CSR auto-signing fails silently if no ticket_salt is set in the ApiListener feature configuration

Icinga 2
, ,
18

Hi,

the boost error is only visible in the debug log, still could you maybe file a bug in the issue tracker? I’m not sure if this is a wanted behavior or actually a bug.

I just ran your steps to reproduce in a docker test setup (master and client) based on Debian buster and Icinga 2 v2.11 RC1, I had no issues. Since I had no DNS service in my test environment I used the IP addresses for connections. Can you verify if your DNS resolves properly to the expected host and maybe try IP addresses.

My steps:

Agent/Client:

icinga2 pki new-cert --cn $HOSTNAME \
--key /var/lib/icinga2/certs/$HOSTNAME.key \
--cert /var/lib/icinga2/certs/$HOSTNAME.crt

icinga2 pki save-cert --key /var/lib/icinga2/certs/$HOSTNAME.key \
--cert /var/lib/icinga2/certs/$HOSTNAME.crt \
--trustedcert /var/lib/icinga2/certs/trusted_parent.crt \
--host 172.17.0.2

Master:

icinga2 pki ticket --cn deb10-icinga2-client

Agent/Client:

icinga2 node setup \
--cn $HOSTNAME \
--ticket f1d062d85861a459f42325e6f546f5fc04f3afd0 \
--endpoint deb-icinga2-master \
--zone $HOSTNAME \
--parent_zone master \
--parent_host 172.17.0.2 \
--trustedcert /var/lib/icinga2/certs/trusted_parent.crt \
--accept-commands --accept-config --disable-confd

Best regards
Michael