Help with SSL Validation on a domain with a cert signed by an internal CA?

[surfrock66]

I have an internal EasyRSA Certificate Authority with a root CA installed on all my servers (including the zabbix server, and Ubuntu 24.04 box). I am using the built in certificate validation template (https://www.zabbix.com/integrations/ssl) but the cert is showing as invalid, with the specific failure listed as "failed to verify certificate: x509: certificate signed by unknown authority". I don't see an option in the config or macros to specify a root CA, and I'm wondering how to indicate that. I validated the root certificate is in the server's cert store, and I can verify the ssl cert is fully valid with CURL.

[surfrock66]

I ended up pivoting. I just duplicated my zabbix server as an additional host called "SSL - remotefqdn (via Zabbix Server Agent2)" and only added the cert template and the 2 macros.

[One_Of_The_Martin_s]

Hi there,

even this is a old Thread, I ended up "here" in the same way ... But: I learned:

• The agent (zabbix_agent / zabbix_agent2) does the job ...
  • retrieve the certificate
  • validate the certificate
  • ...

So, the process "zabbix_agent.get_certificate" must be able to validate. I "imported" the internal RootCA into the system-wide's "database" /etc/ssl/certs using "update-ca-certificates".

Maybe this is good four you and someone else.

Martin