As mentioned in (58) in ZBXNEXT-1263 and further documented at the certificate page, arriving at a proper value for "Subject" field in host's "Encryption" tab is non-trivial - one should use a command-line tool for it.

Since using the "Subject" field is a must from the security perspective, it is sad that it currently requires manual handling for every host with a command-line tool. It would be nice to reduce the amount of effort in two ways:

• support partial matching, listing only required fields: "CN=agent.example.com" (then using a command-line tool will not be necessary)
• support macros: "CN={HOST.DNS}" (reported separately in ZBXNEXT-3148 and covers pre-shared keys, too)

Both should reduce the amount of effort significantly and make it more convenient.