Architecture Question: CA issues - hostname is not DNS name

Icinga 2
1

Hello, this is related to this Question about agents being not directly reachable at remote sites.

I have a working setup of a master at the main site with its own hostname (lets call it icinga-master), but reachable from external through port forwarding using a different IP and DNS name (icinga.company.org).

Situation is, agent reaches out to master, but will not authenticate because the certificate does not match the address given for the master.

Question: how to change the checking of the hostname or how to tell the agent that the master has two names?

[2024-09-28 09:14:25 +0000] information/ApiListener: Finished reconnecting to endpoint ‘master’ via host ‘EXTERNAL-IP’ and port ‘5665’
[2024-09-28 09:14:35 +0000] information/ApiListener: Reconnecting to endpoint ‘master’ via host ‘EXTERNAL-IP’ and port ‘5665’
[2024-09-28 09:14:35 +0000] warning/ApiListener: Unexpected certificate common name while connecting to endpoint ‘master’: got ‘HOSTNAME’
[2024-09-28 09:14:35 +0000] information/ApiListener: Finished reconnecting to endpoint ‘master’ via host ‘EXTERNAL-IP’ and port ‘5665’

2

can you post the endpoint zones.conf?

the ‘master’ hostname in the agent’s zones.conf still can be like icinga.master which of course would not be resolvable but the ip should be the external ip.
there is no need to change the hostname

1 Like
3

Man, you made my day. I was about to rant about the hostname and certificate, but then thought “wait a minute…”

this my working zones config on the agent now:

object Endpoint "<INTERNAL-MASTER-HOSTNAME AKA CERTIFICATE ISSUED TO HOSTNAME>" {
        host = "<EXTERNAL IP OF HOST>"
}

object Zone "master" {
        endpoints = [ "<INTERNAL-MASTER-HOSTNAME AKA CERTIFICATE ISSUED TO HOSTNAME>" ]
}

object Endpoint "icinga-agent2" {
}

object Zone "icinga-agent2" {
        endpoints = [ "icinga-agent2" ]
        parent = "master"
}

object Zone "global-templates" {
        global = true
}

object Zone "director-global" {
        global = true
}

Before, it was this:

object Endpoint "master" {
        host = "<EXTERNAL IP OF HOST>"
}

object Zone "master" {
        endpoints = [ "master" ]
}