# Windows Agent with the director: Failed to fetch certificate from host

**URL:** <https://community.icinga.com/t/windows-agent-with-the-director-failed-to-fetch-certificate-from-host/3330>\
**Category:** Icinga Director\
**Created:** [January 28, 2020, 2:29pm UTC](https://community.icinga.com/t/windows-agent-with-the-director-failed-to-fetch-certificate-from-host/3330 "2020-01-28T14:29:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco-total](https://community.icinga.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@marco-total](https://community.icinga.com/u/marco-total)\
**Post date:** [January 28, 2020, 2:29pm UTC](https://community.icinga.com/t/windows-agent-with-the-director-failed-to-fetch-certificate-from-host/3330/1 "2020-01-28T14:29:15Z")

</div>

Hi,

i installed on a fresh installed CentOS 8 icinga2, icingaweb2 and the director. After the first configuration (I use the youtube webinar videos from netways) all looks fine, but i have a problem to install the icinga2 agent on a windows maschine:

```
PS C:\ProgramData> exit Icinga2AgentModule `

-DirectorUrl 'http://172.xx.xx.xx/icingaweb2/director/' `

-DirectorAuthToken 'ffd11aa441d57765517c4b1b31d7336b3cb76438' `

-RunInstaller

Notice: Started script run...

Notice: Connected successfully to Icinga Director Self-Service API over API token.

Notice: Setting internal Agent Name to "PC03020442.xxx.local"

Notice: Trying to fetch Host IP-Address for hostname: PC03020442.xxx.local

Notice: Setting IP 172.xx.xx.xx as primary IP for this host for all requests. Access it wi

th &ipaddress& for all JSON requests.

Notice: Using Icinga version "", setting certificate directory to "C:\ProgramData\icinga2\e

tc\icinga2\pki"

Warning: Icinga 2 Agent does not seem to be installed on the system

Notice: Installing Icinga 2 Agent from local directory

Warning: Icinga 2 Agent Installer verification disabled.

Notice: Installing Icinga 2 Agent

Notice: Icinga 2 Agent installed.

Notice: Using Icinga version "2.11.0", setting certificate directory to "C:\ProgramData\ici

nga2\var\lib\icinga2\certs"

Notice: Found Icinga 2 Agent version 2.11.0 installed at "C:\Program Files\ICINGA2\"

Notice: Creating host "PC03020442.xxx.local" over API token inside Icinga Director.

Notice: Writing host API-Key "7a1d46cfadf339ebe9d15aa772fb45419dedbca5" to "C:\ProgramData\

icinga2\etc\icinga2\icingadirector.token"

Notice: Successfully fetched configuration for this host over Self-Service API.

Notice: Fetched ticket "f6bd4b84ab77a99dcf8c7fe573e30712e603b486" from Icinga Director

Notice: Generating Host certificates required by Icinga 2

Notice: information/base: Writing private key to 'C:\ProgramData\icinga2\var\lib\icinga2\ce

rts\PC03020442.xxx.local.key'.

information/base: Writing X509 certificate to 'C:\ProgramData\icinga2\var\lib\icinga2\certs

\PC03020442.xxx.local.crt'.

Notice: Storing Icinga 2 certificates

Fatal: Ausnahme beim Aufrufen von "generateCertificates" mit 0 Argument(en): "information/

cli: Retrieving X.509 certificate for 'xxxmon1.xxx.local:5665'.

critical/pki: Cannot connect to host 'xxxmon1.xxx.local' on port '5665'

critical/cli: Failed to fetch certificate from host."

######## The script encountered several errors during run ########

Fatal: Ausnahme beim Aufrufen von "generateCertificates" mit 0 Argument(en): "information/

cli: Retrieving X.509 certificate for 'xxxmon1.xxx.local:5665'.

critical/pki: Cannot connect to host 'xxxmon1.xxx.local' on port '5665'

critical/cli: Failed to fetch certificate from host."

```

First, I try on the master reconfigure a new ca:

```
rm -rf /var/lib/icinga2/ca/*

rm -rf /var/lib/icinga2/certs/*

```

then i rerun icinga2 api setup to create ne certificates:

```
[root@xxxmon1 icinga2]# icinga2 api setup
information/cli: Generating new CA.
information/base: Writing private key to '/var/lib/icinga2/ca//ca.key'.
information/base: Writing X509 certificate to '/var/lib/icinga2/ca//ca.crt'.
information/cli: Generating new CSR in '/var/lib/icinga2/certs//thillmmon1.thillm.local.csr'.
information/base: Writing private key to '/var/lib/icinga2/certs//thillmmon1.thillm.local.key'.
information/base: Writing certificate signing request to '/var/lib/icinga2/certs//thillmmon1.thillm.local.csr'.
information/cli: Signing CSR with CA and writing certificate to '/var/lib/icinga2/certs//thillmmon1.thillm.local.crt'.
information/pki: Writing certificate to file '/var/lib/icinga2/certs//thillmmon1.thillm.local.crt'.
information/cli: Copying CA certificate to '/var/lib/icinga2/certs//ca.crt'.
information/cli: API user config file '/etc/icinga2/conf.d/api-users.conf' already exists, not creating config file.
information/cli: Reading '/etc/icinga2/icinga2.conf'.
information/cli: Updating '"conf.d/api-users.conf"' include in '/etc/icinga2/icinga2.conf'.
information/cli: Backup file '/etc/icinga2/icinga2.conf.orig' already exists. Skipping backup.
information/cli: Include statement 'include "conf.d/api-users.conf"' already set.
information/cli: Enabling the 'api' feature.
warning/cli: Feature 'api' already enabled.
information/cli: Updating 'NodeName' constant in '/etc/icinga2/constants.conf'.
information/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.
information/cli: Updating 'ZoneName' constant in '/etc/icinga2/constants.conf'.
information/cli: Backup file '/etc/icinga2/constants.conf.orig' already exists. Skipping backup.

```

 ![API](https://community.icinga.com/uploads/default/original/2X/2/296a93346fdff89e9fd9d696854a375760d6c1a7.png) ![director config](https://community.icinga.com/uploads/default/original/2X/c/cd046c1511beeea2b0e2c81c86406f9d45e1c350.png) ![endpoint](https://community.icinga.com/uploads/default/original/2X/f/ff713ba73ddc9d6f64b7a59edd2e7a7747b01b93.png) ![host](https://community.icinga.com/uploads/default/original/2X/3/390bc22295ffe36ec9746633725dd265b88c55dd.png) ![Host_Template](https://community.icinga.com/uploads/default/original/2X/a/a6bf0281394dd6853052ec2359e0e19034dc91e6.png)

I try 2 days now to solve the problem, but i don’t find the problem in my config. Have anyone a idea to solve the error messsage?

Thank you!

Marco

---

<div class="post-metadata">

**Author:** ![marco-total](https://community.icinga.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@marco-total](https://community.icinga.com/u/marco-total)\
**Post date:** [January 28, 2020, 2:29pm UTC](https://community.icinga.com/t/windows-agent-with-the-director-failed-to-fetch-certificate-from-host/3330/2 "2020-01-28T14:29:51Z")

</div>

![zones](https://community.icinga.com/uploads/default/original/2X/a/a9475da08812fda9e212dd441bd23d0f44c0e3ef.png)

[root@xxxmon1 icinga2]# netstat -an | grep 5665  
tcp 0 0 0.0.0.0:5665 0.0.0.0:\* LISTEN

Log-file, when i try to install the agend on the remote machine:  
[root@xxxmon1 icinga2]# tail -f icinga2.log  
[2020-01-28 15:34:55 +0100] information/ApiListener: New client connection from [172.21.10.41]:50472 (no client certificate)  
[2020-01-28 15:34:55 +0100] information/HttpServerConnection: Request: GET /v1/ (from [172.21.10.41]:50472), user: root, agent: ).  
[2020-01-28 15:34:55 +0100] information/HttpServerConnection: Request: GET /v1/objects/apilisteners/api?all\_joins=1 (from [172.xx.xx.xx]:50472), user: root, agent: ).  
[2020-01-28 15:34:55 +0100] information/HttpServerConnection: HTTP client disconnected (from [172.21.10.41]:50472)  
[2020-01-28 15:34:57 +0100] information/WorkQueue: #7 (IdoMysqlConnection, ido-mysql) items: 6, rate: 2.55/s (153/min 805/5min 2436/15min);  
^C

---

<div class="post-metadata">

**Author:** ![log1c](https://community.icinga.com/user_avatar/community.icinga.com/log1c/32/2071_2.png) [@log1c](https://community.icinga.com/u/log1c)\
**Post date:** [January 29, 2020, 9:10am UTC](https://community.icinga.com/t/windows-agent-with-the-director-failed-to-fetch-certificate-from-host/3330/3 "2020-01-29T09:10:00Z")

</div>

Check if there is something blocking the 5665 connection to the master. As is is a CentOS check SELinux and the firewall.

Before trying to reinstall it might be necessary to “clean” the host (at least it was for me until now):

1. Remove the host object from Icinga Director, deploy config.
2. Uninstall Icinga2 Agent from Windows Host `Icinga2Agent -RunUninstaller`
3. Remove `C:\ProgramData\icinga2` from Windows host
4. Run the installer with the Director self-service API again.

---

<div class="post-metadata">

**Author:** ![marco-total](https://community.icinga.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@marco-total](https://community.icinga.com/u/marco-total)\
**Post date:** [January 29, 2020, 6:09pm UTC](https://community.icinga.com/t/windows-agent-with-the-director-failed-to-fetch-certificate-from-host/3330/4 "2020-01-29T18:09:48Z")

</div>

Thank you for the tipp! It was my fault! I create a firewall rule without use the --permanent parameter…3 days ago, i restart the server…now the icinga2 director works very goot and i can continue with the configuation.