[ZBX-21714] Zabbix 6.0.x PSK - no suitable signature algorithm Created: 2022 Sep 30  Updated: 2022 Oct 14  Resolved: 2022 Oct 14

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G), Server (S)
Affects Version/s: 6.0.8, 6.0.9
Fix Version/s: None

Type: Problem report Priority: Trivial
Reporter: Cezary Assignee: Igor Gorbach (Inactive)
Resolution: Commercial support required Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Ubuntu 22.04 (openssl 3.0.2), Ubuntu 20.04 (openssl 1.1.1f), Debian 10 (1.1.1n)



 Description   

Steps to reproduce:

1. Fresh installation of zabbix-server-mysql 6.0.9 from zabbix repository via apt, also with fresh database from template. I tried them all with different combinations:

 

root@Debian10:/var/log/zabbix# zabbix_server -V
zabbix_server (Zabbix) 6.0.9
Revision 64721203c07 21 September 2022, compilation time: Sep 21 2022 09:09:36Copyright (C) 2022 Zabbix SIA
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it according to
the license. There is NO WARRANTY, to the extent permitted by law.This product includes software developed by the OpenSSL Project
for use in the OpenSSL Toolkit (http://www.openssl.org/).Compiled with OpenSSL 1.1.1d  10 Sep 2019
Running with OpenSSL 1.1.1n  15 Mar 2022
 

 

root@Ubuntu22:/usr/share/zabbix# zabbix_server -V
zabbix_server (Zabbix) 6.0.9
Revision 64721203c07 21 September 2022, compilation time: Sep 21 2022 09:09:36Copyright (C) 2022 Zabbix SIA
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it according to
the license. There is NO WARRANTY, to the extent permitted by law.This product includes software developed by the OpenSSL Project
for use in the OpenSSL Toolkit (http://www.openssl.org/).Compiled with OpenSSL 3.0.2 15 Mar 2022
Running with OpenSSL 3.0.2 15 Mar 2022
 
root@Ubuntu20:/var/log/zabbix# zabbix_agentd -V
zabbix_agentd (daemon) (Zabbix) 6.0.9
Revision 64721203c07 21 September 2022, compilation time: Sep 21 2022 09:09:36Copyright (C) 2022 Zabbix SIA
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it according to
the license. There is NO WARRANTY, to the extent permitted by law.This product includes software developed by the OpenSSL Project
for use in the OpenSSL Toolkit (http://www.openssl.org/).Compiled with OpenSSL 1.1.1f  31 Mar 2020
Running with OpenSSL 1.1.1f  31 Mar 2020
 
root@Ubuntu22:# zabbix_agentd -V zabbix_agentd (daemon) (Zabbix) 6.0.9 Revision 64721203c07 21 September 2022, compilation time: Sep 21 2022 09:09:36Copyright (C) 2022 Zabbix SIA License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it according to the license. There is NO WARRANTY, to the extent permitted by law.This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).Compiled with OpenSSL 3.0.2 15 Mar 2022 Running with OpenSSL 3.0.2 15 Mar 2022

 

 

2. Add single host to server and setup PSK encryption on it

 

TLSAccept=psk
TLSPSKIdentity=zabbix
TLSPSKFile=/etc/zabbix/psk 

PSK generated via command: openssl rand -hex 32

 

 

Result:
Server:

3234:20220930:121836.127 interfaceid:1 hostid:10084 ip:'127.0.0.1' dns:'' port:'10050' type:1 main:1 useip:1 available:1 errors_from:0 disable_until:0 error:'' availability_ts:1664533055 reset_availability:0 items_num 60interfaceid:12 hostid:10529 ip:'10.10.10.10' dns:'' port:'10050' type:1 main:1 useip:1 available:2 errors_from:1664529873 disable_until:1664533144 error:'Get value from agent failed: TCP successful, cannot establish TLS to [[10.10.10.10]:10050]: SSL_connect() I/O error: [0] Success' availability_ts:1664533055 reset_availability:0 items_num 14
  3434:20220930:121904.106 In get_value_agent() host:'nexus.domain.com' addr:'10.10.10.10' key:'system.uptime' conn:'TLS with PSK'
  3434:20220930:121904.108 Item [nexus.domain.com:system.uptime] error: Get value from agent failed: TCP successful, cannot establish TLS to [[10.10.10.10]:10050]: SSL_connect() I/O error: [0] Success
 

Client:

91290:20220930:120704.535 failed to accept an incoming connection: from 10.10.10.10: TLS handshake set result code to 1: file ../ssl/t1_lib.c line 2750: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm: TLS write fatal alert "handshake failure"
 91292:20220930:120704.535 failed to accept an incoming connection: from 10.10.10.10: unencrypted connections are not allowed
 

Expected:
TLS encryption working with current and previous 5.x+ agent versions.

 

If you need any additional debuging data or something please let me know.



 Comments   
Comment by Igor Gorbach (Inactive) [ 2022 Oct 14 ]

Cannot reproduce on Ubuntu 20.04 

Tried with openssl 1.1.1f,q - and the same psk settings - no issues

Looks like as misconfiguration, but we cannot help here, because ZBX project is a bug tracker

In this case  - commercial support required

You're also able to get some help in 
Zabbix International Community in Telegram
or on
Zabbix Forum

Generated at Sun Aug 03 03:41:05 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.