5.5 SSL certificate check issue

[itadmins]

We upgraded to 5.5, now all of our sites that use ntlm authentication are throwing warnings on the SSL cert check. I don't know why it's trying to authenticate with the webpage. Further I noticed that if I set these service checks to inactive or disable notifications my settings get reset and they come back and start notifying.

Just tried deleting those service checks, and their gone from CCM but the checks are showing under operations center and services on the home tab.

SSL OK - Certificate '*.xxxx.xxx' will expire on 2019-02-11 15:24 -0500/EST. HTTP WARNING: HTTP/1.1 401 Unauthorized - 522 bytes in 0.015 second response time

[scottwilkerson]

I don't see "SSL OK" anywhere in that plugin.

Can yo confirm what the full command is that is being used for this service in the CCM blocking out any sensitive data?

My only guess would be that you changed a default command instead of creating a new one

I would also recommend grabbing a snapshot from pre-upgrade at
Configure -> CCM -> Configuration Snapshots
Download

This may help us recover your old command definitions before they all get overwritten

[itadmins]

Scott,

I edited my post to clarify the problem a bit further.

In response to your post, this is the command being used. And I did download and compare it with a previous snapshot, the command was the same.

Code: Select all

check_xi_service_http_cert!30 -p 443

[scottwilkerson]

So go to Configure -> CCM -> Commands and find check_xi_service_http_cert

This isn't a standard command, and that is what we will need to see

[itadmins]

Code: Select all

$USER1$/check_http -H $HOSTADDRESS$ -C $ARG1$

[scottwilkerson]

Your original post mentioned a different plugin you were using for these NTLM checks, however this is the standard http check..

Are you sure you do not need to change these to use the special NTLM authentication you required before?

[itadmins]

The certificate check using the standard check_http command was working before the update. Now the service checks even refuse to get deleted. The plugin I use to authenticate and check ntlm websites does not offer a working certificate check.

[scottwilkerson]

Ok, doing some some digging, and it appears to be a bug that was introduced in the version of Nagios Plugins that is being used but will be fixed when a new version is released.

https://github.com/nagios-plugins/nagio ... issues/280

If you are comfortable compiling plugins you could likely download and compile the new version out of master here
https://github.com/nagios-plugins/nagios-plugins

and just copy over check_http

[itadmins]

Ok, when can we expect this to be fixed? I do not know how to compile plug-ins.

Can you give me a work around? Also we aren't able to delete these services, they just keep re-appearing.

[scottwilkerson]

This may work as a temporary work-around (besides the other workaround I already gave you of compiling the plugins and grabbing

change the check_xi_service_http_cert command frm this

Code: Select all

$USER1$/check_http -H $HOSTADDRESS$ -C $ARG1$

to this

Code: Select all

$USER1$/check_http -H $HOSTADDRESS$ -C $ARG1$ -e "HTTP/1.1 401"

but it could make checks that aren't returning 401 errors fail (if you have any)