SSL connect error

[roborative]

I'm trying to monitor a web service but the check fails with an SSL connect error (the log contains: Error doing curl_easy_perform [SSL connect error]). I tried connecting to the service via curl directly from a console and it does not exhibit this error. Is there something I might try to resolve the issue?

[roborative]

So the lack of response on this issue suggest to me that this may be a bug. Should I go ahead and submit this as an issue?

[xs-]

The lack of response is probably due to a lack of sufficient information.

But i'll go ahead and give it a try
- Is the ssl certificate of webservice a valid one or did you self-sign it?
- Can you curl/wget it without any error/warning?
- Is the hostname of the service resolvable via DNS? is there a conflicting /etc/hosts entry? (you aren;t using an IP address for this in zabbix right?)
- Do other SSL sites work from zabbix?
- is your CURL a stock one or did you compile it yourself?

[roborative]

Thanks for the taking the time to respond.

Is the ssl certificate of webservice a valid one or did you self-sign it?

The server uses an Equifax certificate.

Can you curl/wget it without any error/warning?

Yes, curl works fine from the command line with the URL.

Is the hostname of the service resolvable via DNS? is there a conflicting /etc/hosts entry? (you aren;t using an IP address for this in zabbix right?)

Yes. It's a thirdparty's public site and the test uses the hostname.

Do other SSL sites work from zabbix?

Yes.

is your CURL a stock one or did you compile it yourself?

It's the standard version provided in Ubuntu Intrepid.

[xs-]

Well, if other ssl sites work from zabbix, my guess would be a typo or something weird with the ssl negotiation / certificate.

[roborative]

I just double-checked the URL (cut and pasted it from the Zabbix config) and it doesn't exhibit the error. Are there some arguments that are passed to Curl that might explain the difference in the results I'm seeing? I just pass in the URL w/o any specific options.

In case anyone wants to try this at home the URL I'm requesting is:

https://secure.braintreepaymentgateway.com/api/transact.php

[roborative]

BTW, I'm seeing this with Zabbix 1.6.1 running on Ubuntu Intrepid

[roborative]

I've opened an issue for this error:

https://support.zabbix.com/browse/ZBX-727

[StefanJ]

Hello,

we have Zabbix 1.6.4 running on Debian 5.0.1 Lenny and the same problem.

Is there a solution?

Curl works fine, but in Zabbix we have the "SSL connect error" too.

[perlboy]

I've created a fix for this which can be found here

[enkrypt3d]

Seeing the same problems in 2.2.1.... I posted my notes in the jira ticket.

[dimir]

See latest comment in https://support.zabbix.com/browse/ZBX-727 for the fix. The solution is to install libcurl OpenSSL version (instead of GNU TLS) and recompile zabbix.