I am attempting to monitor a Windows 10 host with CMA. The packet capture shows that the agent attempts to establish an encrypted connection using TLS 1.0 but is rejected during the handshake by the poller.
How can I change the protocol used by the CMA to TLS 1.2?
My config is as follows:
Host to be monitored :
- OS: Windows 10
- Agent version : 24.10.0
- Configuration :
- Poller endpoint : 192.168.122.64
- Poller-initiated connection : NO
- Encryption : YES
- Trusted CA’s certificate file : ADDED
- IP : 192.168.122.124
- Enabled SSL protocols : TLSv1.2
Poller (Central used as poller) :
- OS: Almalinux 9
- Centreon version : 24.10.3
- IP : 192.168.122.64
- Enabled SSL protocols : TLSv1.1, TLSv1.2, TLSv1.3
Extract from CMA log file :
[2025-03-18 16:30:06.847] [centreon-monitoring-agent] [info] [main_win.cc:169] centreon-monitoring-agent start
[2025-03-18 16:30:06.848] [centreon-monitoring-agent] [debug] [grpc_client.cc:51] client this=0x829eea7080 activate compression deflate
[2025-03-18 16:30:06.848] [centreon-monitoring-agent] [info] [grpc_client.cc:67] encrypted connection to 192.168.122.64:4317 cert: ..., key: ..., ca: -----BEGIN...
[2025-03-18 16:30:06.877] [centreon-monitoring-agent] [info] [scheduler.cc:160] schedule 0 checks to execute in 1s
[2025-03-18 16:30:06.877] [centreon-monitoring-agent] [debug] [bireactor.cc:51] create client this=0x829ef37610 peer:192.168.122.64:4317
[2025-03-18 16:30:06.981] [centreon-monitoring-agent] [error] [bireactor.cc:99] 0x829ef37610 client peer:192.168.122.64:4317 fail read from stream
[2025-03-18 16:30:06.981] [centreon-monitoring-agent] [error] [bireactor.cc:146] 0x829ef37610 client peer 192.168.122.64:4317 fail write to stream
[2025-03-18 16:30:06.981] [centreon-monitoring-agent] [debug] [bireactor.cc:196] 0x829ef37610 client::shutdown
Failed handshake
TLS 1.2 configured on Windows 10 VM
Observation :
I understand it may be possible to install the necessary openssl stack on the Poller so TLSv1.0 is supported; however for the use-case at hand, TLSv1.0 is not a viable option. Thus the need to make TLSv1.2 work.