1

So I have two sites running, each behind a single Amazon ELB.

For the purpose of this post (and my companies privacy), using these hostnames for each:

  • example.com
  • anotherexample.com

Certs are installed for both. Both certs are trusted (purchased from a CA).

They work perfectly fine via browsers/etc and the proper certs are used when the site is requested (expected behavior of ELB). Have confirmed with various browsers & requests that the appropriate certs are being loaded and validated when each site is access.

However I found a weird quirk when trying to monitor the cert expiration with Nagios.

The certificate monitoring works, but only for the default cert in the ELB, regardless of which host is being accessed.

Here is the command definition, standard setup:

define command{
    command_name    check_cert_expire
    command_line    $USER1$/check_http -S -H $HOSTADDRESS$ -C $ARG1$
}

Then in the host/service definitions:

define host{
  host_name             example.com
  use                   docker-container
  display_name          Example Site 1
  check_command         check_https_page!/
}

define host{
  host_name             anotherexample.com
  use                   docker-container
  display_name          Example Site 2
  check_command         check_https_page!/
}


define service{
  host_name             example.com
  use                   generic-service
  service_description   Cert Expiry Site1
  check_command         check_cert_expire!45
}

define service{
  host_name             anotherexample.com
  use                   generic-service
  service_description   Cert Expiry Site2
  check_command         check_cert_expire!45
}

However for BOTH service checks, I get IDENTICAL responses:

SSL OK - Certificate '*.example.com' will expire on 2020-03-08 23:59 +0000/UTC. HTTP OK: HTTP/1.1 302 Found - 572 bytes in 0.016 second response time

So regardless of the hostname, it's only checking the example.com cert inside the ELB listener.

I've attached a screenshot of the ELB's certificate setup. 2 certs installed, they work fine in all cases except this Nagios monitoring:

cert setup

I'm sure this has something to do with the request being sent to ELB not triggering whatever packet routing is going on inside ELB to decipher the host, but not even sure where to start on finding out why.

I know this question is extremely specific and obscure but hoping someone has any ideas or a known solution.

EDIT: I know this goes without saying, but trying the check manually:

./check_http -S -H anotherexample.com -C 45

Gives me the same result, returns a valid response but for the example.com cert!

4

Use check_http --sni

When multiple certificates are used on the same ip:port the client must use Server Name Identification (SNI) to select the right one. Modern browsers do it by default, however the nagios check_http must be told to do SNI with --sni.

| improve this answer | |
  • You sir, are a hero! – emmdee Aug 2 '18 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.