SSL_shutdown errors when using PSK to Zabbix Proxy

[philthynz]

I have a Zabbix proxy connecting to the server with certificates, and I want to use a Zabbix agent on the same machine to connect to the proxy.

Zabbix TLS Proxy config:

TLSConnect=cert
TLSAccept=cert,psk,unencrypted
TLSCAFile=/opt/certs/zabbix_ca_file
TLSServerCertIssuer=CN=domain,DC=domain,DC=com
TLSServerCertSubject=CN=server.domain.com,OU=ou,O= company,L=city,ST=state,C=country
TLSCertFile=/opt/certs/zabbix_client.crt
TLSKeyFile=/opt/certs/client_csr.key

Zabbix TLS Agent config:

TLSConnect=psk
TLSAccept=unencrypted,psk
TLSPSKIdentity=zabbixproxy1w
TLSPSKFile=/etc/zabbix/zabbix_agentd.psk

In the Agent log I see:

18416:20190902:113148.977 SSL_shutdown() with 127.0.0.1 set result code to 1: file ../ssl/ssl_lib.c line 2072: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init
18416:20190902:113148.977 active check configuration update from [127.0.0.1:10051] started to fail (TLS read set result code to 1: file ../ssl/record/rec_layer_s3.c line 1528: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required: SSL alert number 116: TLS read fatal alert "unknown")

18416:20190902:113248.992 SSL_shutdown() with 127.0.0.1 set result code to 1: file ../ssl/ssl_lib.c line 2072: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init
18416:20190902:113349.006 SSL_shutdown() with 127.0.0.1 set result code to 1: file ../ssl/ssl_lib.c line 2072: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init


The data from the Agent is being received by the server. Any idea what these errors mean?

[Hamardaban]

I see the configs you have proxy configured to use for tls connection. That's what the proxy does by connecting to the agent for a list of active checks! And the agent does not accept this connection because "TLSAccept=unencrypted,psk"

[philthynz]

Thanks for the response. I also tried with:

Zabbix TLS Proxy config:

TLSConnect=cert
TLSAccept=psk
TLSCAFile=/opt/certs/zabbix_ca_file
TLSServerCertIssuer=CN=domain,DC=domain,DC=com
TLSServerCertSubject=CN=server.domain.com,OU=ou,O= company,L=city,ST=state,C=country
TLSCertFile=/opt/certs/zabbix_client.crt
TLSKeyFile=/opt/certs/client_csr.key

Zabbix TLS Agent config:

TLSConnect=psk
TLSAccept=psk
TLSPSKIdentity=zabbixproxy1w
TLSPSKFile=/etc/zabbix/zabbix_agentd.psk

I imagine that tells the proxy to accept only psk for active checks, and the agent will only use psk for passive and active checks. Unfortunately it has same errors.

Proxy errors:
7428:20190903:114651.803 failed to accept an incoming connection: from 192.168.3.2: TLS handshake set result code to 1: file ../ssl/statem/statem_srvr.c line 3654: error:1417C0C7:SSL routines:tls_process_client_
certificateeer did not return a certificate: TLS write fatal alert "unknown"

Agent errors:
28627:20190903:114621.900 SSL_shutdown() with zabbixproxy.domain.com set result code to 1: file ../ssl/ssl_lib.c line 2072: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init



Is this because the proxy connects to the server with TLS cert? Can we use psk in combination with cert?

[Hamardaban]

As I wrote the problem in connection the proxy TO the agent! Carefully read the documentation about how the server / proxy transmits a list of checks to active agent

[philthynz]

Yes I see. The Proxy makes active connection attempts via cert. So the Agent needs to accept cert and not psk.

I moved the agents to cert based encryption and it solved the issue. Thanks.