Critical/config: Error: Endpoint object for '<fqdn>.key' is missing

Icinga 2
1

Hi

I appear to be having some issiues with an endpoint. This appears not to be able to find the “key” which is available within “/var/lib/icinga2/certs”

total 24K
drwxr-xr-x 2 nagios nagios 4.0K May 14 06:04 .
drwxr-x— 5 nagios nagios 4.0K May 13 11:47 …
-rw-r–r-- 1 nagios nagios 1.7K May 13 10:03 ca.crt
-rw-r–r-- 1 nagios nagios 1.8K May 14 06:03 fqdn.crt
-rw-r–r-- 1 nagios nagios 1.7K May 14 06:03 fqdn.csr
-rw-r–r-- 1 nagios nagios 3.2K May 14 06:04 fqdn.key

When doing a config check this is the error which appears

service icinga2 checkconfig

  • checking Icinga2 configuration
    [2019-05-14 06:30:44 -0400] information/cli: Icinga application loader (version: r2.10.4-1)
    [2019-05-14 06:30:44 -0400] information/cli: Loading configuration file(s).
    [2019-05-14 06:30:44 -0400] information/ConfigItem: Committing config item(s).
    [2019-05-14 06:30:44 -0400] information/ApiListener: My API identity: fqdn.key
    [2019-05-14 06:30:44 -0400] critical/config: Error: Endpoint object for ‘fqdn.key’ is missing.
    Location: in /etc/icinga2/features-enabled/api.conf: 5:1-5:24
    /etc/icinga2/features-enabled/api.conf(3): */
    /etc/icinga2/features-enabled/api.conf(4):
    /etc/icinga2/features-enabled/api.conf(5): object ApiListener “api” {
    ^^^^^^^^^^^^^^^^^^^^^^^^
    /etc/icinga2/features-enabled/api.conf(6): accept_config = true
    /etc/icinga2/features-enabled/api.conf(7): accept_commands = true

[2019-05-14 06:30:44 -0400] critical/config: 1 error

  • checking Icinga2 configuration. Check ‘/var/log/icinga2/startup.log’ for details.

The constants.conf file under node name shows the fqdn along with the command “hostname --fqdn”
These certs and keys were generated from the master server and then moved into the endpoint using the following commands

icinga2 pki new-cert --cn fqdn.key --key fqdn.key --csr fqdn.csr
icinga2 pki sign-csr --csr fqdn.csr --cert fqdn.cr

Can anyone assist as to why this isn’t working?

2

Check if the zones.conf on the endpoint has the required Endpoint and Zone objects for the endpoint and the master.

1 Like
3

Hi,

since you are using the manual certificate commands, you also need to create the configuration objects told by @log1c. node wizard and node setup generate them already for you, the manual cert commands don’t do that.

For a quick solution, you can do the following:

vim /etc/icinga2/zones.conf

object Endpoint "fqdn" {

}

object Zone "master" {
  endpoints = [ "fqdn" ]
}

Depending on your preferred environment, follow the docs for further steps then.

Cheers,
Michael