# ERROR importing ca certificate - x509 module **URL:** \ **Category:** Icinga Web Modules\ **Tags:** x509\ **Created:** [June 20, 2024, 8:33am UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744 "2024-06-20T08:33:34Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [June 20, 2024, 8:33am UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/1 "2024-06-20T08:33:34Z")
I’m trying toconfigure x509 module on my ICINGA2 installation. I followed the steps here: [Installing Icinga Certificate Monitoring - Icinga Certificate Monitoring](https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/02-Installation/) After the installation of package on UBUNTU, I correctly create the DM on MySQL. This is my Scenario: ![image](https://community.icinga.com/uploads/default/original/2X/1/1fab6e03935693f8fafdf4613d8b03d660d67276.png) When I try to execute the configuration step: icingacli x509 import --file /etc/ssl/certs/ca-certificates.crt I have this error: > ERROR: Icinga\Exception\ConfigurationError in /usr/share/php/Icinga/Data/ResourceFactory.php:49 with message: Cannot load resource config “x509”. Resource does not exist. Now My ICINGA Installation give me error even from WEB UI: From UI of module configuration I cannot see the “x509” DB: ![image](https://community.icinga.com/uploads/default/original/2X/6/67a59c98aff11d3825dc2130478fe07dba4d0278.png) Any Idea ? THX ---
**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\ **Post date:** [June 20, 2024, 8:40am UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/2 "2024-06-20T08:40:53Z")
Did you setup the x509 DB in Icingaweb2 as a resource? ---
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [June 20, 2024, 1:43pm UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/3 "2024-06-20T13:43:33Z")
You are right! The documentation is missing this part. After I have added the DB, the import was fine. Now I have another error trying the check command. If I run this command (as user root): icingacli x509 check host --ip 18.66.196.27 I receive the error : UNKNOWN - Host not found Even Is I use both ip and host. The same command running as “iconga” user give me: ERROR: Cannot read enabled modules. Config directory “/etc/icingaweb2” is not readable ---
**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\ **Post date:** [June 20, 2024, 1:48pm UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/4 "2024-06-20T13:48:21Z")
If I understand the module correctly, you can only check after a scan put the chain into the DB. Under which user does the icinga-x509.service run? > The documentation is missing this part. Maybe you could send in a patch? ---
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [June 20, 2024, 2:16pm UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/5 "2024-06-20T14:16:50Z")
> [@rivad](#): > > icinga-x509 The service is running under “root” user. Is not clear to me the role of scanning process. Following this example: > **[Monitoring Certificate Expiration with the x509 Module | www.neteye-blog.com](https://www.neteye-blog.com/2021/02/monitoring-certificate-expiration-with-the-x509-module/)** > > Now, if you've followed my previous blogs about the x509 Module, you should have in place your x509 Certificates Asset with (or without) a minimum of cleanup routines. Now it's time to look at what Icinga was made for: monitoring. Making an asset out... Which kond of JOB I have to schedule ? ---
**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\ **Post date:** [June 20, 2024, 2:24pm UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/6 "2024-06-20T14:24:54Z")
Well the jobs trigger the scans of your network for certificates, the validate step figures out if the chain is valid or not and the check will tell you if the chain on host,ip,port is valid. ---
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [June 21, 2024, 8:11am UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/7 "2024-06-21T08:11:00Z")
There is an error into the x509 module help The help (and most examples online) reports that the command to run a certificate check is these: > icingacli x509 check host --ip 10.0.10.78 > icingacli x509 check host --host [mail.example.org](http://mail.example.org) > icingacli x509 check host --ip 10.0.10.78 --host [mail.example.org](http://mail.example.org) --port 993 But, in my case this way do not work. I have to use --host **s** instead of --host ![image](https://community.icinga.com/uploads/default/original/2X/9/9e26276068c79dcb97367d11c1ee7c214dfe8466.png) ![image](https://community.icinga.com/uploads/default/original/2X/8/8a82cefa0813986bd9994a2bad651205dbaf9511.png) ---
**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\ **Post date:** [June 21, 2024, 9:10am UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/8 "2024-06-21T09:10:43Z")
I guess it just ignores `--hosts` and you have an other error that keeps `--host` from working. My bet is on missing SNI entry in the module config. What’s the host in the chain if you search for the IP in `/icingaweb2/x509/usage`? ---
**Author:** ![picoroma](https://community.icinga.com/user_avatar/community.icinga.com/picoroma/32/2235_2.png) [@picoroma](https://community.icinga.com/u/picoroma)\ **Post date:** [June 21, 2024, 10:40am UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/9 "2024-06-21T10:40:05Z")
> [@rivad](#): > > SNI entry in the module config What is thiS? (sorry for my question … but I’m starting right now to use this module) ---
**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\ **Post date:** [June 21, 2024, 12:35pm UTC](https://community.icinga.com/t/error-importing-ca-certificate-x509-module/13744/10 "2024-06-21T12:35:18Z")
SNI allows you to add host names to IP+port and multiple host names to the same IP+port. This is needed because the webserver can serve different certificates if the browser requests a different website with a different domain or none at all (direct connection to IP+port). > **[Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)** > > Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. The extension allows a server to present one of multiple possible certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other service over TLS) to be served by the same IP address without requiring all those si Pr... [https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/03-Configuration/#server-name-indication](https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/03-Configuration/#server-name-indication)