0

Configuring check_nrpe and NRPE daemon with --enable-ssl generates a DH key pair. Are these DH keys enough to establish SSL connection? Or do we need certs and keys signed by a CA? Docs say certificates CAN be used for security.

1 Answer 1

2

SSL/TLS can support sessions that do not require X.509 certificates, such as anonymous Diffie Hellman, but it's very unlikely that you'll come across real world implementations that use it - for a start there is no authentication with this cipher suite.

There is documentation here that describes the process needed to configure TLS in Nagios. The Terminology section has:

To implement SSL you need to generate a certificate. When you generate a certificate, you create a request that needs to be signed by a Certificate Authority (CA). This CA can be:

  • A trusted company like VeriSign

  • An internal CA that is part of your IT infrastructure, like a Microsoft Windows CA

  • The Nagios Core server itself (self signed)

Therefore, depending on the level of security/convenience you need, you might get away with a simple self-signed certificate.

2
  • so with anon DH, there is encryption but no authentication?
    – pdns
    Commented Oct 28, 2017 at 17:06
  • Correct - DH will be used to generate a symmetric key for encryption, but neither end will know with who they're sharing encrypted information. That's why it's never used. Commented Oct 28, 2017 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .