Home » Categories » Multiple Categories

Nagios XI - LDAP / Active Directory - Import Users Certificate Issues

Problem Description

When using the "LDAP / Active Directory Import Users" component in Nagios XI you may receive an error like the following when attempting to login:

Unable to authenticate: TLS error-8179:Peer's Certificate issuer is not recognized.

 

Issues like these can occur when the certificate you've added to Nagios XI is for a root CA when a subordinate CA is what actually issued the certificate, this subordinate CA certificate will also need to be uploaded.

 

Resolving the Problem

Delete Certificates

First step is to remove the existing certificates.

  • Log into the Nagios XI Web interface

  • Navigate to Admin > Users > LDAP/AD Integration

    • Under the Certificate Authority Management section

    • Delete all the existing certificates by clicking the X icon in the Actions column

 

Ensure Environment Is Correctly Setup

Log into your Nagios XI server in an SSH session and execute the following commands:

mkdir -p /etc/openldap/cacerts
chown apache.nagios /etc/openldap /etc/openldap/cacerts /etc/openldap/certs
chmod 664 /etc/openldap/ldap.conf
chmod 775 /etc/openldap /etc/openldap/certs /etc/openldap/cacerts
sed -i 's/TLS_CACERTDIR/#TLS_CACERTDIR/g' /etc/openldap/ldap.conf
echo "TLS_CACERTDIR /etc/openldap/cacerts" >> /etc/openldap/ldap.conf

 

The last step is to restart the Apache service using one of the commands below:

 

RHEL 7 | CentOS 7 | Oracle Linux 7

systemctl restart httpd.service

 

Debian | Ubuntu 16/18

systemctl restart apache2.service

 

 

Add Certificates

Now add all the required CA certificates.

  • Log into the Nagios XI Web interface

  • Navigate to Admin > Users > LDAP/AD Integration

    • Under the Certificate Authority Management section

    • Click the Add Certificate button

      • Paste the text from your certificate and then click the Add Certificate button

    • Repeat until all the required certificates have been added

 

Once you have completed the above steps the Import Users functionality will work if the CA certificates match the LDAP / Active Directory they are authenticating against.

 

 

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/



Special Offer For Knowledgebase Visitors! Get a huge discount on Nagios Log Server by clicking below.

Get 60% Off Nagios Log Server!

Did you know? Nagios provides complete monitoring of: Windows, Linux, UNIX, Servers, Websites, SNMP, DHCP, DNS, Email, Storage, Files, Apache, IIS, EC2, and more!

1 (3)
Article Rating (3 Votes)
Rate this article
  • Icon PDFExport to PDF
  • Icon MS-WordExport to MS Word
Attachments Attachments
There are no attachments for this article.
Related Articles RSS Feed
SSL/TLS - Signing Certificates With A Microsoft Certificate Authority
Viewed 28239 times since Wed, Jun 14, 2017
SNMP Traps - Understanding Trap Variables
Viewed 22701 times since Mon, Oct 24, 2016
Nagios XI - Resizing the VM Disk Size
Viewed 11848 times since Thu, Jan 28, 2016
Nagios XI - Update Components And Wizards
Viewed 5086 times since Sun, Feb 3, 2019
Nagios Xi - Masquerading As Another User
Viewed 4370 times since Wed, Jul 19, 2017
Nagios XI - Reset Security Credentials
Viewed 5422 times since Mon, Jan 25, 2016
Nagios XI - Activating Your License
Viewed 6721 times since Thu, Jan 28, 2016
Nagios XI - Upgrading To PHP 7
Viewed 18208 times since Tue, Oct 22, 2019
Nagios XI - Understanding User Permissions
Viewed 5674 times since Thu, Jan 21, 2016
OpenSSL causes issue with check_nrpe plugin with NSClient++
Viewed 8680 times since Fri, Apr 30, 2021