NRPE Could not complete SSL handshake - Peer did not return a ceritificate
0
votes
1
answer
3919
views
I am getting SSL Handshake errors with NRPE after enabling SSL. It worked perfectly fine without SSL doing check_nrpe. The allowed host is correct and when run without SSL enabled it shows the proper version. Both are running 4.3 on CentOS Linux release 7.9.2009 (Core) I did not compile NRPE or nagios from source I installed via Yum.
Here are the configs I feel are important to this issue.
here is the error I'm getting logged... It says wrong version but both are running same version of NRPE.
I am using a real purchased wildcard cert... Same cert on both sides. Cert matches the domain name of the server.
nrpe --version
NRPE - Nagios Remote Plugin Executor
Version: 4.0.3
Same version on both for openssl
openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017
When I run ./check_nrpe -H hostname.domain.com I get
CHECK_NRPE: (ssl_err != 5) Error - Could not complete SSL handshake with 10.1.1.125: 1
On the other server it logs:
Jan 5 12:48:54 nagiostest2 nrpe: Error: (ERR_get_error_line_data = 336130315), Could not complete SSL handshake with 10.1.1.64: wrong version number
Jan 5 12:51:11 nagiostest2 nrpe: CONN_CHECK_PEER: checking if host is allowed: 10.1.1.64 port 16075
Jan 5 12:51:11 nagiostest2 nrpe: is_an_allowed_host (AF_INET): is host >10.1.1.6410.1.1.6410.1.1.6410.1.1.64<
Jan 5 12:51:11 nagiostest2 nrpe: is_an_allowed_host (AF_INET): host is in allowed host list!
Jan 5 12:51:11 nagiostest2 nrpe: Error: (ERR_get_error_line_data = 336105671), Could not complete SSL handshake with 10.1.1.64: peer did not return a certificate
Here is the important portions of my nrpe.cfg
debug=1
ssl_cipher_list=ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH
ssl_version=TLSv1.1+
#ssl_cipher_list=ALL:!MD5:@STRENGTH
#ssl_cipher_list=ALL:!MD5:@STRENGTH:@SECLEVEL=0
ssl_cipher_list=ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH
# SSL Certificate and Private Key Files
ssl_cacert_file=/etc/nagios/ssl/ca.crt
ssl_cert_file=/etc/nagios/ssl/star.mydomain.com.crt
ssl_privatekey_file=/etc/nagios/ssl/star.mydomain.com.key
# SSL USE CLIENT CERTS
# This options determines client certificate usage.
# Values: 0 = Don't ask for or require client certificates (default)
# 1 = Ask for client certificates
# 2 = Require client certificates
ssl_client_certs=2
# Enables all SSL Logging
ssl_logging=0xff
Thank you for any help ahead of time!
Asked by Keith Shannon
(83 rep)
Jan 5, 2021, 09:09 PM
Last activity: Jan 6, 2021, 01:59 PM
Last activity: Jan 6, 2021, 01:59 PM