Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to check the availability of a SSL Web site (https) with nagios.

I have add a command to the command.cfg:

define command{
  command_name    check_http_myserver_Demo
  command_line    $USER1$/check_http -H www.mydomain.de -u /Demo -p 443 -S
}

Then I have add also a service in the localhost.cfg:

define service {
   use                             local-service
   host_name                       myServer
   service_description             HTTP myserver Response Check
   check_command                   check_http_myserver_Demo
   max_check_attempts              2
   normal_check_interval           5
   retry_check_interval            1
   notification_interval           240
   notification_period             24x7
   notification_options            w,u,c,r
}

If I check the configuration file with "nagios -v nagios.cfg" I'm getting no errors.

The nagios server check of this service is negativ and says "HTTP CRITICAL - Fehler beim Empfangen" (it's german; my translation: "error while receiving"). But the service is definitive available. I can open a browser and can open the URL without problems.

Any ideas?

EDIT:

If I run the check manually I get:

/usr/lib64/nagios/plugins/check_http -v -H www.c-onDocFlow.de -u / -S
GET / HTTP/1.1
User-Agent: check_http/v1.4.15 (nagios-plugins 1.4.15)
Connection: close
Host: www.c-onDocFlow.de

HTTP CRITICAL - Fehler beim Empfangen

Without "-S" it runs ok. Also if I take a other https side (of a other domain) it's ok. May be something is with the certificate wrong, but I cannot see any problem.

share|improve this question
1  
If you run the check command by hand on your nagios server, does it still fail? –  Flup May 20 '13 at 10:51
    
Thanks, see my edit. –  Steffen May 20 '13 at 11:35
    
FWIW when I try this from here, I get a 400 error from your webserver. –  Flup May 20 '13 at 11:38
    
If you try connecting using openssl directly from the command line, does it tell you anything about problems with the site certificate? (e.g. openssl s_client -connect servername:443) –  Jenny D May 20 '13 at 11:39
    
Found it! Thanks "Jenny D". Your command returns a wrong SSL certificate (for a second domain of this server). The other domain will be no longer used. I have correct the httpd configuration and now it works! Many thanks also to Flup for your help! –  Steffen May 20 '13 at 11:52

1 Answer 1

up vote 1 down vote accepted

You may not be able to see anything else wrong, but I can:

[me@risby]$ openssl s_client -connect www.c-onDocFlow.de:443
CONNECTED(00000003)
[...]
Certificate chain
 0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=www.dbregio-nwn.de
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
---
[much certificate stuff deleted]
---
GET /
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>503 Service Temporarily Unavailable</title>
</head><body>
<h1>Service Temporarily Unavailable</h1>
<p>The server is temporarily unable to service your
request due to maintenance downtime or capacity
problems. Please try again later.</p>
</body></html>

You say you can get the root page from the webserver with a browser no problem ("the service is definitive available"); is it from the NAGIOS server that you succeed in doing that, and could we see some evidence? At the moment, it looks like NAGIOS is quite rightly telling you that the server's not giving out any content at all.

share|improve this answer
    
It was a httpd config error. The openssl command returns a certificate of a old (second) domain of this server (and your request is going on that domain). See also the comment of "Jenny D" and my last comment. Thanks –  Steffen May 20 '13 at 11:58
1  
Well done on solving your own problem, given a few pointers! May I encourage you to write your answer up and accept it (you may have to wait 48 hours to be able to do so)? Or suggest to JennyD that she write her comment up as an answer so you can accept that? –  MadHatter May 20 '13 at 12:27
1  
This issue has bit me a couple of times before as well. I use digicert.com/help for a quick SSL tester when I don't want to bother with the command line. –  jeffatrackaid May 20 '13 at 13:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.