x509 loosing hosts - Githubissues

Icinga / icingaweb2-module-x509

Keeps track of certificates as they are deployed in a network environment.

https://icinga.com/docs/x509/latest/

GNU General Public License v2.0

107 stars 24 forks source link

x509 loosing hosts #239

Open slalomsk8er opened 6 months ago

slalomsk8er commented 6 months ago

Describe the bug

I get regularly Unknown for x509 checks with the reason "Host not found"

To Reproduce

create a director import
wait
observe periodical unknowns

Expected behavior

Hosts don't vanish and reappear.

Screenshots

If applicable, add screenshots to help explain your problem.

Your Environment

Icinga Web 2 version and modules (System - About): 2.12.1 & 1.3.1
Icinga 2 version used (icinga2 --version): r2.14.2-1
PHP version used (php --version): PHP 8.0.30
Server operating system and version: AlmaLinux 8.9

blueman70 commented 6 months ago

BUG DESCRIPTION IN ORDER TO CONFIRM SAME PROBLEM I got same issue but using "icingacli", without director. Checking manually with command icingacli x509 check host --ip xxx.xxx.xxx.xxx (or --host, or etc etc) or others results always: UNKNOWN - Host not found No other errors messages found.

ENVIRONMENT

Icinga Web 2 version and modules (System - About): 2.12.1 & 1.3.2 (latest x509)
Icinga 2 version used (icinga2 --version): r2.14.2-1
PHP version used (php --version): PHP 8.3.7
Server operating system and version: Ubuntu 22.04.4 LTS (jammy)

Some suggestion about it? Thx in advance!!!

blueman70 commented 6 months ago

ANSWERING MYSELF - SOLVED ISSUE The Icinga docs about x509 module is not so clear (maybe for me but....???). In order to retrieve the correct certificate for a specific host (or subnet), you need to create a JOB with a icingaweb gui under Certificate Monitoring/Configuration/Jobs and scan JOB (manually or scheduled) in order to acquire data.

In this example I ran a scan to www.apple.com [23.14.136.246] after scanning all certificates are showed on the gui

apple-cert

Hope to be clear and help your issue.

slalomsk8er commented 6 months ago

@blueman70 Thanks for your input. Sadly no help for my issue as the director import created the service from already detected FQDN/IP:port triplets and subsequent job runs loose the triplet and rediscover them.