Hello,

First, thank you for your detailed feedback. The encryption issue was fixed two weeks ago on development branch. You can find latest version I have compiled this morning here: centreon-monitoring-agent.exe . I will try to reproduce your agent crash and to fix it asap.

Regards

hello

with that new agent, I don’t have the error and the service is running correctly when running without “poller iniated connection”, it seems to work now

so : “client connect to poller without encryption” : ok

if checking encryption, i’m having some issues , but I probably did not create the certificate correctly, i’ll try other method 

the error I got was : “ossl_transport_security.cc:1659] Handshake failed with fatal error SSL_ERROR_SSL: error:0A00010B:SSL routines::wrong version number” 

but I made a selfsigned without ca, probably not ok, i’ll try with a ca file

I think I may need to recheck the documentation, I don’t really understand what/when using the encryption

in the case "client connect to poller” the poller has a certificate, apparently directly in the /etc/pki folder (ca cert, server cert, and keys)

in this case, does the client need checkbox “encryption”?

the cma log on the client says :

“

so I’m a bit confused and it’s not really clear 

is this encryption both way? (with a cert on the client and the server)

on the other case, “poller connect to client”, the client act as a server as it listen on port 4317, there you need a certificat to ensure encryption, I don’t really know how to create a valid certificate (I tried using the same as the one I made on the linux poller, but if I need to create a certificat with the agent hostname, this will be really problematic 

(something like the key automatically installed in the “centreron-nsclient” package would be nice)

Yes, if one side uses encryption, the other must do so. But you don’t have to create keys for both sides even if it is allowed. The protocol is grpc on http2, so crypto must be parameterized as an http server and his client.

In case of poller is the server, you generate a key and a certificate on the server and you can put server certificate in windows certificate store of the agent host.

Unfortunately, in case of reverse connection, you need a certificate by agent host, as certificate CN must contains agent host name. On the other side, poller has to connect to agent using this host name, not IP. If agent host name is not in DNS, I add it in /etc/hosts.

In case of poller is the server, you generate a key and a certificate on the server and you can put server certificate in windows certificate store of the agent host.

ok that’s clearer, i’ll try that

Unfortunately, in case of reverse connection, you need a certificate by agent host, as certificate CN must contains agent host name. On the other side, poller has to connect to agent using this host name, not IP. If agent host name is not in DNS, I add it in /etc/hosts.

that is something extremely problematic, going back to the “hostname” needed in the configuration, this is simply preventing cloning and deploying VMs with any form of templates even more : the installer could be run by a package manger and then what? (you would need to run a powershell command, that could work, get newselfsigned, or maybe use the standard microsoft certificate store, which would be easier to manage and be compatibile with pre-existing installed certificate, or internal pki that deliver signed certificate to all windows host in a domain, lots of possibilities, none of which seems ok

next you need to get that certificate and and push somehow in /etc/pki of the poller? (or is that not needed)

 grpc over http ok, ssl for http, ok, but you surely can add some ssl connexion option to ignore certificate, and any name  would pass, or even a “CN=*” could work for that matter and matche dns or ip

Hi Christophe, thanks for your feedback.

We plan to release, after the GA, an “Insecure TLS connection” mode, which will do the following : 

• autosigned certificates are allowed

• CN check is disabled

It seems this could fix your need. Do you confirm ? 

Thanks.

Hi

yes this would be great, and a small procedure or even include the generation of that self signed in the installer?

if a cert/key in base64 is the end on windows here is a script to create a self signed and export it
 

$certFile = 'C:\temp\test2.crt'
$keyFile =  'C:\temp\test2.key'

$params = @{
    DnsName = 'localhost'
    CertStoreLocation = 'Cert:\LocalMachine\My'
     KeyExportPolicy = 'Exportable'
}

$cert = New-SelfSignedCertificate @params
@(
    '-----BEGIN CERTIFICATE-----'
     System.Convert]::ToBase64String($cert.RawData, 'InsertLineBreaks')
    '-----END CERTIFICATE-----'
) | Out-File -FilePath $certFile -Encoding ascii

$rsakey =  System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
$keybytearr = $rsakey.Key.Export((System.Security.Cryptography.CngKeyBlobFormat]::Pkcs8PrivateBlob)

@(
    '-----BEGIN CERTIFICATE-----'
     System.Convert]::ToBase64String($keybytearr, 
     System.Base64FormattingOptions]::InsertLineBreaks)
    '-----END CERTIFICATE-----'
) | Out-File -FilePath $keyFile -Encoding ascii

$cert | remove-item