add this as a variable to your service config to define the serviec you want to check.
I did, error message is still the same.
icinga2 ca list
doesn’t show any open signing requests?
No, there are no open request.
with icinga2 ca list --all there are multiple entrys for my host with hostname and with FQDN?
I searched in doc but its not possible to delete signed requests, am I right?
Because
signals that the agents certificate is not yet signed by the Icigna CA.
I found on the Agent under %ProgramData%\icinga2\var\lib\icinga2\certs
multiple CA’s and I installed them (CA.crt and agentFQDN.crt) to the trust folder for CA’s to make sure, Agent has the Certificates and trusts them aswell.
huh, never seen that command before. Not sure what it runs in the background.
I recommend running icinga2 daemon -C
to validate the configuration.
Okay. Running the icinga2 daemon -C
shows no erros/problems.
Log on Agent:
information/ApiListener: New client connection for identity 'masterFQDN' to [masterIP]:5665 (certificate validation failed: code 18: self signed certificate)
information/ApiListener: Finished reconnecting to endpoint 'masterFQDN' via host 'masterFQDN' and port '5665'
warning/JsonRpcConnection: API client disconnected for identity 'masterFQDN'
warning/ApiListener: Certificate validation failed for endpoint 'masterFQDN': code 18: self signed certificate
And then it starts again with the first error message above.
information/ApiListener: New client connection for identity 'masterFQDNt' to [masterIP]:5665 (certificate validation failed: code 18: self signed certificate)
Log on Master:
[2023-05-15 14:05:38 +0000] information/ApiListener: Reconnecting to endpoint 'agentFQDN' via host 'agentFQDN' and port '5665'
[2023-05-15 14:05:38 +0000] critical/ApiListener: Cannot connect to host 'agentFQDN' on port '5665': Host not found (authoritative)
Connection from Agent to master works.
Telnet with 5665 works and no Local or external Firewall is blocking any traffic.
Do you have any idea on this?