I am encountering an issue with SSL certificate configuration in NSClient++ while trying to enable the HTTPS REST API. Despite placing the necessary certificate files in the correct directory and updating the nsclient.ini configuration, the NSClient++ service fails to recognize the certificates and defaults to HTTP on port 8443
Environment
NSClient++ Version: 0.5.2.41 (2018-04-26)
Monitoring Tool: Centreon 24.10 (REST API plugin)
Nsclient.ini
[/settings/log]
; LOG LEVEL - Log level to use. Available levels are error,warning,info,debug,trace
level = trace
; DATEMASK - The size of the buffer to use when getting messages this affects the speed and maximum size of messages you can recieve.
date format = %Y-%m-%d %H:%M:%S
; FILENAME - The file to write log data to. Set this to none to disable log to file.
file name = ${exe-path}/nsclient.log
[/modules]
; Enable required modules
WEBServer = enabled
CheckExternalScripts = enabled
CheckHelpers = enabled
CheckEventLog = enabled
CheckNSCP = enabled
CheckDisk = enabled
CheckSystem = enabled
NRPEServer = enabled
[/settings/default]
; PASSWORD - Password used to authenticate against server
password = vddr1WeBsnRVYjKui69RHfyd1BffghKR
; ALLOWED HOSTS - List of IPs allowed to connect
allowed hosts = 127.0.0.1,192.168.8.2
[/settings/WEB/server]
port = 8443
certificate = C:\Program Files\NSClient++\security\client_cert.pem
certificate key = C:\Program Files\NSClient++\security\client_cert.key
ca = C:\Program Files\NSClient++\security\ca_cert.pem
ssl options = no-sslv2,no-sslv3,no-tlsv1,no-tlsv1_1
allowed ciphers = HIGH:!aNULL:!MD5:!3DES:!RC4:@STRENGTH
verify mode = peer-cert
tls version = TLSv1.2,TLSv1.3
insecure = false
; HTTP/2 disabled for compatibility
alpn protocols = http/1.1
; DH KEY
dh = ${certificate-path}/nrpe_dh_2048.pem
[/settings/external scripts]
allow arguments = 1
allow nasty characters = 1
[/settings/external scripts/scripts/default]
ignore perfdata = true
Observed the nsclient.log and confirmed the following error:
error:c:\source\0.5.2\modules\WEBServer\WEBServer.cpp:159: Certificate not found (disabling SSL)
debug:c:\source\0.5.2\modules\WEBServer\WEBServer.cpp:185: Loading webserver on port: 8080
From centreon :/usr/lib/centreon/plugins//centreon_nsclient_restapi.pl --plugin=apps::nsclient::restapi::plugin --mode=query --hostname='192.168.1.243' --port='8443' --proto='https' --legacy-password='***' --http-backend=curl --insecure --command=check_drivesize --arg="drive=*" --arg="perf-config=used(unit:B)used %(ignored:true)" --arg="filter=type in ('fixed') and name not regexp '.(System Reserved|SYSTEM RESE).' and drive_or_id not like '?'" --arg="warning=total_used>80%" --arg="critical=total_used>90%"
UNKNOWN: curl perform error : Couldn't connect to server
Are there any known issues with SSL certificate compatibility in NSClient++ 0.5.2?
Is there a specific format or configuration required for the certificates that I might be missing?
Could this issue be related to the LocalSystem account not properly accessing the files, even though permissions appear correct?