SSLError for HTTPS module
LogicMonitor is telling me that one of my FortiGate firewalls, which uses a self signed cert for the GUI, is giving a couple of errors. One error was "days remaining" for the SSL certificate and the other is just this generic "SSLError". I went into the FortiGate and renewed the self signed cert for the GUI and that cleared up the "days remaining" error but the generic "SSLError" persists. I'm not quite sure what's throwing the error so I'm not really sure what to do to resolve it. Suggestions?
Kirby Timm
Posted 1 year ago·Last reply 1 year ago
22 comments
Kirby Timm
OP1 year agoFor anyone else that may be looking at this in the future, support has supplied me with a solution that works.
In LogicMonitor, Open up Settings -> Collectors -> [locate the Collector in question] -> Collector Configuration -> Wrapper Config
Within wrapper config, look at all the "wrapper.java.additional.##" where the ## is going to be a number starting at 1 and incrementing by 1. For example in my environment I had
wrapper.java.additional.1 - wrapper.java.additional.28
Add 1 to the last wrapper.java.additional.## (so for me it would be wrapper.java.additional.29) and add the following line to the end of your config
wrapper.java.additional.29=-Djdk.tls.maxHandshakeMessageSize=50000
Then click "save and restart" to restart the collector. This solved the issue.
The "why" is a bit more iffy. According to LogicMonitor support:
It looks like it was basically just buffer overflow protection built in to the Collector. We have a buffer of 32KiB for the handshake response, if the response exceeds that buffer size we discard it as invalid. To be clear, the following is conjecture, but I figure what's going on here is that most SSL handshake responses are less than 32KiB, so that value was probably chosen arbitrarily as 'good enough' for most cases. Given that the SSL handshake response contains the entire certificate chain, if the chain is long enough it could in theory exceed that buffer size, which I assume is why the developers offered this as a knob to turn in the config. According some random sources I found online, a typical enterprise certificate chain for an internal server using TLS 1.2 can be 6-10KiB, so 32KiB should be enough in most cases. Looks like in this case it wasn't.
Kirby Timm
OP1 year agoWell, I went ahead and actually opened a ticket with LogicMonitor support on this. I've had a ticket open with FortiNet support since last week but that ticket has kind of gone stale.
On a related but different note, is there some where to see in LM exactly what the OID is that's being queried?
Mike Moniz
·1 year agoThere isn't a OID for an HTTP(S) check, it's would use an actual HTTPS request using a check that is built directly into the collector code.
For the collector logs, you can ask the collector to "send logs to LogicMonitor" which will upload them to the portal where you can then download them without directly accessing the collector. See https://www.logicmonitor.com/support/collectors/collector-management/collector-logging#sc-header-160 . Note that the files without a starting number is the latest one. But I find it easier to check the logs directly on the collector if I have access to it. Easier to view and you can sort by last modified. Logs are located at C:\Program Files\LogicMonitor\Agent\logs\ for Windows Collectors and /usr/local/logicmonitor/agent/logs/ for Linux Collectors by default. wrapper.log is likely the one you want.
Kirby Timm
OP1 year agoI did find this in the wrapper log. Not sure it's helpful or not?
[FSMWebpageTask$HttpResponseCallback.failed:958] Caught SSL exception, CONTEXT=host=<IP>, sslErrorReason=unknown., EXCEPTION=javax.net.ssl.SSLProtocolException: The size of the handshake message (37037) exceeds the maximum allowed size (32768)
I'm not sure how one would adjust the size of the handshake message or how it got wonky to begin with... or if it's just a red herring?
Kirby Timm
OP1 year agoI'm going to try and move the resource from 1 collector to another to see if that makes any difference.
Kirby Timm
OP1 year agoYeah, big ol "no" on that. Now I see the same error on the collector it was moved too.
Mike Moniz
·1 year agoThat does sound like that would be an issue. Perhaps the cert is lots of chains for some reason, but since you are having fortigate generate the cert itself, I don't know if there is anything you can do on that side.
For a fix you likely need to work with LM support to see if there is a special agent.conf setting that may help resolve that issue. Or perhaps they need to release a new collector version with a fix.
Mike Moniz
·1 year agoIf you already have a ticket with Fortigate, I would provide that new information to them also. Perhaps they can provide a workaround on their side.
Kirby Timm
OP1 year agoYep, I did!
Kirby Timm
OP1 year agoOh, I should check for a collector update! Good idea!
Kirby Timm
OP1 year agoInternal web check doesn't give any more useful information
Kirby Timm
OP1 year agoWell, I've renewed all the internal certs but logicmonitor is still throwing the error. I don't understand why. There was no error with the selfsigned cert previously.
Mike Moniz
·1 year agoWhat does a browser show when you attempt to look at the firewall? Does Poll Now show anything useful?
Kirby Timm
OP1 year agoBrowser throws an error because it's selfsigned, but LogicMonitor never had an issue with that before and doesn't have an issue with my other 5 fortinet clusters running selfsigned certs either.
Mike Moniz
·1 year agoSpecifically with the message "net::ERR_CERT_AUTHORITY_INVALID" and not another like "NET::ERR_CERT_INVALID" or "NET::ERR_Cert_Weak_Signature_Algorithm_Error"?
Perhaps worth adding that URL as a website check in LM just as a test and see if gives you more details? You can also try looking at the wrapper/smproxy log files on the collector to see if that provide more details.
Kirby Timm
OP1 year agoCorrect, it's specifically net::ERR_CERT_AUTHORITY_INVALID which is the same error I get from my other 5 sites running self signed certs but are not throwing any error in logicmonitor. I tried running the website checker but we don't have the licensing for that so it's not setup for anything and just tosses an error. I'll have to look deeper into how to set that up. I also didn't find wrapper/smproxy log files so I'll also have to look into where to find those.
Mike Moniz
·1 year agoLooking at the HTTPS datasource, the SSLError datapoint will alert if the value is 6. Looking at https://www.logicmonitor.com/support/logicmodules/datasources/data-collection-methods/webpage-httphttps-data-collection says that is "invalid SSL certificate" so still looking like a cert issue. The HTTPS check should work fine with self-signed certs (does here), so I would guess perhaps the options when it was regenerated are the issue? Like perhaps it uses an old algorithm or an invalid subject?
I would try looking at the cert details in a browser to look at it in more detail.
Lewis_Beard
·1 year agoI wonder if there is any chance his server does a redirect. We had some issue where SSL Certs datasource was trying to look at the site LM had but that site actually redirected to somewhere else, but the datasource doesnt care. So we had some issues due to the SSL cert datasource not taking that into account. Probably not related, its just the only thing I have that could help OP. I guess I should have replied to him. :) Oh well, he will see the extra post count surely. :)
Kirby Timm
OP1 year agoI don't think this would be the case. The error wasn't there before I went on PTO, nothing changed while I was out, and the error was there while I came back from PTO.
Lewis_Beard
·1 year agoFair enough. I just remembered that a redirect thing bit us once, when someone changed something on a server we were monitoring, and the redirect was new. Hope you find something soon. Cheers!
Kirby Timm
OP1 year agoNo worries at all. Thanks for the comment.
Kirby Timm
OP1 year agoCould be that it's because it looks like some other built in certs are expiring next month. I'll put it through a change control and run the commands to update the certs and see if that resolves it.