Zbx 6.0.7 - no suitable signature algorithm TLS write fatal alert handshake failure

[Metalgalle]

Hello everybody,
I already done some searches, but I can't find a way to get rid of this problem.

I have a server/proxy infrastructure.
All the zabbix machines are on Ubuntu 20.04 and are updated to version 6.0.x.

I have the Zabbix server at my HQ, and 8 proxies at my customers.

All the Proxies are in active mode, and contact my Zabbix server via FQDN.

All the configurations of the proxies are the same, same timing, same connection method (TLS-PSK).


I noticed that one of those proxies (one and only one) makes the server write this log line once per second:

1025626:20220804:170306.233 failed to accept an incoming connection: from x.x.x.x: TLS handshake set result code to 1: file ../ssl/t1_lib.c line 2750: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm: TLS write fatal alert "handshake failure"

None of the other proxies makes this problem.


Note that the "malfunctioning" proxy, works correctly (I can monitor the remote items and send configuration modifications), and does not write errors in the log file.


I already tried to check firewall side, but no errors.
Tried also to trim the PSK in order to get back below the 512bits, but nothing changed.


I hope that anyone can bring me in the correct direction to solve the problem!


Thanx a lot to everyone in advance!

[andris]

Hi!

Can you check what are OpenSSL versions on your server and the problematic proxy?
Is OpenSSL version on the problematic proxy the same as on normally connecting proxies?
Is TLSConnect parameter in zabbix_proxy.conf correct for the problematic proxy?

[Metalgalle]

Sorry for late reply.

OpenSSL are at the same version (OpenSSL 1.1.1f 31 Mar 2020), and is also the same on another correctly working proxy.

TLSConnect parameter is correctly set to "psk" as the other proxies are...

[andris]

Hmm... Everything is the same but works differently ...
For deeper investigation maybe you can use Wireshark or tcpdump to capture packets and see the difference what comes from normal and problematic proxies.

[Markku]

8 proxies at my customers

Also verify with the affected customer if they have some kind of TLS intercept/decrypt in their firewall that could affect the TLS connections from the proxy.

Markku

[Metalgalle]

Also verify with the affected customer if they have some kind of TLS intercept/decrypt in their firewall that could affect the TLS connections from the proxy.

Markku

Thanx a lot Markku, disabling the IPS on the firewall at the client-side did the trick!