0

I am getting SSL Handshake errors with NRPE after enabling SSL. It worked perfectly fine without SSL doing check_nrpe. The allowed host is correct and when run without SSL enabled it shows the proper version. Both are running 4.3 on CentOS Linux release 7.9.2009 (Core) I did not compile NRPE or nagios from source I installed via Yum.

Here are the configs I feel are important to this issue.

here is the error I'm getting logged... It says wrong version but both are running same version of NRPE.

I am using a real purchased wildcard cert... Same cert on both sides. Cert matches the domain name of the server.

nrpe --version
NRPE - Nagios Remote Plugin Executor
Version: 4.0.3

Same version on both for openssl

openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

When I run ./check_nrpe -H hostname.domain.com I get

CHECK_NRPE: (ssl_err != 5) Error - Could not complete SSL handshake with 10.1.1.125: 1

On the other server it logs:

Jan  5 12:48:54 nagiostest2 nrpe[3575]: Error: (ERR_get_error_line_data = 336130315), Could not complete SSL handshake with 10.1.1.64: wrong version number
Jan  5 12:51:11 nagiostest2 nrpe[3692]: CONN_CHECK_PEER: checking if host is allowed: 10.1.1.64 port 16075
Jan  5 12:51:11 nagiostest2 nrpe[3692]: is_an_allowed_host (AF_INET): is host >10.1.1.64< an allowed host >10.1.1.64<
Jan  5 12:51:11 nagiostest2 nrpe[3692]: is_an_allowed_host (AF_INET): is host >10.1.1.64< an allowed host >10.1.1.64<
Jan  5 12:51:11 nagiostest2 nrpe[3692]: is_an_allowed_host (AF_INET): host is in allowed host list!
Jan  5 12:51:11 nagiostest2 nrpe[3692]: Error: (ERR_get_error_line_data = 336105671), Could not complete SSL handshake with 10.1.1.64: peer did not return a certificate

Here is the important portions of my nrpe.cfg

debug=1

ssl_cipher_list=ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH

ssl_version=TLSv1.1+

#ssl_cipher_list=ALL:!MD5:@STRENGTH
#ssl_cipher_list=ALL:!MD5:@STRENGTH:@SECLEVEL=0
ssl_cipher_list=ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH

# SSL Certificate and Private Key Files

ssl_cacert_file=/etc/nagios/ssl/ca.crt
ssl_cert_file=/etc/nagios/ssl/star.mydomain.com.crt
ssl_privatekey_file=/etc/nagios/ssl/star.mydomain.com.key


# SSL USE CLIENT CERTS
# This options determines client certificate usage.
# Values: 0 = Don't ask for or require client certificates (default)
#         1 = Ask for client certificates
#         2 = Require client certificates
ssl_client_certs=2

# Enables all SSL Logging
ssl_logging=0xff

Thank you for any help ahead of time!

2
  • 2
    "peer did not return a certificate" - looks like the client certificate you requested with ssl_client_certs=2 is not provided. Are you sure that the client is supposed and configured to actually send one, i.e. is the option actually intended or just enabled because you did not know better? Commented Jan 5, 2021 at 21:51
  • So the certs were there... As answered below I needed to add command line flags. i thought the entries in the nrpe.cfg was enough but I had to specify the certs in the command line. Thank you for your help! Commented Jan 7, 2021 at 18:41

1 Answer 1

1

I'm assuming the nrpe.cfg is from the node being called up (10.1.1.125) and if that's the case, as Steffen said above, you have configured it to require a certificate from anyone calling it. Presumably this should be included when you run check_nrpe, and looking at the help text for 4.0.3 (which is the one I have) there's a -C flag for this. So presumably, you either need to include it with your calls, or re-configure the NRPE node being called up.

1
  • 1
    This was it!! I had everything setup correctly I just didn't realize I needed to pass proper flags for it... The certs I had the CA, cert & key were all correct but needed to be passed in the command line check. Thank you so much! I'll post the example in case anyone else comes across it: ./check_nrpe -A /etc/nagios/ssl/ca_chain.crt -C /etc/nagios/ssl/star.mydomain.com.crt -K /etc/nagios/ssl/star.mydomain.com.key -H cos7validation.mydomain.com NRPE v4.0.3 Commented Jan 7, 2021 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .