Configuring check_nrpe and NRPE daemon with --enable-ssl generates a DH key pair. Are these DH keys enough to establish SSL connection? Or do we need certs and keys signed by a CA? Docs say certificates CAN be used for security.


SSL/TLS can support sessions that do not require X.509 certificates, such as anonymous Diffie Hellman, but it's very unlikely that you'll come across real world implementations that use it - for a start there is no authentication with this cipher suite.

There is documentation here that describes the process needed to configure TLS in Nagios. The Terminology section has:

To implement SSL you need to generate a certificate. When you generate a certificate, you create a request that needs to be signed by a Certificate Authority (CA). This CA can be:

  • A trusted company like VeriSign

  • An internal CA that is part of your IT infrastructure, like a Microsoft Windows CA

  • The Nagios Core server itself (self signed)

Therefore, depending on the level of security/convenience you need, you might get away with a simple self-signed certificate.

  • so with anon DH, there is encryption but no authentication? – pdns Oct 28 '17 at 17:06
  • Correct - DH will be used to generate a symmetric key for encryption, but neither end will know with who they're sharing encrypted information. That's why it's never used. – garethTheRed Oct 28 '17 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.