Zabbix 7.o LTS - will not start with SSL Configured

[eebc-ict-netman]

I hope someone is able to help?

installing Zabbix 7.0 LTS today on Ubuntu 24.04

when I configured the server for SSL, (with the same details I have used for Zabbix 60. LTS & Zabbix 7.0 rc3, but these both worked without a problem), I get an error message when restarting nginx.

I only get a partial message (as I am unable to find the file where the error message is stored, odd, I have looked everywhere I can think of), the error is as follows.
Jun 04 17:54:57 zabbix systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Jun 04 17:54:57 zabbix nginx[2174]: 2024/06/04 17:54:57 [emerg] 2174#2174: cannot load certificate "/etc/ssl/domain.crt": BIO_new_file() failed (S>
Jun 04 17:54:57 zabbix nginx[2174]: nginx: configuration file /etc/nginx/nginx.conf test failed
Jun 04 17:54:57 zabbix systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE
Jun 04 17:54:57 zabbix systemd[1]: nginx.service: Failed with result 'exit-code'.
Jun 04 17:54:57 zabbix systemd[1]: Failed to start nginx.service - A high performance web server and a reverse proxy server.
can anyone help me with the messages and where they are stored or which file?

the nginx.conf file is as follows.
listen 80;
listen 443 ssl;

server_name zabbix7.domain;
keepalive_timeout 70;

ssl_certificate /etc/ssl/domain.crt;
ssl_certificate_key /etc/ssl/domain.rsa;

ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;

the folder where the crt and key file are below.
ls /etc/ssl -l
total 48
drwxr-xr-x 2 root root 20480 Apr 23 10:40 certs
-r--r--r-- 1 root root 3859 Jun 4 13:18 domain.crt
-r--r--r-- 1 root root 3272 Jun 4 13:17 domain.rsa
-rw-r--r-- 1 root root 12324 Mar 31 07:42 openssl.cnf
drwx------ 2 root root 4096 Mar 31 07:42 private
these are the same files I have just updated on my 6.0 LTS and also for testing yesterday, the 7.0 rc3 install....

It all works when using HTTP, but https is just not playing ball.

[Markku]

What does Nginx error.log say?

One potential problem is that your TLS key file (the secret one) is world-accessible, instead of having it with restricted access in the /etc/ssl/private directory.

Markku

[tim.mooney]

I only get a partial message (as I am unable to find the file where the error message is stored, odd, I have looked everywhere I can think of), the error is as follows.
Jun 04 17:54:57 zabbix systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Jun 04 17:54:57 zabbix nginx[2174]: 2024/06/04 17:54:57 [emerg] 2174#2174: cannot load certificate "/etc/ssl/domain.crt": BIO_new_file() failed (S>

Markku's suggestion about permissions on the private key was a good one, you should definitely fix that.

As far as the log messages, anything that isn't written to the application's specific log file (Nginx log files, as Markku mentioned) is captured by systemd and written to a system "journal".

If you just run

sudo systemctl status -l nginx.service

systemctl annoyingly truncates log messages at your screen width.

If, however, you pipe the output into something, it doesn't do that, so doing

sudo systemctl status -l nginx.servicce | less

will get you the full message.

You also may want to take a look at the man page for journalctl. It describes a more general tool for querying the contents of the systemd journal. For a failed service startup where you know the service, "systemctl status -l <service>" is easier, but understanding journalctl may also be helpful.

[eebc-ict-netman]

hi Markku,

thanks for the info I would usually lock it up, I have changed them both to 400, still the same error, see below.

tim.mooney - your info much appreciated, thank you, forgot about using 'less'.

and as it turns out, it was a schoolboy error, simple to fix.

naming (and security) is everything!

thanks both for your help in pointing out that my problem was an ID10T problem..