GLPI-Agent 1.7 : SSL not working #567

waaalex · 2023-12-22T13:46:01Z

waaalex
Dec 22, 2023

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Hello,
Since 1.7 update, ssl does not works (check from keystore). Here is error message :

[Fri Dec 22 14:40:29 2023][info] [http server] HTTPD service started on port 62354
[Fri Dec 22 14:40:30 2023][info] GLPI Agent memory usage: WSS=4800512 PFU=111255552
[Fri Dec 22 14:40:30 2023][info] target server0: next run: Fri Dec 22 14:40:28 2023 - https://glpi/glpi/plugins/glpiinventory/
[Fri Dec 22 14:40:30 2023][info] target server0: server https://glpi/glpi/plugins/glpiinventory/
[Fri Dec 22 14:40:30 2023][info] sending contact request to server0
[Fri Dec 22 14:40:30 2023][error] [http client] internal response: 500 Can't connect to glpi:443 (Bad file descriptor), SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
[Fri Dec 22 14:40:30 2023][error] [http client] unexpected content, starting with: Can't connect to glpi:443 (Bad file descriptor)
[Fri Dec 22 14:40:30 2023][error] No supported answer from server at https://glpi/glpi/plugins/glpiinventory/
[Fri Dec 22 14:40:30 2023][info] target server0: next run: Fri Dec 22 14:41:30 2023 - https://glpi/glpi/plugins/glpiinventory/
[Fri Dec 22 14:41:30 2023][info] target server0: server https://glpi/glpi/plugins/glpiinventory/
[Fri Dec 22 14:41:30 2023][info] sending prolog request to server0
[Fri Dec 22 14:41:30 2023][error] [http client] internal response: 500 Can't connect to glpi:443 (Bad file descriptor), SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
[Fri Dec 22 14:41:30 2023][error] No supported answer from server at https://glpi/glpi/plugins/glpiinventory/
[Fri Dec 22 14:41:30 2023][info] target server0: next run: Fri Dec 22 14:43:30 2023 - https://glpi/glpi/plugins/glpiinventory/
[Fri Dec 22 14:41:30 2023][info] GLPI Agent memory usage: WSS=3592192 PFU=124964864

When i enable no-ssl-check, it works.
@g-bougard told me :
But before, first check if you have enabled one of the ca-cert-file, ca-cert-dir or ssl-fingerprint option. From v1.7, if one of these options is used, we consider it must work and so we don't export windows keystore. If you want to use keystore, don't set any of these options.

All these options are disabled.
If i come back to 1.6.1, it work.

Glpi-agent 1.6.1 checks ssl validity with windows keystore, maybe this feature is not enable in 1.7?

glpi and inventory plugin in latest version.
Can you help me?
Thanks.
Regards.

Answered by g-bougard

Dec 22, 2023

Of course... I just published a hotfix ;-)

Get it there: https://github.com/glpi-project/glpi-agent/releases/tag/1.7.1

View full answer

g-bougard · 2023-12-22T14:00:57Z

g-bougard
Dec 22, 2023
Maintainer

Hi @waaalex

can you open an administrative console, cd to the agent installation folder and run the following command ? Than share the output:

glpi-agent --debug --debug --logger=stderr --tasks=inventory --force

This should provide more debug details on the SSL checks with all the required debug from the agent.

0 replies

waaalex · 2023-12-22T14:36:26Z

waaalex
Dec 22, 2023
Author

Hi,
Here is output :

C:\Program Files\GLPI-Agent>glpi-agent --debug --debug --logger=stderr --tasks=inventory --force
[debug] Logger backend Stderr initialized
[debug] Logger backend File initialized
[debug] GLPI Agent (1.7)
[debug] Configuration directory: C:/Program Files/GLPI-Agent/etc
[debug] Data directory: C:/Program Files/GLPI-Agent/share
[debug] Storage directory: C:\Program Files\GLPI-Agent\var
[debug] Lib directory: C:/Program Files/GLPI-Agent/perl/agent
[debug] [target server0] Next server contact planned for Fri Dec 22 15:34:56 2023
[debug2] getAvailableTasks() : add of task Collect version 2.9
[debug2] getAvailableTasks() : add of task Deploy version 3.0
[debug2] getAvailableTasks() : add of task Inventory version 1.15
[debug2] getAvailableTasks() : add of task RemoteInventory version 1.4
[debug2] Preparing execution plan
[debug] Available tasks:
[debug] - Collect: 2.9
[debug] - Deploy: 3.0
[debug] - Inventory: 1.15
[debug] - RemoteInventory: 1.4
[debug] target server0: server https://glpi/glpi/plugins/glpiinventory/
[debug] Planned tasks for server0: Inventory
[debug] Provided by Teclib Edition
[debug] Installer built on Thu Dec 21 14:26:35 2023 UTC
[debug] Built with Strawberry Perl 5.36.0
[debug] Built on github actions windows image for glpi-project/glpi-agent repository
[debug] Running in foreground mode
[info] server0 is not ready yet, but run is forced
[info] target server0: server https://glpi/glpi/plugins/glpiinventory/
[debug2] [http client] Using Compress::Zlib for compression
[info] sending prolog request to server0
[debug2] [http client] sending message:
<?xml version="1.0" encoding="UTF-8"?>
<REQUEST>
  <DEVICEID>PT-350.get.com-2023-06-30-15-20-29</DEVICEID>
  <QUERY>PROLOG</QUERY>
  <TOKEN>12345678</TOKEN>
</REQUEST>
DEBUG: .../IO/Socket/SSL.pm:3020: new ctx 103201776
DEBUG: .../IO/Socket/SSL.pm:705: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:707: socket connected
DEBUG: .../IO/Socket/SSL.pm:730: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:774: using SNI with hostname glpi
DEBUG: .../IO/Socket/SSL.pm:815: request OCSP stapling
DEBUG: .../IO/Socket/SSL.pm:831: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:845: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:3700: * TLSv1.3 (OUT), TLS handshake, Client hello (1)
DEBUG: .../IO/Socket/SSL.pm:848: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:858: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:868: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:888: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:845: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:3700: * TLSv1.3 (IN), TLS handshake, Server hello (2)
DEBUG: .../IO/Socket/SSL.pm:3700: * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8)
DEBUG: .../IO/Socket/SSL.pm:3700: * TLSv1.3 (IN), TLS handshake, Certificate (11)
DEBUG: .../IO/Socket/SSL.pm:2864: ok=0 [0] /DC=xx/DC=xx/CN=xx-XX-CA/C=x/ST=x/L=x/O=x/CN=glpi
**DEBUG: .../IO/Socket/SSL.pm:3700: * TLSv1.3 (OUT), TLS alert, unknown CA (560)**
DEBUG: .../IO/Socket/SSL.pm:848: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:851: SSL connect attempt failed

DEBUG: .../IO/Socket/SSL.pm:851: local error: SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
DEBUG: .../IO/Socket/SSL.pm:854: fatal SSL error: SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
DEBUG: .../lib/Net/HTTPS.pm:67: ignoring less severe local error 'IO::Socket::IP configuration failed', keep 'SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed'
DEBUG: .../IO/Socket/SSL.pm:3069: free ctx 103201776 open=103201776
DEBUG: .../IO/Socket/SSL.pm:3073: free ctx 103201776 callback
DEBUG: .../IO/Socket/SSL.pm:3080: OK free ctx 103201776
[error] [http client] internal response: 500 Can't connect to glpi:443 (Bad file descriptor), SSL connect attempt failed error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
[error] No supported answer from server at https://glpi/glpi/plugins/glpiinventory/

It seems that agent does not recognize CA :
**DEBUG: .../IO/Socket/SSL.pm:3700: * TLSv1.3 (OUT), TLS alert, unknown CA (560)**

Regards.
Et joyeux noel ;)

4 replies

g-bougard Dec 22, 2023
Maintainer

Okay, just understand there's a little regression due to the update related to #560

waaalex Dec 22, 2023
Author

Ok i will wait for a fix. I can make tests to validate your correction.

g-bougard Dec 22, 2023
Maintainer

Of course... I just published a hotfix ;-)

Get it there: https://github.com/glpi-project/glpi-agent/releases/tag/1.7.1

Answer selected by waaalex

waaalex Dec 22, 2023
Author

Perferct! It work now.
Thank you very much @g-bougard

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GLPI-Agent 1.7 : SSL not working #567

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 4 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

GLPI-Agent 1.7 : SSL not working #567

waaalex Dec 22, 2023

Documentation & bug reporting acknowledgment

Describe your problem

Replies: 2 comments · 4 replies

g-bougard Dec 22, 2023 Maintainer

waaalex Dec 22, 2023 Author

g-bougard Dec 22, 2023 Maintainer

waaalex Dec 22, 2023 Author

g-bougard Dec 22, 2023 Maintainer

waaalex Dec 22, 2023 Author

waaalex
Dec 22, 2023

Replies: 2 comments 4 replies

g-bougard
Dec 22, 2023
Maintainer

waaalex
Dec 22, 2023
Author

g-bougard Dec 22, 2023
Maintainer

waaalex Dec 22, 2023
Author

g-bougard Dec 22, 2023
Maintainer

waaalex Dec 22, 2023
Author