[Pkg-nagios-devel] Bug#396866: nagios-plugins-basic: check_http -S reports "error on receive" for certain hosts

[Marc Haber]

Package: nagios-plugins-basic
Version: 1.4.3.0cvs.20060707-3
Severity: normal

Hi,

I am trying to check an https server (that is, to my knowledge,
running IIS on Windows Server 2003) with check_http. Unfortunately,
the check does not succeed, and the error message "error on receive"
is printed:

| $ /usr/lib/nagios/plugins/check_http -S -H a.b.c.d -p 443 --verbose
| GET / HTTP/1.0
| User-Agent: check_http/1.91 (nagios-plugins 1.4.3)
| Host: a.b.c.d
| 
|
| Error on receive

When I connect to the host with openssl s_client a.b.c.d:443, I can
issue the same http request and get an answer:

GET / HTTP/1.0
User-Agent: check_http/1.91 (nagios-plugins 1.4.3)
Host: a.b.c.d

depth=0 /C=DE/ST=BW/L=Cityname/O=Customer/OU=Customer/CN=some.invalid.host.name
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=DE/ST=BW/L=Cityname/O=Customer/OU=Customer/CN=some.invalid.host.name
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=DE/ST=BW/L=Cityname/O=Customer/OU=Customer/CN=some.invalid.host.name
verify error:num=21:unable to verify the first certificate
verify return:1
read R BLOCK
HTTP/1.1 200 OK
Content-Length: 1433
Content-Type: text/html
Content-Location: https://a.b.c.d/iisstart.htm
Last-Modified: Fri, 21 Feb 2003 16:48:30 GMT
Accept-Ranges: bytes
ETag: "0c3110c9d9c21:8ac"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 03 Nov 2006 12:36:53 GMT
Connection: close

When I try a different host (this time apache on Linux), check_http
succeeds, and trying with OpenSSL gives a much shorter communication
trail:
GET / HTTP/1.0
User-Agent: check_http/1.91 (nagios-plugins 1.4.3)
Host: host.name.example

HTTP/1.1 302 Found
Date: Fri, 03 Nov 2006 12:23:29 GMT
Server: Apache/2.0.54 (Debian GNU/Linux) PHP/4.3.10-16 mod_ssl/2.0.54 OpenSSL/0.9.7e
Location: https://host.name.example/default/
Content-Length: 358
Connection: close
Content-Type: text/html; charset=iso-8859-1

This looks to me that the IIS sends its certificate again after the
request, which seems to confuse check_http.

What can I do to find out what goes wrong when I use the check_http
plugin?

Greetings
Marc

-- System Information:
Debian Release: 4.0
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18.1-scyw00225
Locale: LANG=C, LC_CTYPE=de_DE (charmap=ISO-8859-1)

Versions of packages nagios-plugins-basic depends on:
ii  iputils-ping              3:20020927-3.1 Tools to test the reachability of
ii  libc6                     2.3.6.ds1-7    GNU C Library: Shared libraries
ii  libssl0.9.8               0.9.8c-3       SSL shared libraries
ii  procps                    1:3.2.7-3      /proc file system utilities

nagios-plugins-basic recommends no packages.

-- no debconf information