Server not running after trying to add certs

[Minky]

Hello,

today I was trying to add certificates to my zabbix server but when I add them in the config file and restart the server to load the config i get the message
zabbix server is not running the information displayed may not be current

when using systemctl status zabbix-server it says
zabbix-server.service - Zabbix Server Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Tue 2025-04-08 13:09:55 UTC; 5s ago Process: 4651 ExecStart=/usr/sbin/zabbix_server -c $CONFFILE (code=exited, status=0/SUCCESS) Process: 4732 ExecStop=/bin/sh -c [ -n "$1" ] && kill -s TERM "$1" -- $MAINPID (code=exited, status=1/FAILURE) Main PID: 4653 (code=exited, status=0/SUCCESS) CPU: 138ms

I went to etc/zabbix and created a new directory sudo mkdir ssl (where I wanted all the certs to live), then I used sudo openssl req -new -newkey rsa:2048 -nodes -keyout /etc/zabbix/ssl/zabbix_server.key -out /etc/zabbix/ssl/zabbix_server.csr -subj "/CN=li-mon01.<mydomain>.local"
to create the key and csr. I used teh csr to get a certificate from out CA but unlike the documentation i got a .cer instead of .crt.
I then copied the new zabbix_server.cer and the ca´s root .cer to the home directory of the zabbix server. Then sudo coppied it to /etc/zabbix/ssl and now the 2 .cer and the key are in this directory.
Then I edited the conf file and added those 3 lines

and after that i restart zabbix with sudo systemctl restart zabbix-server
And from that point i get the message zabbix server is not running the information displayed may not be current and the status I mentioned earlier.
Where did I go wrong?

Edit:
btw as soon as i put a # in front of my changes in the config file it starts up normaly again.

[cyber]

First thing to do would be to look into server logfile..
you can convert cer to crt if needed (openssl) ... Google helps.

[Minky]

I played around with it for the last hour or so and I think it was just a read privilege problem. The defautl user wasn´t able to read the .key file. I changed read rights with chmod and now the service starts up normal again.
I did the same thing on a test redhat client and its service also starts up normal. But now i get a different error (screenshot below)
This is how i have the host configured in the Zabbix gui:




I think it really doesnt like the .cer file or did I go wrong somewhere else? I will try to find out later today.

[Minky]

Converted the server/host cer and rootCA.cer files to crt using
sudo openssl x509 -in zabbix_server.cer -out zabbix_server.crt -outform PEM
and changed the file extension in the .conf file to the crt files on server and host, still the same problem.



tail -f /var/log/zabbix/zabbix_agent2.log on the host reveales this:


So it appears theres still something wrong with the certs. Any idea what that problem might be?
I´ve never done any such things before and I have no clue. Any time I needed to work with our certs before I could just use our regular .cer file, plop them into whatever application and it just worked.
I don´t know what´s wrong here.


edit: This is what i´ve found since:
I guess that might be part of the issue?