[Q&A] Two diffrent fingerprints for different https adress.

[smurdza]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Hi,

I have a question.
Is it possible configure two different fingerprint for dwo different destination glpi server adres for htttps.

I have two servers glpi with they have two different domain.

How, Can I configured two different fingerprins ?

example case :

serwer = https://glpi.asdf.pl, https://glpi.qwert.pl
ssl-fingerprint = 'dkjfjfddkklss' , 'fkoewsnsis' ????

[g-bougard]

Hello @smurdza
this is a good question.
Actually, I think this is not possible, but looking at IO::Socket::SSL SSL_fingerprint documentation, I guess I can make a little change to support such kind of list.
Anyway, you also can use the same certificate on the 2 servers as ssl-fingerprint is made to bypass other normal checking like hostname.
Or you can also manage to have one of them signed by a public CA.

[g-bougard]

Hi @smurdza

anyway, next nightly will support ssl-fingerprint as comma-separated list. See: 283f86b

[smurdza]

@g-bougard
Super, thank you :)

[smurdza]

@g-bougard
I copy CA cert (PEM) to ca-cert-dir
And I think that property doesn't work :
[info] sending prolog request to server0
[error] [http client] internal response: 500 Can't connect to glpi.xyz.pl:443, IO::Socket::IP configuration failed error:140E0197:SSL routines:SSL_shutdown:shutdown while in init
[error] No answer from server at https://glpi.xyz.pl/marketplace/glpiinventory/

[g-bougard]

Hi @smurdza
be careful about ca-cert-dir folder, just copying PEM file is not sufficient, they must have a specific name in that folder. Check the CA_CERT_DIR=pathname section in that documentation: https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html#command-line-parameters

[smurdza]

Ok, Its works. 👍