Zabbix Agent 2 Fails To Start When Using a Certificate

[ssumrall]

Hello, I'm trying to configure Zabbix Agent 2 to use a certificate for passive checks. The configuration works fine if I start the agent from the command line (zabbix_agent2 -c zabbix_agent2.conf). If I start the agent as a serveice (systemctl restart zabbix-agent2.service) it fails. The logfile indicates that it cannot initialize TLS, see log entry below. I have tried different permissions, and ownerships, on the certificate files but that has not helped. For now the certificate, key and zcerts.cer (root and intermediate certs in one file) are all located in /etc/zabbix.

Environment:
Red Hat Enterprise Linux release 9.2
zabbix_agent2 (Zabbix) 6.4.2
openssl.x86_64 1:3.0.7-6

2023/05/23 15:15:23.056953 Starting Zabbix Agent 2 (6.4.2)
2023/05/23 15:15:23.058047 cannot configure encryption: cannot initialize default TLS context: 40C65631E87F0000:error:80000002:system library:BIO_new_file:No such file or directory:crypto/bio/bss_file.c:67:calling fopen(zcerts.cer, r)
40C65631E87F0000:error:10000080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:75:
40C65631E87F0000:error:05880002:x509 certificate routines:X509_load_cert_crl_file_ex:system lib:crypto/x509/by_file.c:228:

[ansible911]

I have the exact same issue with Zabbix Agent 2.

Any success in solving this?

Environment:
Ubuntu 22.04.2 LTS
zabbix-agent2 6.4.2
openssl 3.0.2

[ssumrall]

I did, finally! I had the same problem with Agent 2 on Windows with certs. The solution worked on both platforms. It took forever to figure out the exact combination that would work. I had to put each of the required files in the typical TLS locations and next I had to grant read permission to the Zabbix group. Oh, I also had to create my own CA file with the root and intermediate certificates.

For Red Hat it loos like this.

In /etc/pki/tls/certs/
-rw-r----- 1 root zabbix 4292 May 24 13:24 zabbix_agent2_ca.cer
-rw-r----- 1 root zabbix 2358 May 24 11:02 zabbix_agent2.cer

In /etc/pki/tls/private/
-rw-r----- 1 root zabbix 1704 May 24 11:02 zabbix_agent2.key

This works for me so far but if there are any suggestions to make it better I am open to hear them.