Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate

[TeleMediaCC]

Hi,

I am attempting to use this plugin in Icinga2web with Go Daddy Secure Certificate Authority - G2 issued certificates, but I keep running into an error:

Plugin Output
SSL_CERT CRITICAL *.telemedia.hu: Cannot verify certificate: unable to get local issuer certificate, unable to verify the first certificate

I attached the check_ssl_cert -H www2.telemedia.hu -v -d command result.
error.txt

Hope you can help!

[matteocorti]

If I understand you correctly when run in the command line you get an OK status

SSL_CERT OK - x509 certificate '*.telemedia.hu' (www2.telemedia.hu) from 'Go Daddy Secure Certificate Authority - G2' valid until May  2 08:15:45 2023 GMT (expires in 332 days)|days_chain_elem1=332;20;15;; days_chain_elem2=3255;20;15;; days_chain_elem3=3282;20;15;; days_chain_elem4=4409;20;15;;

But not in Icinga where OpenSSL cannot find the root certificate.

You can specify the root certificate bundle of your system with the -r option:

   -r,--rootcert path              Root certificate or directory to be used

[TeleMediaCC]

Yes. When run in cli, everything is ok. The problem only in Icinga.
Where specify the root certificate bundle? On Icinga server or the Web Server? And which command use -r,--rootcert path?

[matteocorti]

Where you configure the plugin in Icinga you have to specify the additional -r option. On Debian should be (I didn't check)

-r /etc/ssl/certs/ca-certificates.crt

[TeleMediaCC]

Thx. I only configure in simple icinga config:

apply Service "ssl-cert" {
import "1day-service"
check_command = "ssl_cert"
vars.ssl_cert_warn = 30
vars.ssl_cert_critical = 10
command_endpoint = host.vars.client_endpoint

But, then I create custom command somehow with check_ssl_crt.

Thx!

[henricsouza]

Hi!
thanks for sharing the plugin

i'm trying to monitor the .pfx certificate.
./check_ssl_cert -f /usr/local/nagios/libexec/custom/cert/test.pfx -w 30 -c 10 -d

[DBG] ALL_MSG = \n SSL_CERT CRITICAL x.x.x.xx : Cannot find Signed Certificate Timestamps (SCT)\n SSL_CERT CRITICAL /usr/local/nagios/libexec/custom/cert/test.pfx: Error verifying the certificate chain

[DBG] number of errors = 2
SSL_CERT CRITICAL /usr/local/nagios/libexec/custom/cert/test.pfx : Error verifying the certificate chain|days_chain_elem1=362;30;10;;

[matteocorti]

Your certificate does not support Certificate Transparency (see https://certificate.transparency.dev/howctworks/). You can ignore it with --ignore-sct.