Nagios Support Forum

Posted: **Thu Dec 03, 2015 4:56 pm**

Hi,
Is there any document/instruction I can follow about how to setup Nagios to call a web service that uses client certificates?

thanks

Posted: **Thu Dec 03, 2015 5:20 pm**

Can you clarify what you mean by a client certificate?

Are you referring to check a SSL certificate through check_http?

Posted: **Fri Dec 04, 2015 10:45 am**

Yes, I want to monitor a secured web service which requires the certificate for client authentication.

Posted: **Fri Dec 04, 2015 11:09 am**

You should be able to use the check_http command, along with the -J parameter.

Code: Select all

 check_http -H <vhost> | -I <IP-address> [-u <uri>] [-p <port>]
       [-J <client certificate file>] [-K <private key>]
       [-w <warn time>] [-c <critical time>] [-t <timeout>] [-L] [-E] [-a auth]
       [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport>]
       [-e <expect>] [-d string] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]
       [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]
       [-A string] [-k string] [-S <version>] [--sni] [-C <warn_age>[,<crit_age>]]
       [-T <content-type>] [-j method]

Posted: **Wed Dec 23, 2015 11:09 am**

Thanks for your reply.
I have tried to use -J with check_http and received the following output during my test..any idea about it?

COMMAND: /usr/local/nagios/libexec/check_http -H 10.... -u "/keepalive" -p 443 -S -J /tmp/NagiosCertificate.pem -K /tmp/NagiosPrivateKey.pem

OUTPUT: HTTP WARNING: HTTP/1.1 403 Forbidden - 1412 bytes in 0.020 second response time |time=0.019972s;;;0.000000 size=1412B;;;0

Posted: **Wed Dec 23, 2015 5:00 pm**

Can you run it with a -v flag, and post the output above the **** CONTENT **** part?

Posted: **Thu Dec 24, 2015 11:02 am**

Hello,

I am working with AWang on the same issue. I don't know if this matters, we are using our company self-signed SSL client certificate rather than the commercial/3rd party SSL client certificate.

Thanks!

Posted: **Mon Dec 28, 2015 11:13 am**

awang wrote:Thanks for your reply.
I have tried to use -J with check_http and received the following output during my test..any idea about it?

COMMAND: /usr/local/nagios/libexec/check_http -H 10.... -u "/keepalive" -p 443 -S -J /tmp/NagiosCertificate.pem -K /tmp/NagiosPrivateKey.pem

OUTPUT: HTTP WARNING: HTTP/1.1 403 Forbidden - 1412 bytes in 0.020 second response time |time=0.019972s;;;0.000000 size=1412B;;;0

rkennedy wrote:Can you run it with a -v flag, and post the output above the **** CONTENT **** part?

Could one of you run the check command with the -v flag, and post the output?

Code: Select all

/usr/local/nagios/libexec/check_http -H 10.x.x.x -u "/keepalive" -p 443 -S -J /tmp/NagiosCertificate.pem -K /tmp/NagiosPrivateKey.pem -v

Posted: **Fri Jan 08, 2016 3:20 pm**

Here's the response we got back.

COMMAND: /usr/local/nagios/libexec/check_http -I hostnamexx -S -J /usr/local/nagiosxi/NagiosCertificate.pem -K /usr/local/nagiosxi/NagiosKey.pem -v
OUTPUT: GET / HTTP/1.0
User-Agent: check_http/v2.0.3 (nagios-plugins 2.0.3)
Connection: close
Accept: */*

https://hostnamexxx:443/ is 1412 characters
STATUS: HTTP/1.1 403 Forbidden
**** HEADER ****
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 08 Jan 2016 20:17:19 GMT
Connection: close
Content-Length: 1233
**** CONTENT ****
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>403 - Forbidden: Access is denied.</title>
<style type="text/css">

</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>403 - Forbidden: Access is denied.</h2>
<h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>
</fieldset></div>
</div>
</body>
</html>

HTTP WARNING: HTTP/1.1 403 Forbidden - 1412 bytes in 0.051 second response time |time=0.051404s;;;0.000000 size=1412B;;;0

Posted: **Mon Jan 11, 2016 12:19 pm**

Can you verify what the permissions of /usr/local/nagiosxi/NagiosCertificate.pem and /usr/local/nagiosxi/NagiosCertificate.pem and /usr/local/nagiosxi/NagiosKey.pem is set to and let us know?

Nagios Support Forum

web service that uses client certificates

web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates

Re: web service that uses client certificates