Table of Contents
- 1 连接类型或权限问题
- 服务器配置为与agent程序连接，但agent仅接受未加密的连接
- 一方连接证书，但另一方只接受PSK，反之亦然
- Attempting to use Zabbix sender compiled with TLS support to send data to Zabbix server/proxy compiled without TLS
- One side connects with PSK but other side uses LibreSSL or has been compiled without encryption support
- One side connects with PSK but other side uses OpenSSL with PSK support disabled
1 连接类型或权限问题
服务器配置为与agent程序连接，但agent仅接受未加密的连接
在服务器或proxy日志（带有mbed TLS（PolarSSL）1.3.11）
在服务器或proxy日志中（使用GnuTLS 3.3.16）
Get value from agent failed: zbx_tls_connect(): gnutls_handshake() failed: \
-110 The TLS connection was non-properly terminated.在服务器或proxy日志中（使用OpenSSL 1.0.2c）
Get value from agent failed: TCP connection successful, cannot establish TLS to [[127.0.0.1]:10050]: \
Connection closed by peer. Check allowed connection types and access rights一方连接证书，但另一方只接受PSK，反之亦然
在任意日志中（使用mbed TLS（PolarSSL））：
failed to accept an incoming connection: from 127.0.0.1: ssl_handshake():\
SSL - The server has no ciphersuites in common with the client在任意日志中（使用GnuTLS）：
failed to accept an incoming connection: from 127.0.0.1: zbx_tls_accept(): gnutls_handshake() failed:\
-21 Could not negotiate a supported cipher suite.在任意日志中（使用OpenSSL 1.0.2c）：
failed to accept an incoming connection: from 127.0.0.1: TLS handshake returned error code 1:\
file .\ssl\s3_srvr.c line 1411: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher:\
TLS write fatal alert "handshake failure"Attempting to use Zabbix sender compiled with TLS support to send data to Zabbix server/proxy compiled without TLS
In connecting-side log:
Linux:
...In zbx_tls_init_child()
...OpenSSL library (version OpenSSL 1.1.1 11 Sep 2018) initialized
...
...In zbx_tls_connect(): psk_identity:"PSK test sender"
...End of zbx_tls_connect():FAIL error:'connection closed by peer'
...send value error: TCP successful, cannot establish TLS to [[localhost]:10051]: connection closed by peerWindows:
...OpenSSL library (version OpenSSL 1.1.1a 20 Nov 2018) initialized
...
...In zbx_tls_connect(): psk_identity:"PSK test sender"
...zbx_psk_client_cb() requested PSK identity "PSK test sender"
...End of zbx_tls_connect():FAIL error:'SSL_connect() I/O error: [0x00000000] The operation completed successfully.'
...send value error: TCP successful, cannot establish TLS to [[192.168.1.2]:10051]: SSL_connect() I/O error: [0x00000000] The operation completed successfully.In accepting-side log:
One side connects with PSK but other side uses LibreSSL or has been compiled without encryption support
LibreSSL does not support PSK.
In connecting-side log:
...TCP successful, cannot establish TLS to [[192.168.1.2]:10050]: SSL_connect() I/O error: [0] SuccessIn accepting-side log:
In Zabbix frontend:
Get value from agent failed: TCP successful, cannot establish TLS to [[192.168.1.2]:10050]: SSL_connect() I/O error: [0] SuccessOne side connects with PSK but other side uses OpenSSL with PSK support disabled
In connecting-side log:
...TCP successful, cannot establish TLS to [[192.168.1.2]:10050]: SSL_connect() set result code to SSL_ERROR_SSL: file ../ssl/record/rec_layer_s3.c line 1536: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure: SSL alert number 40: TLS read fatal alert "handshake failure"In accepting-side log: