Unable to connect to the remote server [EventID: 1553]

[pakyg]

Hi, I'm having trouble with invoke PS plugins working with the API.
I state that I have updated all the modules to the latest version, following all the various steps recommended for installation.
I get the error "Unable to connect to the remote server" EventID 1553. I have registered the various PS plugins, with the command: Add-IcingaRESTApiCommand -Command 'Invoke-IcingaCheck *' -Endpoint 'apichecks' -Whitelist ;.
Can you help me solve the problem?
Thanks so much,
Greetings

[LordHepipud]

Hello,

thank you for the issue. Is the Icinga PowerShell service running?

Get-Service icingapowershell

What happens if you restart the service? The EventLog should print error messages in case the Listener Socket cannot be established. Do you have any of these log messages inside your EventLog: https://icinga.com/docs/icinga-for-windows/latest/restapi/doc/20-Eventlog/

Can you please share the information for these commands:

Get-Module -ListAvailable -Name 'icinga-powershell-restapi';
Get-Module -ListAvailable -Name 'icinga-powershell-apichecks';

Get-IcingaBackgroundDaemons;

Show-IcingaRESTApiCommands;

Get-IcingaFrameworkApiChecks;

Get-IcingaAgentHostCertificate;

Are you using the certificates generated by the Icinga Agent or have you provided a custom certificate to create the REST-Api socket?

https://icinga.com/docs/icinga-for-windows/latest/restapi/doc/02-Installation/#daemon-registration

[pakyg]

Hello,
Thanks for your quick response.

The Icinga Powershell Service is running.
Restarting the service, I get the "EventID 2000" error.
I am using the certificate generated by Icinga Agent, for the registration of the rest-api daemon, I used the command:
"Use-Icinga;
Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi'; "

Get-IcingaFrameworkApiChecks;
True
By issuing the command: "Get-IcingaAgentHostCertificate;" it does not report any results in output.

To register the rest api as a background daemon, I used the built-in command: "Use-Icinga;
Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi'; "

Update:
By registering the API-rest with the following command, the problem seems to have been solved .. I had to pass it the path of the certificate generated by default by Icinga Agent.
Command:
"Use-Icinga;
Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi' -Arguments @ {'-Port' = 5669; '-CertFile' = 'path / to / your / cert / file'}; "
With this procedure, I no longer see errors such as EventID 1553 or 2000.

I await your feedback for a correct resolution of the problem.
Thanks so much!
Greetings

[LordHepipud]

Thank you for the update. I believe the issue is coming from the -RequireAuth argument.

You registered the API to require authentication to access the API, which is causing a problem for the build-in API check handler, as there is no support available for this option.

Running this alone should already work fine, as long as -RequireAuth is not set.

Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi'

Am I correct here?

[pakyg]

Hello,
I tried to register the API as you suggested, with the command: "Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi';"
I have not set any "-RequireAuth", but I still encounter the two problems mentioned (EventId 2000 and EventId 1553).

I tried on two different servers, in the first I ran the command: "Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi';" and I get error 1553 and 2000.

On the second server, I ran the command: "Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi' -Arguments @ {'-Port' = 5669; '-CertFile' = 'path / to / your / cert / file'};" and I don't have any problems ..

What do you think about it? In all servers, I have not entered any Basic Auth.
Thank you very much!!

[LordHepipud]

Ì came to the conclusion about the basic auth, because the argument is shown on your first screenshot on the registered background daemon. In general the values you enter are the default ones.

For some reason the daemon is unable to auto-fetch the required certificate. Normally the Framework will use

Get-IcingaSSLCertForSocket

To create the socket, which can either be defined manually or used automatically with the Icinga Agent certificates. If the command is returning nothing or an empty result, this means the certificate for the Agent cannot be looked up.

If you manually configure the path to the certificate, it should work.

Could you please execute this snippet inside an Icinga shell and tell me, if the hostname and/or the certificates inside FolderContent are matching or if the naming is entirely different?

[string]$CertDirectory = (Join-Path -Path $Env:ProgramData -ChildPath 'icinga2\var\lib\icinga2\certs\*');
$FolderContent         = Get-ChildItem -Path $CertDirectory -Filter '*.crt' -Exclude 'ca.crt';
$Hostname              = Get-IcingaHostname -LowerCase $TRUE;

$FolderContent;
$HostName;

[pakyg]

Hi,
I did a couple of checks, I run the command: "Get-IcingaSSLCertForSocket", it doesn't report any results in the output.

By running the command suggested by an Icinga shell, I confirm that the hostname and / or certificates within FolderContent match each other..

Currently I will use the command with the arguments, to pass it the path of the certificate manually.

Thanks so much!

[pakyg]

Update:
despite the certificate passed manually, the eventid error 1553 returned.
Command: "Use-Icinga;
Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi' -Arguments @ {'-Port' = 5669; '-CertFile' = 'path / to / your / cert / file'}; "

Eventid 2000 seems to be resolved.

The only remaining error is the eventid 1553.
Can we make other checks?

Thanks so much!

[drapiti]

Hi, we are also experiencing these errors and it is blocking our deployment, quite critical. Was there some change with the last update. We were not experiencing this error with the previous version.

Cheers!

[LordHepipud]

There were no changes which should cause the deployment or the execution to fail. Have you installed the latest version from both, the Framework, the REST-Api and the Checker component?

We improved the Performance and fixed some issues with the service, but it should run just fine without having to configure anything with the Icinga Agent installed and configured with certificates.

If no Agent is present, you have to manually define the certificates. On case there is no socket creation error, the API should just work.

Can you access https://localhost:5668/v1 on the machines with the service installed?

[pakyg]

Hi,
we tried a clean reinstall, for all modules we used Icinga-FrameworkComponent. The installation was successful.

The registration of the daemon with the API was done manually, by running the command:
Register-IcingaBackgroundDaemon -Command 'Start-IcingaWindowsRESTApi' -Arguments @{ '-Port' = 5668; '-CertFile' = 'C:\ProgramData\icinga2\var\lib\icinga2\certs\ my cert file' };
[Notice]: Background daemon Cmdlet "Start-IcingaWindowsRESTApi" has been configured

Running the "Get-IcingaAgentHostCertificate;" command, returns nothing in the output.
Instead by running the suggested command inside a shell:

Is it normal that the command: "Get-IcingaAgentHostCertificate;" does not report any results in the output?

The previous error 2000 seems to have been fixed, but the 1553 still hasn't returned after the last clean install.
I do a couple of checks and see if error 1553 returns.
We are currently experiencing errors 1500 and 1501, they occur about 30 minutes after restarting the services.

From browser going to "https: // localhost: 5668 / v1", it seems to work correctly:

Currently we only need to fix error 1500 and 1501, they occur about 30 minutes after the services restart.
How can we solve?

Thank you!
Greetings

[drapiti]

There were no changes which should cause the deployment or the execution to fail. Have you installed the latest version from both, the Framework, the REST-Api and the Checker component?

We improved the Performance and fixed some issues with the service, but it should run just fine without having to configure anything with the Icinga Agent installed and configured with certificates.

If no Agent is present, you have to manually define the certificates. On case there is no socket creation error, the API should just work.

Can you access https://localhost:5668/v1 on the machines with the service installed?

We have a similar situation to @pakyg, resolved a few issues using the Icinga-FrameworkComponent.

[LordHepipud]

The errors 1500 and 1501 are mostly occurring in case you are using a browser to connect to the API which throws the certificate error. If you are connecting by using Invoke-WebRequest, curl or wget you should always use insecure flags to prevent certificate checking, as otherwise this error occurs.

Another solution would be, to use signed host certificates by your CA which your browser will trust.

I'm not sure at the moment on why the host certificate Cmdlet is not returning the certificate as it should. The command snippet is from the function and seems to work just fine. I will have to dig into that.

[pakyg]

I tried to run the command:
"Use-Icinga; Enable-IcingaUntrustedCertificateValidation;
Invoke-WebRequest -Method GET -UseBasicParsing -Uri 'https: // localhost: 5668 / v1 / checker? Command = cpu'; "

Instead, launching the command from the browser (with the CA installed manually), I can see it correctly.
The problem remains when I try to run an Invoke-WebRequest from Powershell because it keeps giving me an error.
I will update you in case of further developments.

Thanks!
Greetings

[LordHepipud]

Can you please try in addition on the shell to Enable-IcingaUntrustedCertificateValidation, Set-IcingaTLSVersion?

This should ensure you can talk to the TLS 1.2 certificate from the Agent.

[pakyg]

Hi,
I tried to run the additional command "Set-IcingaTLSVersion":

Thanks!