Node wizard has no support for existing TLS certificate

[mcktr (Michael Insel)]

Hi,

while you can use your own CA, I would not recommend it, have a read here:

Own CA for Icinga Cluster/API communication?

Every now and then you may be required to answer the question on “why not use the company’s CA certificates” or “The REST API is not trusted in my browser, fix it”. Here’s some ideas and pros and cons. Please discuss your own findings below Matter of Trust Icinga as an application with masters, satellites and agents should be used in its own CA environment. Once you open this up by e.g. re-using the Puppet CA, you’ll end up with two applications and security layers (Icinga and P…

I don’t understand the following statement:

@flaminggenius

My company is trying to setup monitoring on our phone servers and the phones use a TLS certificate thatss on the server so we can’t just create a new one we need the option to use the one that already exists.

Why is it a blocker to have multiple certificates on one server? Each certificate is used for its own purpose, e.g. for enabling TLS (SSL) on web-servers, mail gateways or for Icinga 2 cluster communication.

For example you have one certificate for a web server in /etc/nginx/ssl/cert.crt. There isn’t a problem to have another one solely for Icinga 2. Icinga 2 will create the certificate in the /var/lib/icinga2/certs, so your web server certificate is never touched by Icinga 2.

There are commands to create and sign the certificate and CSR manually, have a look here:
https://icinga.com/docs/icinga2/latest/doc/06-distributed-monitoring/#manual-certificate-creation

Best regards
Michael