[SOLVED] CheckMK-Installation/Configuration help needed on SSL

[AndreasS]

Hello again,

I have just put monitoring for Proxmox VE (most recent version/patchlevel) on our CheckMK (Agent 2.4.0p18). Following CheckMK-how-to (CheckMK Proxmox Monitoring) and Thomas-Krenn-how-to (Thomas-Krenn Proxmox Monitoring). All is working fine apart from two issues:

1. This critical event occurs for services on all of the single nodes: "Check_MK" (A) and "Check_MK inventory" (B):

A) [agent] Success, [special_proxmox_ve] Agent exited with code 1: Could not connect to PROX01.domain.local:8006 (HTTPSConnectionPool(host='prox01.domain.local', port=8006): Max retries exceeded with url: /api2/json/access/ticket (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)'))))[B]CRIT[/B], [piggyback] Success (but no data found for this host), execution time 2.8 sec

B) Services: all up to date, Host labels: all up to date, [special_proxmox_ve] Agent exited with code 1: Could not connect to PROX01.domain.local:8006 (HTTPSConnectionPool(host='prox01.domain.local', port=8006): Max retries exceeded with url: /api2/json/access/ticket (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)'))))[B]CRIT[/B], execution time 0.7 sec

the same obviously from the Cluster added via special agent (vs. the single nodes) added to CheckMK. The above fixed, will fix this one as well, I guess.

I know that somewhere some SSL-Certificat needs to go, but I can't figure out which needs to go where, I assume root certificate for my.domain.com needs to go to the correct place. This is clearly me being stupid and not an error.

I am tempted to ignore, but this might have consequences I cannot overlook at the moment?

2. on the Cluster added via special agent I see this UNKNOWN one for service "Check_MK agent", which cannot be disabled as it is a forced service:

This service does not implement a native cluster mode. Please change your configuration using the rule 'Aggregation options for clustered services', and select one of the other available aggregation modes.

I don't understand a) the implications this might have ignoring it and b) how to possibly fix the cause of it as the warning ist annoying me.

Any help super-much appreciated

Regards from Aachen,
Andreas

 

[AndreasS]

Good morning,

question 2. solved: Create new Rule in CheckMK which selects "Worst Node Wins". Rule only points to service "Check_MK Agent" and is applied only to the Clustered Host. Service "only" checks, if most recent version of CheckMK Agent is installed on the nodes, which is checked on each node itself anyway. But as it forced service, you cannot ignore/mute check.

question 1. still no solution found.

Regards,
Andreas

 

[AndreasS]

Question 2. solved now as well:

added Proxmox pve-root-ca.pem to CheckMK Trusted Anchor Storage (CheckMK Global Settings -> Trusted certificate authoroties for SSL -> copy .pem cert there). Then re-schedule Check_MK Agent inventory service as it's usual schedule is every 2 hours.

added my.local.domain Root-CA to proxmox via CLI as well.

Regards,
Andreas