Windows Agent with the director: Failed to fetch certificate from host

Hi,

i installed on a fresh installed CentOS 8 icinga2, icingaweb2 and the director. After the first configuration (I use the youtube webinar videos from netways) all looks fine, but i have a problem to install the icinga2 agent on a windows maschine:

PS C:\ProgramData> exit Icinga2AgentModule `

-DirectorUrl 'http://172.xx.xx.xx/icingaweb2/director/' `

-DirectorAuthToken 'ffd11aa441d57765517c4b1b31d7336b3cb76438' `

-RunInstaller

Notice: Started script run...

Notice: Connected successfully to Icinga Director Self-Service API over API token.

Notice: Setting internal Agent Name to "PC03020442.xxx.local"

Notice: Trying to fetch Host IP-Address for hostname: PC03020442.xxx.local

Notice: Setting IP 172.xx.xx.xx as primary IP for this host for all requests. Access it wi

th &ipaddress& for all JSON requests.

Notice: Using Icinga version "", setting certificate directory to "C:\ProgramData\icinga2\e

tc\icinga2\pki"

Warning: Icinga 2 Agent does not seem to be installed on the system

Notice: Installing Icinga 2 Agent from local directory

Warning: Icinga 2 Agent Installer verification disabled.

Notice: Installing Icinga 2 Agent

Notice: Icinga 2 Agent installed.

Notice: Using Icinga version "2.11.0", setting certificate directory to "C:\ProgramData\ici

nga2\var\lib\icinga2\certs"

Notice: Found Icinga 2 Agent version 2.11.0 installed at "C:\Program Files\ICINGA2\"

Notice: Creating host "PC03020442.xxx.local" over API token inside Icinga Director.

Notice: Writing host API-Key "7a1d46cfadf339ebe9d15aa772fb45419dedbca5" to "C:\ProgramData\

icinga2\etc\icinga2\icingadirector.token"

Notice: Successfully fetched configuration for this host over Self-Service API.

Notice: Fetched ticket "f6bd4b84ab77a99dcf8c7fe573e30712e603b486" from Icinga Director

Notice: Generating Host certificates required by Icinga 2

Notice: information/base: Writing private key to 'C:\ProgramData\icinga2\var\lib\icinga2\ce

rts\PC03020442.xxx.local.key'.

information/base: Writing X509 certificate to 'C:\ProgramData\icinga2\var\lib\icinga2\certs

\PC03020442.xxx.local.crt'.

Notice: Storing Icinga 2 certificates

Fatal: Ausnahme beim Aufrufen von "generateCertificates" mit 0 Argument(en): "information/

cli: Retrieving X.509 certificate for 'xxxmon1.xxx.local:5665'.

critical/pki: Cannot connect to host 'xxxmon1.xxx.local' on port '5665'

critical/cli: Failed to fetch certificate from host."

######## The script encountered several errors during run ########

Fatal: Ausnahme beim Aufrufen von "generateCertificates" mit 0 Argument(en): "information/

cli: Retrieving X.509 certificate for 'xxxmon1.xxx.local:5665'.

critical/pki: Cannot connect to host 'xxxmon1.xxx.local' on port '5665'

critical/cli: Failed to fetch certificate from host."

First, I try on the master reconfigure a new ca:

rm -rf /var/lib/icinga2/ca/*

rm -rf /var/lib/icinga2/certs/*

then i rerun icinga2 api setup to create ne certificates:

[root@xxxmon1 icinga2]# icinga2 api setup
information/cli: Generating new CA.
information/base: Writing private key to '/var/lib/icinga2/ca//ca.key'.
information/base: Writing X509 certificate to '/var/lib/icinga2/ca//ca.crt'.
information/cli: Generating new CSR in '/var/lib/icinga2/certs//thillmmon1.thillm.local.csr'.
information/base: Writing private key to '/var/lib/icinga2/certs//thillmmon1.thillm.local.key'.
information/base: Writing certificate signing request to '/var/lib/icinga2/certs//thillmmon1.thillm.local.csr'.
information/cli: Signing CSR with CA and writing certificate to '/var/lib/icinga2/certs//thillmmon1.thillm.local.crt'.
information/pki: Writing certificate to file '/var/lib/icinga2/certs//thillmmon1.thillm.local.crt'.
information/cli: Copying CA certificate to '/var/lib/icinga2/certs//ca.crt'.
information/cli: API user config file '/etc/icinga2/conf.d/api-users.conf' already exists, not creating config file.
information/cli: Reading '/etc/icinga2/icinga2.conf'.
information/cli: Updating '"conf.d/api-users.conf"' include in '/etc/icinga2/icinga2.conf'.
information/cli: Backup file '/etc/icinga2/icinga2.conf.orig' already exists. Skipping backup.
information/cli: Include statement 'include "conf.d/api-users.conf"' already set.
information/cli: Enabling the 'api' feature.
warning/cli: Feature 'api' already enabled.
information/cli: Updating 'NodeName' constant in '/etc/icinga2/constants.conf'.
information/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.
information/cli: Updating 'ZoneName' constant in '/etc/icinga2/constants.conf'.
information/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.

I try 2 days now to solve the problem, but i don’t find the problem in my config. Have anyone a idea to solve the error messsage?

Thank you!

Marco

[root@xxxmon1 icinga2]# netstat -an | grep 5665
tcp 0 0 0.0.0.0:5665 0.0.0.0:* LISTEN

Log-file, when i try to install the agend on the remote machine:
[root@xxxmon1 icinga2]# tail -f icinga2.log
[2020-01-28 15:34:55 +0100] information/ApiListener: New client connection from [172.21.10.41]:50472 (no client certificate)
[2020-01-28 15:34:55 +0100] information/HttpServerConnection: Request: GET /v1/ (from [172.21.10.41]:50472), user: root, agent: ).
[2020-01-28 15:34:55 +0100] information/HttpServerConnection: Request: GET /v1/objects/apilisteners/api?all_joins=1 (from [172.xx.xx.xx]:50472), user: root, agent: ).
[2020-01-28 15:34:55 +0100] information/HttpServerConnection: HTTP client disconnected (from [172.21.10.41]:50472)
[2020-01-28 15:34:57 +0100] information/WorkQueue: #7 (IdoMysqlConnection, ido-mysql) items: 6, rate: 2.55/s (153/min 805/5min 2436/15min);
^C

Check if there is something blocking the 5665 connection to the master. As is is a CentOS check SELinux and the firewall.

Before trying to reinstall it might be necessary to “clean” the host (at least it was for me until now):

  1. Remove the host object from Icinga Director, deploy config.
  2. Uninstall Icinga2 Agent from Windows Host Icinga2Agent -RunUninstaller
  3. Remove C:\ProgramData\icinga2 from Windows host
  4. Run the installer with the Director self-service API again.
3 Likes

Thank you for the tipp! It was my fault! I create a firewall rule without use the --permanent parameter…3 days ago, i restart the server…now the icinga2 director works very goot and i can continue with the configuation.