Zabbix 6.0.8 - Certificate setup to communicate secure between server and proxy fails

[Peter Welter]

We have a simple setup of

• 1 zabbix server and
• 1 zabbix proxy version 6.0.8; both rhel8.

With 'no encryption' the setup works. The zabbix server and the zabbix proxy server see each other.

We try to follow the documentation https://www.zabbix.com/documentation...-zabbix-server but we must say that this page is not helpful enough, unfortunately.

We have certificates for both server with a valid CA but both servers (even in Debuglevel 5) only fail these errors in theire respective logs:

zabbix-server:

340989:20220901:112756.365 failed to accept an incoming connection: from xxx.xxx.xxx.xxx: TLS handshake set result code to 1: file ssl/record/rec_layer_s3.c line 1544: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48: TLS read fatal alert "unknown CA"

340987:20220901:112757.374 failed to accept an incoming connection: from xxx.xxx.xxx.xxx: TLS handshake set result code to 1: file ssl/record/rec_layer_s3.c line 1544: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48: TLS read fatal alert "unknown CA"

340986:20220901:112758.383 failed to accept an incoming connection: from xxx.xxx.xxx.xxx: TLS handshake set result code to 1: file ssl/record/rec_layer_s3.c line 1544: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48: TLS read fatal alert "unknown CA"
​

zabbix proxy-server:

244980:20220901:115216.770 Unable to connect to [zabbix-server-dns-name]:10051 [TCP successful, cannot establish TLS to [[zabbix-server-dns-name]:10051]: unable to get local issuer certificate: SSL_connect() set result code to SSL_ERROR_SSL: file ssl/statem/statem_clnt.c line 1915: error:1416F086:SSL routines:tls_process_server_certificate:certificat e verify failed: TLS write fatal alert "unknown CA"]

244980:20220901:115216.770 Will try to reconnect every 1 second(s)

244976:20220901:115216.832 proxy [NODE="8"]Private Messages[/NODE] started [preprocessing worker #1]

244978:20220901:115216.832 proxy #10 started [preprocessing worker #3]

244980:20220901:115316.362 Still unable to connect...

244969:20220901:115416.769 Still unable to connect...
​

And now we do not see what is missing (Unknown CA?) or even the next step how to proceed?

Any help is appreciated.
--
Peter

[Hamardaban]

Have you configured the TLSCAFile parameter ?

https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_server

https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_proxy

[Peter Welter]

Hi @Hamardaban,

Thanks for the suggestion and the links.

We have set up this particular setting:


ZABBIX PROXY

TLSConnect=cert

TLSAccept=cert

TLSCAFile=/etc/pki/tls/certs/sectigo_ov_chain.pem

TLSServerCertIssuer=CN=...

TLSServerCertSubject=CN=...

TLSCertFile=/etc/pki/tls/certs/zabbix-proxy-....pem

TLSKeyFile=/etc/pki/tls/private/zabbix-proxy-....key

ZABBIX-SERVER

TLSConnect=cert

TLSCAFile=/etc/pki/tls/certs/sectigo_ov_chain.pem

TLSCertFile=/etc/pki/tls/certs/zabbix-server....pem

TLSKeyFile=/etc/pki/tls/private/zabbix-server....key

[Hamardaban]

Check that the user on whose behalf zabbix is running has rights to read files with certificates.
At the time of the tests, comment TLSServerCertIssuer and TLSServerCertSubject.
Try connecting to the server using the openssl test utility. "openssl s_client -CApath /etc/pki/tls/certs/sectigo_ov_chain.pem -connect zserver:zport"

[Peter Welter]

Hi Hamardaban

Testing with openssl s_client hints why Zabbix fails to connect, I guess.

The -CApath (without the CA-filename) or -CAfile (with the CA-filename, as suggested), both returned the same error:

# openssl s_client -CApath /etc/pki/tls/certs/ -connect zabbix-server...:10051

CONNECTED(00000003)

depth=0 C = NL, ST = Zuid-Holland, O = Universiteit Leiden, CN = zabbix-server

verify error:num=20:unable to get local issuer certificate

verify return:1

depth=0 C = NL, ST = Zuid-Holland, O = Universiteit Leiden, CN = zabbix-server

verify error:num=21:unable to verify the first certificate

verify return:1

depth=0 C = NL, ST = Zuid-Holland, O = Universiteit Leiden, CN = zabbix-server

verify return:1
​

We have to fix this first, I guess and I will come back to this next week. Thanks for the help!

[Peter Welter]

After two more days of frustration, with the documentation, videos, forum, the software error messages we almost gave up on Zabbix. Implementing of secure communication with Certificates did not succeed in our case.

Fortunately within an half hour (!) we could enjoy encryption between all part (Zabbix server, Zabbix Proxy and Clients ) https://www.zabbix.com/documentation...re_shared_keys it just works as described!!!!

[Stefano A]

Hi Peter. I agree with what you wrote, after one week of frustration , no way to implement secure communication zabbix server-proxy with certificates. I verified everything more times (server and proxy confs, firewall, certificates), I debugged communication with all tools but nothing. My error is the following:

 cannot connect to proxy "[I]proxyname[/I]": TCP successful, cannot establish TLS to [[[I]proxyname.domain[/I]]:10051]: unable to get issuer certificate: SSL_connect() set result code to SSL_ERROR_SSL: file ../ssl/statem/statem_clnt.c line 1883 func tls_post_process_server_certificate: error:0A000086:SSL routines::certificate verify failed: TLS write fatal alert "unknown CA"

I don't know what else I can do.

Now I'll try with pre-shared keys...