munin-monitoring / munin
46%

DEFAULT BRANCH: master
Repo Added
Files 20
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x

coverage: 46.253%. Remained the same
17416987188

push

github

web-flow 
Enable wget --no-check-certificate option in http_loadtime plugin (#1664)

This patch disables SSL/TLS certificate validation in the http_loadtime
plugin when wget establishes an HTTPS connection. This prevents the
plugin from considering an untrusted certificate a failure. Which allows
the plugin to work with HTTPS protocol servers, even when they supply a
self-signed, expired, or otherwise invalid certificate.

### My case
I am using munin's http_loadtime plugin to monitor a
[pi-hole](https://pi-hole.net/) server. Which creates a self-signed TLS
certificate to support HTTPS. The certificate is created and managed by
3rd-party software. I have enabled automatic redirection of HTTP to
HTTPS in the web server configuration.

### Problem
The wget program will attempt to verify certificates by default. So wget
will exit with an error when the http_loadtime plugin tries to establish
an HTTPS connection with a server providing an untrusted certificate.
Which causes the plugin to consider the operation failed.

This means that the plugin will not be automatically suggested/linked
during the `munin-node-configure` step. And if manually enabled, it will
exit immediately after the connection is initialized - so the `value`
metric will not include the transmit time for downloading any of the
actual data at the configured URL.

### Solution
Conveniently, wget offers an option to disable certificate validation -
[`--no-check-certificate`](https://www.gnu.org/software/wget/manual/wget.html#index-SSL-certificate_002c-check).
When I enable this option then the http_loadtime plugin works fine with
self-signed certificates.

In my case I was able to work around the problem by trusting the
certificate in the operating system. You could also potentially work
around this problem by setting the option in a wget config file for the
root user. But those are not universal solutions. It would be difficult
to use certificate trust to work around this problem with certificates
... (continued)

1043 of 2255 relevant lines covered (46.25%)

275.02 hits per line

Relevant lines Covered
2255 RELEVANT LINES 1043 COVERED LINES
275.02 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
17416987188 master Enable wget --no-check-certificate option in http_loadtime plugin (#1664) This patch disables SSL/TLS certificate validation in the http_loadtime plugin when wget establishes an HTTPS connection. This prevents the plugin from considering an untru... push web-flow github
46.25
16899487863 master build(deps): bump actions/checkout from 4 to 5 (#1662) push web-flow github
46.25
16533573809 master Fix IPv6 node connections (#1661) Commit 012b33a70 changed `from IO::Socket::INET6` to `IO::Socket::IP` but that silently changed the meaning of our default `local_address 0` from `::` to `0.0.0.0` which made IPv6-c... push web-flow github
46.25
15886635317 master `postgres_connections_`: enable `warning` and `critical` for total connections (#1657) this enables having early warnings before hitting max_connections. Info @wt-io-it push web-flow github
70.11
15817413616 master `hddtemp_smartctl`: support `/dev/disk/by-id/*` name translation (#1655) If translate_names is set, for each drive walk the symlinks created by udev below /dev/disk/by-id/ and replace the simple device name sdX by its correspondent. That way, gr... push web-flow github
70.02
15808204940 master Merge 03901247a into 62a9517cf Pull #1655 web-flow github
70.02
15764637078 master hddtemp_smartctl: remove superfluous concatenation (#1654) push web-flow github
70.02
15758199389 master Merge 99dbfe385 into c970adc5d Pull #1654 web-flow github
70.02
15747059995 master hddtemp_smartctl: make temperature limits configurable (#1653) push web-flow github
70.02
15746668905 master Merge 7df63119d into 091c8e612 Pull #1653 web-flow github
70.02
See All Builds (750)