Not working with non-standard ports

[uuneter]

Hello,

I just started using this with our Zabbix server to check several of our website certs. For the sites on default tcp 443, it works great. I have the item key as ssl_cert_check_expire[site1.mydomain.com], and for values I get the days until the cert expires, as expected. However I've tried a couple on non-standard ports, and all I get is the "Value "-65535 ERROR: Failed to get certificate". For these, I've tried item keys like: ssl_cert_check_expire[site2.mydomain.com,5601]. If I run it manually from the host, it works fine:

$ sudo /etc/zabbix/ssl_cert_check.sh expire site2.mydomain.com 5601
98

Note that I'm actually using our valid domains - I'm just putting mydomain.com here as examples. As far as I can tell, that second item key should work. I'm not sure what I'm missing. Thanks for any help.

[selivan]

Try testing it from zabbix user:

sudo -u zabbix /etc/zabbix/ssl_cert_check.sh expire site2.mydomain.com 5601

May be your zabbix user is somehow limited in execution of the script or in making network connections.

[uuneter]

Thanks selivan. That works fine too:

$ sudo -u zabbix /etc/zabbix/ssl_cert_check.sh expire site2.mydomain.com 5601
98

Do you see any issues with the item key I'm trying to use? I tried things like adding quotes, etc., but nothing seems to work.

[selivan]

No idea, if it works from zabbix server launched from zabbix user, it should work from zabbix too.

May be try setting a bigger timeout then default 5 seconds?

ssl_cert_check_expire[site2.mydomain.com,5601,site2.mydomain.com,20]

Or try to debug the problem by changing userparameters:

UserParameter=ssl_cert_check_expire[*], /bin/bash -x /etc/zabbix/ssl_cert_check.sh expire "$1" "$2" "$3" "$4" | tee /tmp/ssl_cert_check-debg.log

[uuneter]

I just noticed in the Zabbix agent log, it doesn't look like it's using the port parameter at all:
"16102:20210414:160014.227 Failed to execute command " /etc/zabbix/ssl_cert_check.sh expire "site2.mydomain.com" "" "" """: Timeout while executing a shell script."

[selivan]

May be you have set a very strict timeout for the item?

[selivan]

And something goes wrong with passing parameters to the script.