Web scenario fail because of certificate check error

[Aer0]

Hello everyone!

In my Zabbix i have a "Web scenario" which is checking access to a HTTPS web page at a neighbour server and i have two options Enabled on "Authentication" tab for it: "SSL verify peer" and "SSL verify host".

At the "Last error message of scenario" we get a message: "SSL certificate problem: unable to get local issuer certificate"

As we think that's because we use self-sing sertificates.

But what i'm trying to find out where the problem is? At the Zabbix Proxy or at the remote server?

Do i need to have self-sign root CA certificates at the Zabbix Proxy for the correct work of this item?

And I'm not sure i understart what is the full chain of this checks? What steps does Zabbix do to check the SSL and Host?

Does anyone has some manual for importing self-sing sertification into Zabbix if this is necessarily?

[Brambo]

Hello everyone!

In my Zabbix i have a "Web scenario" which is checking access to a HTTPS web page at a neighbour server and i have two options Enabled on "Authentication" tab for it: "SSL verify peer" and "SSL verify host".

Do you really need webscenario or is http agent (item) enough?
Both webscenario / http agent are executed by / on the host you configure it.
In the http agent item you have the option to leave SSL verify peer/ verify host disabled. But also the option to provided certificate etc.
Again the checks are done by the agent running on your host / server so if you are using self signed certificate the hosts doesn't know the authority then you must make sure it's know at the host. And when using docker additional steps could be needed.

[Aer0]

Both webscenario / http agent are executed by / on the host you configure it.

Are you sure about that? I have the Host connected to Zabbix only by SNMP. As i understand SNMP doesn't has such instruments to make local HTTP check. So i suppose that all the checks are making by Zabbix Proxy, so i still don't understand which certificates i need to have on my Proxy((((

[Brambo]

Are you sure about that? I have the Host connected to Zabbix only by SNMP. As i understand SNMP doesn't has such instruments to make local HTTP check. So i suppose that all the checks are making by Zabbix Proxy, so i still don't understand which certificates i need to have on my Proxy((((

The root and/or intermediate authority needs to be know for a succesfull certificate check. But if you only want to retrieve some data from a page you don't need it to get it working.
And thinking of it, you are right about where the check is done with the http and web scenario. If host is monitored by proxy the check is done by proxy, no proxy then zabbix server.

[cyber]

http checks as well as web scenarios are executed on server/proxy, whichever is assigned to a host..

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/http

HTTP item checks are executed by Zabbix server. However, when hosts are monitored by a Zabbix proxy, HTTP item checks are executed by the proxy.
HTTP item checks do not require any agent running on a host being monitored.