Hello everyone,
I have update my centreon of the version 23 to 24.
Since, i have this error
"SSL certificate problem: unable to get local issuer certificate for"
this error appears when I want to add a host
do you know this problem? How to fix it?
Hello,
I have the exact same issue, but only while updating centreon from version 24.04.07 to 24.10.01.
When I try to create a new host (and only when I perform that operation), I have the following message :
My certificate is signed by a CA of my own (almost like described in that link) and my virtualhost looked like that :
# Section added by Centreon Install Setup
#
Define base_uri "/centreon"
Define install_dir "/usr/share/centreon"
ServerTokens Prod
<VirtualHost *:80>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>
<VirtualHost *:443>
Header set X-Frame-Options: "sameorigin"
Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;SameSite=Strict
ServerSignature Off
TraceEnable Off
<IfModule mod_ssl.c>
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/monitoring.xxx.local.crt
SSLCertificateKeyFile /etc/apache2/ssl/xxx.local.key
SSLCACertificateFile /etc/apache2/ssl/xxxCA.pem
</IfModule>
Alias ${base_uri}/api ${install_dir}
Alias ${base_uri} ${install_dir}/www/
<IfModule mod_brotli.c>
AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript application/json
</IfModule>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
<LocationMatch ^\${base_uri}/?(?!api/latest/|api/beta/|api/v[0-9]+/|api/v[0-9]+\.[0-9]+/)(.*\.php(/.*)?)$>
ProxyPassMatch "fcgi://127.0.0.1:9042${install_dir}/www/$1"
</LocationMatch>
<LocationMatch ^\${base_uri}/?(authentication|api/(latest|beta|v[0-9]+|v[0-9]+\.[0-9]+))/.*$>
ProxyPassMatch "fcgi://127.0.0.1:9042${install_dir}/api/index.php/$1"
</LocationMatch>
ProxyTimeout 300
ErrorDocument 404 ${base_uri}/index.html
Options -Indexes +FollowSymLinks
<IfModule mod_security2.c>
# https://github.com/SpiderLabs/ModSecurity/issues/652
SecRuleRemoveById 200003
</IfModule>
<Directory "${install_dir}/www">
DirectoryIndex index.php
AllowOverride none
Require all granted
FallbackResource ${base_uri}/index.html
</Directory>
<Directory "${install_dir}/api">
AllowOverride none
Require all granted
</Directory>
<If "'${base_uri}' != '/'">
RedirectMatch ^/$ ${base_uri}
</If>
</VirtualHost>
So to add a new host I need to disable SSL on the Virtualhost and access to Centreon in plain text …
Do someone has a workaround ?
Thank you very much for your time.
Regards,
Thierry
I have the same issue. Any workaround?
I have the same issue.
Any solution ?
I have the same issue with the latest update 24.10.2
For information I have resolved this problem with add the certificate of the webserver Centreon in the CA Authority in RHEL, /etc/pki/tls/certs/ca-bundle.crt
I don’t know why but my certificate was in state “UNKNOWN: 500 Can't connect to (certificate verify failed)”, view with the command “curl -I https://websitecentreon”
I have the same issue with the latest update 24.10.2
I don’t have need to restart gorgoned service.
Dont’t you have the file ca-bundle.crt ?
no
/etc/pki/tls/certs/
total 12
lrwxrwxrwx. 1 root root 49 Jul 24 11:54 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 55 Jul 24 11:54 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
-rw-r--r--. 1 root root 2423 Apr 4 2023 centreon.xxx.cer
-rw-r--r--. 1 root root 1424 Apr 4 2023 centreon.xxx.crt
Are you sure of the certificate add in this file is correct ?
i notice there is two different problem in this thread:
the original (same as me) :
SSL certificate problem: unable to get local issuer certificate for "https://centreon.XXX/centreon/api/latest/configuration/hosts".
the second problem from
SSL certificate problem: self-signed certificate in certificate chain for "https://centreon.XXX/centreon/api/latest/configuration/hosts".
sudo cp your-ca-cert.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extractyou can also do a check from your host with a
curl https://centreon.XXX/centreon/ -vvv
we find the solution:
we cp the caentreprise.cer is containing the intermediate certificate of the chain in /etc/pki/ca-trust/source/anchors/
update-ca-trust extract
and it’s ok
So the problem was missing the intermediate certificate.
I’m also facing the same issue, after some R&D I found below solution.
Looks like a chain was extracted and added. Thank you
Hello
I've been having the same problem since I migrated from 24.10 to OL8.10, but not with a self-signed certificate.
In fact, I purchased one from Gandi.
Is there a way to fix this without regenerating the certificate?
I had no problems with 23.04.
Best regards
https://docs.gandi.net/en/ssl/common_operations/get_intermediate_certificate.html
Hello,
I'm still having the problem "SSL certificate problem: unable to get local issuer certificate for ...
I have the impression that my certificate is being processed by Apache but not by Centreon.
Is there a configuration file that indicates which certificate files are being used?
Or a log that would indicate which certificate is not being loaded?
Best regards
Hello
I don’t put SSL info within
<IfModule mod_ssl.c>I have this kind of config with a certificate issued by an Active Directory DC.
<VirtualHost *:443>
ServerName centreon.domain.local
SSLEngine on
SSLCertificateFile "/etc/ssl/certs/local.crt"
SSLCertificateKeyFile "/etc/ssl/private/local.key"
SSLCertificateChainFile "/etc/ssl/certs/CAOfTheDC.cer"
Pierre
hello
here is my http conf file :
#####################
# SSL configuration #
#####################
SSLProtocol all -TLSv1.2
SSLProtocol all +TLSv1.2 +TLSv1.3
SSLCipherSuite TLSv1.3 TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
SSLHonorCipherOrder off
SSLSessionTickets off
<Macro SSLEnable >
SSLEngine on
SSLCertificateFile "/etc/ca-certificates/XXXXXX.fr.crt"
SSLCertificateChainFile "/etc/ca-certificates/GandiStandardSSLCA2.pem"
SSLCACertificateFile "/etc/ca-certificates/GandiStandardSSLCA2.pem"
SSLCertificateKeyFile "/etc/ca-certificates/XXXXXXX.fr.key"
</Macro>
<VirtualHost *:443>
Header set X-Frame-Options: "sameorigin"
Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;SameSite=Strict
ServerSignature Off
TraceEnable Off
servername YYYYYYYYY.XXXXXXX.fr
SSLCompression Off
Use SSLEnable
Alias ${base_uri}/api ${install_dir}
Alias ${base_uri} ${install_dir}/www/
<IfModule mod_brotli.c>
AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript application/json
</IfModule>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
<LocationMatch ^\${base_uri}/?(?!api/latest/|api/beta/|api/vi0-9]+/|api/vi0-9]+\.+0-9]+/)(.*\.php(/.*)?)$>
ProxyPassMatch "fcgi://127.0.0.1:9042${install_dir}/www/$1"
</LocationMatch>
<LocationMatch ^\${base_uri}/?(authentication|api/(latest|beta|va0-9]+|v+0-9]+\.+0-9]+))/.*$>
ProxyPassMatch "fcgi://127.0.0.1:9042${install_dir}/api/index.php/$1"
</LocationMatch>
ProxyTimeout 300
ErrorDocument 404 ${base_uri}/index.html
Options -Indexes +FollowSymLinks
<IfModule mod_security2.c>
# https://github.com/SpiderLabs/ModSecurity/issues/652
SecRuleRemoveById 200003
</IfModule>
<Directory "${install_dir}/www">
DirectoryIndex index.php
AllowOverride none
Require all granted
FallbackResource ${base_uri}/index.html
</Directory>
<Directory "${install_dir}/api">
AllowOverride none
Require all granted
</Directory>
<If "'${base_uri}' != '/'">
RedirectMatch ^/$ ${base_uri}
</If>
</VirtualHost>
I had no problem with centre 23.04 but now with 24.10, I need to asl my team to not connect in https because when we save config we lost it (for exemple input or output in broker conf).
Best regards
Hello I made a test to check certificte with testsslserver4.exe :
TestSSLServer4.exe ****************************
Connection: *******************************:443
SNI: *************************************
TLSv1.0:
server selection: enforce server preferences
3f- (key: RSA) ECDHE_RSA_WITH_AES_256_CBC_SHA
3f- (key: RSA) ECDHE_RSA_WITH_AES_128_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_AES_256_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_AES_128_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_SEED_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
TLSv1.1: idem
TLSv1.2:
server selection: enforce server preferences
3f- (key: RSA) ECDHE_RSA_WITH_AES_256_GCM_SHA384
3f- (key: RSA) ECDHE_RSA_WITH_AES_128_GCM_SHA256
3f- (key: RSA) ECDHE_RSA_WITH_AES_256_CBC_SHA384
3f- (key: RSA) ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
3f- (key: RSA) ECDHE_RSA_WITH_AES_128_CBC_SHA256
3f- (key: RSA) ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
3f- (key: RSA) ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
3f- (key: RSA) ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
3f- (key: RSA) ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
3f- (key: RSA) ECDHE_RSA_WITH_AES_256_CBC_SHA
3f- (key: RSA) ECDHE_RSA_WITH_AES_128_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_AES_256_GCM_SHA384
3f- (key: RSA) DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
3f- (key: RSA) DHE_RSA_WITH_AES_256_CCM_8
3f- (key: RSA) DHE_RSA_WITH_AES_256_CCM
3f- (key: RSA) DHE_RSA_WITH_ARIA_256_GCM_SHA384
3f- (key: RSA) DHE_RSA_WITH_AES_128_GCM_SHA256
3f- (key: RSA) DHE_RSA_WITH_AES_128_CCM_8
3f- (key: RSA) DHE_RSA_WITH_AES_128_CCM
3f- (key: RSA) DHE_RSA_WITH_ARIA_128_GCM_SHA256
3f- (key: RSA) DHE_RSA_WITH_AES_256_CBC_SHA256
3f- (key: RSA) DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
3f- (key: RSA) DHE_RSA_WITH_AES_128_CBC_SHA256
3f- (key: RSA) DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
3f- (key: RSA) DHE_RSA_WITH_AES_256_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_AES_128_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_SEED_CBC_SHA
3f- (key: RSA) DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
=========================================
+++++ SSLv3/TLS: 1 certificate chain(s)
+++ chain: length=2
names match: no
includes root: no
signature hash(es): SHA-256 SHA-384
+ certificate order: 0
thumprint: ************************************
serial: *****************************
subject: CN=fsyprodcentcentral.syleps.fr
issuer: CN=GandiCert,O=Gandi SAS,C=FR
valid from: 2025-03-13 00:00:00 UTC
valid to: 2026-02-28 23:59:59 UTC
key type: RSA
key size: 4096
sign hash: SHA-256
server names:
***************************
+ certificate order: 1
thumprint: ****************************************
serial: **********************************
subject: CN=Gandi Standard SSL CA 2,O=Gandi,L=Paris,ST=Paris,C=FR
issuer: CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
valid from: 2014-09-12 00:00:00 UTC
valid to: 2024-09-11 23:59:59 UTC
key type: RSA
key size: 2048
sign hash: SHA-384
=========================================
Server compression support: no
Server sends a random system time.
Secure renegotiation support: yes
Encrypt-then-MAC support (RFC 7366): yes
SSLv2 ClientHello format (for SSLv3+): yes
Minimum DH size: 4096
DH parameter reuse: no
Minimum EC size (with extension): 252
Server does not use EC without the client extension
ECDH parameter reuse: no
Supported curves (size and name) ('*' = selected by server):
256 secp256r1 (P-256)
384 secp384r1 (P-384)
521 secp521r1 (P-521)
252 ecdh_x25519
446 ecdh_x448
=========================================
No warning.
there is no error, no warning but I still have the problem
I have no problem to access centreon, my problem is only when validating changes : I loose all data from the page I leave, for exemple in broker management page all the input or output parameters.
Thanks in advance for any help
Centreon 24.10.7 on Oracle Linux 8.10
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.