Home » Categories » Multiple Categories

Nagios XI - How To Use CA Certificates With check_ldaps Plugin

Overview

This KB article shows you how to use certificate authority (CA) certificates with the check_ldaps plugin.

 

Problem

When you try and execute the check_ldaps plugin:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b '' -p 636

The following error is produced:

Could not bind to the LDAP server

 

If you enable the vebose mode -v for the plugin:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b '' -p 636 -v

The following error is produced:

ldap_bind: Can't contact LDAP server (-1)
    additional info: TLS error -8179:Peer's Certificate issuer is not recognized.
Could not bind to the LDAP server

 

This verbose output has indicated that the plugin did not have a CA certificate to validate the certificate.

 

Resolution

You need to create the CA certificate on the Nagios server and configure openldap to use the certificate (check_ldaps plugin uses openldap).

You will need to obtain the CA certificate from your CA and open it in a text editor, you'll be copying the contents of the certificate into a file on the Nagios XI server.

Open an SSH session to your Nagios XI server.

 

Create Certificate

This example will create a certificate file called /etc/openldap/certs/windows_ca.cer and as you can imagine this is from a Microsoft Windows server.

Execute this command:

vi /etc/openldap/certs/windows_ca.cer

This opens the vi text editor.

Press i on the keyboard to go into insert mode.

Paste the contents of your CA certificate into the SSH session.

Press Escape on the keyboard to exit insert mode.

 

When you pasted the text, if a blank line was added after every line you'll need to delete all of these blank lines. Simply press dd on your keyboard to delete a blank line.

 

Type :wq and then press Enter (this will save the file and exit vi).

 

Update ldap.conf

Now you need to tell openldap to use this certificate. 

Execute this command:

vi /etc/openldap/ldap.conf

This opens the vi text editor.

Press i on the keyboard to go into insert mode.

Down arrow until you reach the end of the file

On a new line type the following:

TLS_CACERT /etc/openldap/certs/windows_ca.cer

Press Escape on the keyboard to exit insert mode.

Type :wq and then press Enter (this will save the file and exit vi).

 

Test Plugin

The check_ldaps plugin should now work:

/usr/local/nagios/libexec/check_ldaps -H dc01.domain.local -b '' -p 636

The following message is produced:

LDAP OK - 0.043 seconds response time|time=0.042861s;;;0.000000

 

 

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/

0 (0)
Article Rating (No Votes)
Rate this article
  • Icon PDFExport to PDF
  • Icon MS-WordExport to MS Word
Attachments Attachments
There are no attachments for this article.
Related Articles RSS Feed
Nagios XI - Installing MSSQL Wizard And Plugin Prerequisites
Viewed 481 times since Wed, Jan 27, 2016
Nagios XI - Windows Memory Usage - Physical
Viewed 1158 times since Tue, Jan 26, 2016
Nagios XI - How to Monitor Apache Cassandra Distributed Databases
Viewed 556 times since Thu, Jan 28, 2016
Nagios XI - Monitoring Hosts Using SSH
Viewed 741 times since Thu, Jan 28, 2016
Nagios XI - SNMP Traps with NXTI
Viewed 337 times since Tue, Sep 18, 2018
Nagios XI - Core 4 Load Spikes on 1.75 and 7 Hour Intervals
Viewed 380 times since Mon, Jan 25, 2016
Nagios XI - SNMP MIB Upload Problems
Viewed 751 times since Mon, Apr 10, 2017
Nagios XI - Oracle Services Critical After Nagios XI Upgrade
Viewed 381 times since Wed, Jan 27, 2016
Nagios XI - Using Scripts / Plugins With NSClient++
Viewed 2501 times since Wed, Jul 27, 2016
Nagios XI - ERROR: unable to open include file: /etc/mrtg/conf.d/xxxxxxx.cfg
Viewed 705 times since Wed, Jun 1, 2016