Zabbix Agent SSL_read() timed out

[pah]

Hello,

we're using Zabbix 4.0 LTS with active Zabbix Agent checks and PSK encryption successfully with over 200 hosts.

But now we have a strange problem with two new hosts: the checks cannot be retrieved from the server by the agent.

Zabbix Server version: 4.0.17

Zabbix Agent versions tried: 4.0.10, 4.0.16, 4.4.5

Error in Zabbix Agent log:

active check configuration update from [monitoring.example.com:10051] started to fail (SSL_read() timed out)

(Hostname masked)

Does anyone have an idea what this could be?

Log from the server contains no information. Increased debug level at the agent does not result in anything interesting either.

[lewis lee]

I got same problem in 4.2.4

[tim.mooney]

Zabbix depends on the underlying host OS's encryption routines. Typically on Linux that means the OpenSSL library, but it's possible Zabbix could be built to use some other implementation instead.

When reporting TLS/SSL problems between two endpoints, it's therefore very useful to know not just the versions of the Zabbix software, but also OS and version of each host involved.

There could be many reasons why these things are failing, but the first guess (and that's all it is) I would make is that the new clients are using a more recent operating system, which includes updated settings for TLS, and those updated settings are not compatible with the settings in use on your Zabbix server. One example of this would be if the new clients are defaulting to TLS version 1.2 and 1.3 only, while the server only supports TLS 1.0 and 1.1. An even more likely scenario is that both the client and the server support e.g TLS 1.2, but they don't share a common cipher.

Of course, the problem could be something else entirely, that has nothing to do with TLS or SSL version incompatibilities. Have you verified form the client that you can even connect to the appropriate port on the server, and that it's not something simple like a firewall or routing issue between the systems?

[lewis lee]

I encountered same problem in Zabbix Appliance container 4.2.4. After upgraded to Zabbix Appliance container 4.4.6, the problem was solved.