sunny_hkhk asked a question.
Hi All,
We are trying to send data from ubuntu 22.04 client to snow inventory server, however we are keep on getting below error.
The server has valid certificate and we even tried installing the rootca in client machine.
Anyone has any idea about this issue?
in snowagent.log
2024-02-12T10:56:52+11:00; Verbose; snowagent; http/CurlMessageHandler.cpp; Send; Contacting server 'https://snow.example.com/api/client/hello'.
2024-02-12T10:56:53+11:00; WARNING; snowagent; http/ConfigMessageHandler.cpp; SendToEndpoint; A http send error occured with endpoint https://snow.example.com/. HttpTransportException: Problem with the SSL CA cert (path? access rights?)
2024-02-12T10:56:53+11:00; Verbose; snowagent; http/EndPointHandler.cpp; TrySendToKnownEndPoints; Endpoint is unreachable
2024-02-12T10:56:53+11:00; ERROR; snowagent; message_loop/MessageLoop.cpp; Handshake; Handshake failed. Cannot connect to server. No endpoint can establish a connection to the server.
Hi @Sandeep Saar
Have you seen this article?
https://community.flexera.com/s/article/linux-agent-error-Problem-with-SSL
Best regards,
Nathan
Thanks @Nathan Green , I have had a look at the article and copied the root certificate manually and mentioned in the configuration file. It worked for me.
However, I would like to know how it works in an ideal scenario? Would like to know the certificate exchange from the server when the client tries to contact it?
Had this problem a year ago or so.
Got this from a support engineer:
"I managed to replicate your issue with the agent. I have compared the config to a working one and I really cannot see any problems with it. Nonetheless, I have created a new Linux agent and this one works. I have redone the config file, and tested this config and it works perfectly well."
Hey @Joakim Bergkvist - it may have been that the engineer changed the value of the http.ssl_verify to false in the snowagent.config & it didn't perform a "check".
If false, the agent will not verify that any certificate used to secure communication is issued by a trusted certificate authority (CA). This setting is enabled by default and must be explicitly disabled if necessary. Acceptable value: true/false.
In my experience; connectivity with Linux can verify but is generally due to networking, certificates or failure to register DNS so in some cases you may have to add a secondary endpoint with IP Address to those edge cases, i.e.
<Server>
<Endpoint>
<Address>https://Gateway.yourdomain.com</Address>
</Endpoint>
<Endpoint>
<Address>https://192.168.24.3:443</Address> <!-- IP of the Inventory or Gateway -->
</Endpoint>
</Server>