Sample Header Ad - 728x90

NRPE Could not complete SSL handshake - Peer did not return a ceritificate

0 votes
1 answer
3919 views
I am getting SSL Handshake errors with NRPE after enabling SSL. It worked perfectly fine without SSL doing check_nrpe. The allowed host is correct and when run without SSL enabled it shows the proper version. Both are running 4.3 on CentOS Linux release 7.9.2009 (Core) I did not compile NRPE or nagios from source I installed via Yum. Here are the configs I feel are important to this issue. here is the error I'm getting logged... It says wrong version but both are running same version of NRPE. I am using a real purchased wildcard cert... Same cert on both sides. Cert matches the domain name of the server. nrpe --version NRPE - Nagios Remote Plugin Executor Version: 4.0.3 Same version on both for openssl openssl version OpenSSL 1.0.2k-fips 26 Jan 2017 When I run ./check_nrpe -H hostname.domain.com I get CHECK_NRPE: (ssl_err != 5) Error - Could not complete SSL handshake with 10.1.1.125: 1 On the other server it logs: Jan 5 12:48:54 nagiostest2 nrpe: Error: (ERR_get_error_line_data = 336130315), Could not complete SSL handshake with 10.1.1.64: wrong version number Jan 5 12:51:11 nagiostest2 nrpe: CONN_CHECK_PEER: checking if host is allowed: 10.1.1.64 port 16075 Jan 5 12:51:11 nagiostest2 nrpe: is_an_allowed_host (AF_INET): is host >10.1.1.6410.1.1.6410.1.1.6410.1.1.64< Jan 5 12:51:11 nagiostest2 nrpe: is_an_allowed_host (AF_INET): host is in allowed host list! Jan 5 12:51:11 nagiostest2 nrpe: Error: (ERR_get_error_line_data = 336105671), Could not complete SSL handshake with 10.1.1.64: peer did not return a certificate Here is the important portions of my nrpe.cfg debug=1 ssl_cipher_list=ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH ssl_version=TLSv1.1+ #ssl_cipher_list=ALL:!MD5:@STRENGTH #ssl_cipher_list=ALL:!MD5:@STRENGTH:@SECLEVEL=0 ssl_cipher_list=ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH # SSL Certificate and Private Key Files ssl_cacert_file=/etc/nagios/ssl/ca.crt ssl_cert_file=/etc/nagios/ssl/star.mydomain.com.crt ssl_privatekey_file=/etc/nagios/ssl/star.mydomain.com.key # SSL USE CLIENT CERTS # This options determines client certificate usage. # Values: 0 = Don't ask for or require client certificates (default) # 1 = Ask for client certificates # 2 = Require client certificates ssl_client_certs=2 # Enables all SSL Logging ssl_logging=0xff Thank you for any help ahead of time!
Asked by Keith Shannon (83 rep)
Jan 5, 2021, 09:09 PM
Last activity: Jan 6, 2021, 01:59 PM