Module X509

Hmm, I’ve succeeded with the following steps, but i’ve got the following php version installed on the system with Ubuntu 18.04 & Debian 10.

php -version
PHP 7.3.14-1~deb10u1 (cli) (built: Feb 16 2020 15:07:23) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.14, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.3.14-1~deb10u1, Copyright (c) 1999-2018, by Zend Technologies

Now to the Steps i performed:

1. cd /usr/share/icingaweb2/modules/
2. wget https://github.com/Icinga/icingaweb2-module-x509/archive/v1.0.0.tar.gz
3. tar xf v1.0.0.tar.gz && mv icingaweb2-module-x509 x509 && rm v1.0.0.tar.gz
4. wget https://github.com/Icinga/icingaweb2-module-ipl/archive/v0.5.0.tar.gz
5. tar xf v0.5.0.tar.gz && mv icingaweb2-module-ipl ipl && rm v0.5.0.tar.gz 
6. wget https://github.com/Icinga/icingaweb2-module-reactbundle/archive/v0.7.0.tar.gz
7. tar xf v0.7.0.tar.gz && mv icingaweb2-module-reactbundle reactbundle && rm v0.7.0.tar.gz
8. apt install -y php-gmp openssl ca-certificates
9. mysql -e "create database x509; grant SELECT, INSERT, UPDATE, DELETE, DROP, CREATE VIEW, INDEX, EXECUTE ON x509.* TO 'x509'@localhost IDENTIFIED BY 'xxx';"
10. mysql -u username -p x509 < /usr/share/icingaweb2/modules/x509/etc/schema/mysql.schema.sql
11. icingacli module enable ipl
12. icingacli module enable reactbundle

Creating the Icingaweb2 Database resource which ist needed for the x509 Module.

Adding the Database to the Module.

And finally running the following command

icingacli x509 import --file /etc/ssl/certs/ca-certificates.crt

Hope one of those steps helps in finding the culprit in your setup.

Regards

David

1 Like

:ok_hand: perfect! now it’s working!
A huge thank you! :slightly_smiling_face:

1 Like

Hi all,

I am sorry if I am jumping in wrong place, but I am wondering if there is a solution to having this module using PostgreSQL as DB resource?
My monitoring system is setup and I am using PostgreSQL for all so far so it came a bit as unexpected surprise that this module does not support it.

Thank you,

Marko

Hi Marko,

Sure this is not out of scope, at the moment we just provide with the module a schema for mysql/mariadb databases. If anybody or we has time to create provide a schema for postgres this should be no problem at all.

As said above at the moment we don’t have a schema for postgres but please feel free to add an request/issue and or subscribe for the already existing one in github so the developers know it has been requested.


Regards

David

Hi David,

Blazing fast update, just asked in the ticket above
(https://github.com/Icinga/icingaweb2-module-x509/issues/10)
and almost instantly got an answer. Super.

Marko

Thanks Marko!

We try our best … hope you also get an quick reply for the time estimation.

Best

David

Hello there!

Time estimates are a tricky thing, especially right now in these exceptional circumstances.
We’re all struggling to keep up with what is happening, might be dealing with personal issues and are not working at full capacity, as our thoughts are preoccupied.

Hope you understand and have a nice day! :slight_smile:
Feu

Hello there!

I have a little question about this module.

First of all, it works fine for me, the jobs are running and the certificates are correct discovered.

But under the section “Certificate Usage” there is instead of the hostname only the IP-address of the hosts.
I couldnt figure out why this is happening.
Is there something missing from my side?

Debian 9
Icinga r2.11.3-1
Icingaweb 2.7.3

Best Regards,
Chris

Hi Christoph,

First of all Welcome and thanks for asking …
And second good question … i think we just iterate through the addresses but i would need to ask the Developer about that …

Might be also a good point for an feature request …

I see what i can find out.

Regards

David

Absolutely,

I was only asking if there is time estimate, in order to better manage expectations of users on my side, no rush or pressure intended.
Indeed, circumstances are making all harder and I hope you are all primarily staying healthy and happy!

Kind regards,
Marko

1 Like

Hello @Chris21 and welcome to the community!

I would like to ask you to open a separate topic with this question.
This way it won’t be buried in here and might get a little more attention!

Have a nice day,
Feu

Hi Icinga wizards,

How is the X509 module pgsql moving?

Marko

1 Like

Hi @mvrgotix,

Please see https://github.com/Icinga/icingaweb2-module-x509/pull/85.

Tests and feedback welcome!

All the best,
Eric

Thank you.

I will test is asap!

— — —
Met vriendelijke groet / Best regards,

Marko Vrgotic
Sr. System Engineer
ActiveVideo

Hello, I have just set up the module and I am stuck when integrating the data sources, respectively when modifying the synchronization.

The initial situation is as follows. All my servers are automatically included in the monitoring when provisioning. The hostnames correspond to “Webserver1.domain”.

To monitor all certificates I have to store the corresponding SNI per IP in the module.

My current approach is to use the host_ip to fill an array “icingacli_x509_host” with the host_name from the module, so that I can then monitor them via Service Apply Rule. Currently all certificates are accessible via port 443, so that an assignment icingacli_x509_host to icingacli_x509_port is not yet relevant.

I am currently at a loss here, since I cannot logically write the SNI into the host’s array based on the IP.

Is this possible at all and if so, could someone please give me an approach to this?
Is my approach wrong?

Currently I only see the possibility to create X host objects with the same IP to establish a certificate monitoring based on the data of the module. With this approach, however, the clarity of my host would be lost.

Hey @Gninieb and welcome!

I don’t have experience with the module itself (until we move one of our monitoring instances off of Icinga1x), but you might try creating a new post (should be able to just copy what you have here)

I would be interested to see what the resolution is, since I will likely face a similar problem

Hi @steaksauce & @Gninieb !

We’ve seen the question but are at the moment occupied with other issues.
There will be a response in the near future. Please stand by.
If someone with experience can answer this quicker than us please step in.

Regards

David

2 Likes