect=cert
TLSAccept=cert
TLSCAFile=/etc/zabbix/keys/zabbix-ca.crt
TLSCertFile=/etc/zabbix/keys/zabbix-server.crt
TLSKeyFile=/etc/zabbix/keys/zabbix-server.key

error on proxy side :
20119:20190716:080238.118 resuming Zabbix agent checks on host "client": connection restored
20121:20190716:080359.709 cannot send list of active checks to "10.32.1.60": connection of type "TLS with certificate" is not allowed for host "client"

seems like once it works and then "TLS with certificate" is not allowed".

(windows)zabbix_agent_client conf:
TLSConnect=cert
TLSAccept=cert
TLSCAFile=C:\Program Files\Zabbix\keys\zabbix_ca.crt
TLSCertFile=C:\Program Files\Zabbix\keys\zabbix_agentd.crt
TLSKeyFile=C:\Program Files\Zabbix\keys\zabbix_agentd.key

client gui conf :
hosts -> encryption -> certificate& certificate

And i see the client is available in zabbix-server + giving latest data.
so why do i see in the logs like there is a problem ?
Thanks

[andris]

TLS settings in "zabbix_proxy.conf" specify how the proxy is talking with Zabbix server. This is working as expected as you describe.
But these settings do not specify how proxy is talking with agents. Settings how to talk with each agent the proxy gets from Zabbix server (by default once per hour).
So, you can look is there a mismatch between encryption settings in frontend for a particular host and the "zabbix_agentd.conf" on that host (and is configuration synchronized on server and proxy).

[Hamardaban]

Imagine what your proxy host has 2 role: "proxy" (connecting with the server and other agents) and "agent," which is monitored by using the same proxy (first role). Error in logs are relevant to work zabbix_agent on proxy_host.