Website certificate by Zabbix agent 2 and LDAP server

[mguldner]

I used "Website certificate by Zabbix agent 2" to check an LDAP servers certificate by simply adding {$CERT.WEBSITE.PORT}=636. This worked fine until recently.

Now I am getting "Cannot fetch data: remote error: tls: handshake failure."

Possibly this changed with the upgrade from 7.2 to 7.4 - but this might be a coincidence because there where also changes (patches) on the ldap server side. There was still Agent 2 7.2 on the the LDAP server when the problem first occurred and it did not change with 7.4

zabix_get results in "ZBX_NOTSUPPORTED: Cannot fetch data: remote error: tls: handshake failure."; exactly the same command with port 443 instead of 636 works fine.

openssl s_client works:

[FONT=monospace][COLOR=#ff5454][B]l1:~ #[/B][/COLOR][COLOR=#000000] openssl s_client -connect l1.************:636 -brief [/COLOR]
CONNECTION ESTABLISHED
Protocol version: TLSv1.2
Ciphersuite: AES256-GCM-SHA384
Peer certificate: O = YYY, CN = [COLOR=#000000]l1.************
Verification: OK[/COLOR][/FONT]

In the ldap server's log I see:

TLS accept failure 1 on connection 0x21b8e720, setting err = -5875. Error stack:
error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher

Any idea why Zabbix agent 2 can't get the certificate information any more? Are there any cipher settings to change?

Thanks!

[mguldner]

It seems I can not yet edit my post... corrected version of that "Code" box above:

openssl s_client -connect l1.************:636 -brief
CONNECTION ESTABLISHED
Protocol version: TLSv1.2
Ciphersuite: AES256-GCM-SHA384
Peer certificate: O = YYY, CN = 1.************
Verification: OK

[Markku]

If it helps, you can capture the agent traffic with tcpdump, pktmon or Wireshark (depending on your platform) and open it in Wireshark to see the actual TLS parameters attempted.

There are TLS options in agent 2 configuration file but I think they are for agent-proxy/server communication.

Markku

[mguldner]

Thanks, I tried to find out more with tcpdump....


Connecting with Zabbix Agent 2 (via zabbix_get) showed this in the "Client Hello" packet:

Cipher Suites (13 suites)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)

Connecting with openssl s_connect showed this in the "Client Hello" packet:

    Cipher Suites (31 suites)
    Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
    Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)
    Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
    Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009f)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xccaa)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
    Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
    Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x006b)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
    Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
    Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
    Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
    Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)​

These are the ciphers supported by the LDAP server:

nmap --script ssl-enum-ciphers -p 636 [ldapserver]
Starting Nmap 7.92 ( https://nmap.org ) at 2025-07-16 12:07 CEST
Nmap scan report for ...
Host is up (0.000094s latency).

PORT    STATE SERVICE
636/tcp open  ldapssl
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       Forward Secrecy not supported by any cipher
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 0.54 seconds​

So indeed there seems to be no shared cipher between agent and LDAP server. It is still not clear to me whether this has changed recently on Zabbix's side or on the LDAP server side. Is there anything known about a change with Zabbix?

[Markku]

You can try browsing the release notes (https://www.zabbix.com/release_notes), support portal or Zabbix git repository for related changes, or maybe just install Zabbix agent 2 version 7.0.x, it will be supported a few more years.

Markku

[mguldner]

OK, I investigated this systematically... result: the change came with zabbix agent 7.2.7, not with any OS updates.

7.2.6:

Cipher Suites (19 suites)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
    Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
    Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)
    Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
    Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
    Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
    Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)

7.2.7:

Cipher Suites (13 suites)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
    Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
    Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)​

Now the question is: was this done intentionally by the Zabbix devolopers, or is it some sort of mishap? I don't see anything in the release notes.

[Markku]

I don't see anything obvious in the diff either:

https://git.zabbix.com/projects/ZBX/repos/zabbix/compare/diff?targetBranch=refs%2Ftags%2F7.2.6&sourceBranch=refs%2Ftags%2F7.2.7&targetRepoId=152

You could open an issue at https://support.zabbix.com to get confirmation if this is intended or unintended, and to request fixing it or adding it to the upgrade notes. I don't know if this can be packaging/platform specific, they'll know it.

Markku

[mguldner]

Thanks!

I'll consider opening an issue... for now I have asked for comments in the forum of the manufacturer of the LDAP server (eDirectory).

One more thing came to my mind which seems strange: login to that very same LDAP server with Zabbix still works, its just the agent that restricts ciphers so rigorously, not the server.

[Markku]

One more thing came to my mind which seems strange: login to that very same LDAP server with Zabbix still works, its just the agent that restricts ciphers so rigorously, not the server.

Good catch, agent 2 is Go-based while server is C-based, maybe they use different TLS libraries (and/or they are bundled differently).

Markku