Re: Error finding server identity keys
David R Anderson <[email protected]> Mon, 16 Dec 2024 10:14:50 +1300
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <CAKu11d0rYUrEOJPctGwAnN6scudgBur+37PhEFXOWG_nNj8f1g@mail.gmail.com> |
--===============9000280382943239768== Content-Type: multipart/alternative; boundary="0000000000008d05970629558ed5" --0000000000008d05970629558ed5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I found a solution for "error finding server identity keys" 1. Looking at debug output showed the certificates were being searched for in /usr/local/share/snmp/tls 2. By supplying a file path [snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt I was doing nothing other than supplying the same thing again - It needed to be the fingerprint. Which I only had in my comments. 3. Debug also showed that the default port was 10161 not 1161 which I had found in the Ubuntu man pages. Although this was not the reason for "error finding server identity keys". Here is a set of instructions for a successful configuration of SNMP over TLS/TCP that users may find useful. SNMP v3 Using TLS over TCP - Instructions for testing localhost connection client/server on 127.0.0.1 using Linux Subsystem for Windows, VM, or single native-linux machine to confirm successful configuration/operation of secure SNMP communication which may be mandatory on some networks. This uses only a basic snmpd.conf configuration, with no accompanying snmp.conf file, together with the most basic of command line client requests. Only available for Unix based platforms like Linux (no Windows unless running VM or WSL) When you have compiled source code with OpenSSL support (not covered here) you should be able to verify your build like: In my case: $ net-snmp-config --version 5.9.4 $ net-snmp-config --config-options '--with-security-modules=3Dtsm' '--with-transports=3DTLSTCP,DTLSUDP' '--with-mib-modules=3Dtsm-mib' Create your own certificate authority certificate & use it to sign your server/client certificates using net-snmp-cert utility supplied by net-snmp. Steps: certificate authority certificate & key > certificate signing requests for snmpd & manager > signing of snmpd & manager certificates. net-snmp-cert genca -I -n ca.snmp.dev CA Generated: ca-certs/ca.snmp.dev.crt private/ca.snmp.dev.key ~/.snmp$ net-snmp-cert gencsr -I -t snmpd -n snmp.dev Certificate Signing Request Generated: newcerts/snmpd.csr private/snmpd.key ~/.snmp$ net-snmp-cert gencsr -I -t manager -n danderson Certificate Signing Request Generated: newcerts/manager.csr private/manager.key :~/.snmp$ net-snmp-cert signcsr -I --with-ca ca.snmp.dev --csr snmpd Signed Certificate Signing Request: newcerts/snmpd.csr with CA: ca-certs/ca.snmp.dev.crt private/ca.snmp.dev.key Generated Certificate: newcerts/snmpd.crt ~/.snmp$ net-snmp-cert signcsr -I --with-ca ca.snmp.dev --csr manager Signed Certificate Signing Request: newcerts/manager.csr with CA: ca-certs/ca.snmp.dev.crt private/ca.snmp.dev.key Generated Certificate: newcerts/manager.crt Copy tls directory with certificates to default file location /usr/local/share/snmp Server/Client fingerprints (manager/peer) manager =3D 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 snmpd =3D 70:3E:91:F9:2D:E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2D Config file snmpd.conf - minimum lines required Step 1: Testing the server snmpd with just these two lines agentaddress tlstcp:127.0.0.1:10161 [snmp] localCert 70:3E:91:F9:2D:E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2= D Start Server with TLS Debug sudo /usr/local/sbin/snmpd -f -Lo -Dtls -C -c snmpd.conf Output registered debug token tls, 1 tlstcp: registering TLS constructor tlstcp: listening on tlstcp port 127.0.0.1:10161 NET-SNMP version 5.9.4 Step 2: Add manager details into snmpd.conf in order to use the TLS connection certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --sn danderson rwuser -s tsm danderson auth rwuser danderson auth system syscontact david@xxxxxxxxxx # Add in some information we will transfer from server to client Start snmpd server in a Linux terminal in the same directory as snmpd.conf Run the following in another terminal from any directory (no snmp.conf file yet) With debugging -D of tls optional e.g. -Dtls sudo snmpget -v 3 --defSecurityModel=3Dtsm -u manager \ -l authPriv -T localCert=3D4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 \ -T peerCert=3D70:3E:91:F9:2D:E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2D -Dtls \ tlstcp:127.0.0.1:10161 sysContact.0 Result NMPv2-MIB::sysContact.0 =3D STRING: david@xxxxxxxxxxx Not much output. In this case, just a line from snmpd.conf transferred from server to client. But it proves the SNMP over TLS/TCP has been successful. This should now work for more useful exercises using snmpget/snmpwalk etc. Debugging options (when things predictably don=E2=80=99t go to plan) Checking the server is listening Command: sudo netstat -tlnp | grep 10161 For checking the output for tls, certs information use -Dtls or -DCerts When things got tough I found -D9 useful See: https://net-snmp.sourceforge.io/wiki/index.php/Debug_tokens References that I found helpful Quick setup of SNMP v3 DTLS/TLS access in CentOS/RHEL 7 Linux - net-snmp <https://www.youtube.com/watch?v=3DBTEFwYbGJ-8> https://net-snmp.sourceforge.io/wiki/index.php/TUT:Using_TLS On Fri, Dec 13, 2024 at 11:09=E2=80=AFAM David R Anderson <david@mranderson= .co.nz> wrote: > NET-SNMP version: 5.9.4 > net-snmp-config --config-options > '--with-security-modules=3Dtsm' '--with-transports=3DTLSTCP,DTLSUDP' > '--with-mib-modules=3Dtsm-mib' > > OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.4.0 22 Oct 2024) > > OS > Welcome to Ubuntu 24.04.1 LTS (GNU/Linux > 5.15.167.4-microsoft-standard-WSL2 x86_64) > > Relevant config lines snmpd.conf - No snmp.conf used > agentaddress tlstcp:1161 > > # certificate local defines the default X.509 public key to use as the > server's identity (man pgs Ubuntu snmpd.conf) > [snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt > > # certificate common name danderson e.g CN =3D danderson > # /usr/local/share/snmp/tls/certs/manager.crt: SHA1 > Fingerprint=3D4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 > certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:9= 8 > --cn > > # SNMP v3 user. Security model -s > rwuser -s tsm danderson auth > > Output from snmpd using: sudo /usr/local/sbin/snmpd -f -Lo -Dcert -C -c > snmpd.conf > ---->snip<--- > cert:dump: ------------------------ End ---------------------- > cert:util:config: parsing 10 > 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn > cert:find:params: looking for remote_peer(2) in MULTIPLE(0x200), hint > 0x7ffd493e92d0 > cert:find:params: looking for remote_peer(2) in FINGERPRINT(0x2), hint > 0x7ffd493e92d0 > cert:find:params: hint =3D > 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 > cert:find:found: using cert manager.crt / > 4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) > (uses=3Didentity+remote_peer (3)) > cert:find:found: using cert manager.crt / > 4adb1f38c859e90958dfcc4a5f30394a53fb3198 for remote_peer(2) > (uses=3Didentity+remote_peer (3)) > cert:map:add: pri 10, fp 4adb1f38c859e90958dfcc4a5f30394a53fb3198 > cert:find:params: looking for identity(1) in DEFAULT(0x0), hint (nil) > cert:find:params: looking for identity(1) in MULTIPLE(0x200), hint > 0x5573fdf68c60 > cert:find:params: looking for identity(1) in FINGERPRINT(0x2), hint > 0x5573fdf68c60 > cert:find:params: hint =3D /usr/local/share/snmp/tls/certs/snmpd.crt > cert:find:params: looking for identity(1) in FILE(0x1), hint 0x5573fdf68c= 60 > cert:find:params: hint =3D /usr/local/share/snmp/tls/certs/snmpd.crt > error finding server identity keys > > I have tested the certificates/keys using: > sudo openssl s_server -cert /usr/local/share/snmp/tls/certs/snmpd.crt -ke= y > /usr/local/share/snmp/tls/private/snmpd.key -CAfile > /usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt -accept 1161 -tls1_2 > -www > > sudo openssl s_client -connect 127.0.0.1:1161 -tls1_2 -CAfile > /usr/local/share/snmp/tls/ca-certs/ca.snmp.dev.crt -cert > /usr/local/share/snmp/tls/certs/manager.crt -key > /usr/local/share/snmp/tls/private/manager.key > > All good with the certificates generated using *net-snmp-cert* > > This error appears a number of times in the net-snmp mailing list archive= s > - without any obvious explanation or fix. If this is a: "well you're not > running on a native Linux machine" problem then it would be really helpfu= l > to have it fixed. Since Linux is being run more often than ever on Window= s > machines. > > I have found the code references and could possibly recompile with > additional debug lines. But I was hoping someone may have an easier > solution. > > Regards > David Anderson > > --0000000000008d05970629558ed5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div><span id=3D"gmail-docs-internal-guid-54a15f23-7fff-a3= fa-c6a3-73f724138b4b"><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0= pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-= serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:no= rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical= -align:baseline">I found a solution for "error finding server identity= keys"</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0= pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-= serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:no= rmal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical= -align:baseline">1. Looking at debug output showed the certificates were be= ing searched for in /usr/local/share/snmp/tls=C2=A0</span></p><p dir=3D"ltr= " style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style= =3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background= -color:transparent;font-variant-numeric:normal;font-variant-east-asian:norm= al;font-variant-alternates:normal;vertical-align:baseline">2. By supplying = a file path [snmp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt I wa= s doing nothing other than supplying the same thing again - It needed to be= the fingerprint. Which I only had in my comments.</span></p><p dir=3D"ltr"= style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D= "font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-co= lor:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;= font-variant-alternates:normal;vertical-align:baseline">3. Debug also showe= d that the default port was 10161 not 1161 which I had found in the Ubuntu = man pages. Although this was not the reason for "error finding server = identity keys".</span></p><br><p dir=3D"ltr" style=3D"line-height:1.38= ;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-famil= y:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-varia= nt-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:no= rmal;vertical-align:baseline">Here is a set of instructions for a successfu= l configuration of SNMP over TLS/TCP that users may find useful.</span></p>= </span><br class=3D"gmail-Apple-interchange-newline"></div><div><span id=3D= "gmail-docs-internal-guid-4cd27bdf-7fff-de01-e35b-23d6e515e450"><p dir=3D"l= tr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style= =3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background= -color:transparent;font-variant-numeric:normal;font-variant-east-asian:norm= al;font-variant-alternates:normal;vertical-align:baseline">SNMP v3 Using TL= S over TCP - Instructions for testing localhost connection client/server on= 127.0.0.1 using Linux Subsystem for Windows, VM, or single native-linux ma= chine to confirm successful configuration/operation of secure SNMP communic= ation which may be mandatory on some networks.=C2=A0</span></p><br><p dir= =3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span = style=3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);backg= round-color:transparent;font-variant-numeric:normal;font-variant-east-asian= :normal;font-variant-alternates:normal;vertical-align:baseline">This uses o= nly a basic snmpd.conf configuration, with no accompanying snmp.conf file, = together with the most basic of command line client requests.</span></p><br= ><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"= ><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0= );background-color:transparent;font-variant-numeric:normal;font-variant-eas= t-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Only= available for Unix based platforms like Linux (no Windows unless running V= M or WSL) When you have compiled source code with OpenSSL support (not cove= red here) you should be able to verify your build like:</span></p><br><p di= r=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span= style=3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);back= ground-color:transparent;font-variant-numeric:normal;font-variant-east-asia= n:normal;font-variant-alternates:normal;vertical-align:baseline">In my case= :=C2=A0</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;m= argin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-seri= f;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal= ;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali= gn:baseline">$ net-snmp-config --version</span></p><p dir=3D"ltr" style=3D"= line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size= :12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transp= arent;font-variant-numeric:normal;font-variant-east-asian:normal;font-varia= nt-alternates:normal;vertical-align:baseline">5.9.4</span></p><p dir=3D"ltr= " style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style= =3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background= -color:transparent;font-variant-numeric:normal;font-variant-east-asian:norm= al;font-variant-alternates:normal;vertical-align:baseline">$ net-snmp-confi= g --config-options</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margi= n-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Aria= l,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-num= eric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;v= ertical-align:baseline">=C2=A0'--with-security-modules=3Dtsm' '= --with-transports=3DTLSTCP,DTLSUDP' '--with-mib-modules=3Dtsm-mib&#= 39;</span></p><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;m= argin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-seri= f;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal= ;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali= gn:baseline">Create your own certificate authority certificate & use it= to sign your server/client certificates using net-snmp-cert utility suppli= ed by net-snmp. Steps: certificate authority certificate & key > cer= tificate signing requests for snmpd & manager > signing of snmpd &am= p; manager certificates.</span></p><br><p dir=3D"ltr" style=3D"line-height:= 1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-f= amily:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);f= ont-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alte= rnates:normal;vertical-align:baseline">net-snmp-cert genca -I -n=C2=A0 <a h= ref=3D"http://ca.snmp.dev">ca.snmp.dev</a></span></p><p dir=3D"ltr" style= =3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-= size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rg= b(207,226,243);font-variant-numeric:normal;font-variant-east-asian:normal;f= ont-variant-alternates:normal;vertical-align:baseline">CA Generated:</span>= </p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0= pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,= 0,0);background-color:rgb(207,226,243);font-variant-numeric:normal;font-var= iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli= ne">=C2=A0=C2=A0ca-certs/ca.snmp.dev.crt</span></p><p dir=3D"ltr" style=3D"= line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size= :10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(20= 7,226,243);font-variant-numeric:normal;font-variant-east-asian:normal;font-= variant-alternates:normal;vertical-align:baseline">=C2=A0=C2=A0private/ca.s= nmp.dev.key</span></p><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-t= op:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,s= ans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-n= umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal= ;vertical-align:baseline">~/.snmp$ net-snmp-cert gencsr -I -t snmpd -n <a h= ref=3D"http://snmp.dev">snmp.dev</a></span></p><p dir=3D"ltr" style=3D"line= -height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10p= t;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,22= 6,243);font-variant-numeric:normal;font-variant-east-asian:normal;font-vari= ant-alternates:normal;vertical-align:baseline">Certificate Signing Request = Generated:</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0p= t;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-s= erif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-numeri= c:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vert= ical-align:baseline">=C2=A0=C2=A0newcerts/snmpd.csr</span></p><p dir=3D"ltr= " style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style= =3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background= -color:rgb(207,226,243);font-variant-numeric:normal;font-variant-east-asian= :normal;font-variant-alternates:normal;vertical-align:baseline">=C2=A0=C2= =A0private/snmpd.key</span></p><br><p dir=3D"ltr" style=3D"line-height:1.38= ;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-famil= y:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-= variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternat= es:normal;vertical-align:baseline">~/.snmp$ net-snmp-cert gencsr -I -t mana= ger -n danderson</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-= top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,= sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-= numeric:normal;font-variant-east-asian:normal;font-variant-alternates:norma= l;vertical-align:baseline">Certificate Signing Request Generated:</span></p= ><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"= ><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0= );background-color:rgb(207,226,243);font-variant-numeric:normal;font-varian= t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"= >=C2=A0=C2=A0newcerts/manager.csr</span></p><p dir=3D"ltr" style=3D"line-he= ight:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;f= ont-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,2= 43);font-variant-numeric:normal;font-variant-east-asian:normal;font-variant= -alternates:normal;vertical-align:baseline">=C2=A0=C2=A0private/manager.key= </span></p><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;marg= in-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;c= olor:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-numeric:norm= al;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-a= lign:baseline">:~/.snmp$ net-snmp-cert signcsr -I --with-ca <a href=3D"http= ://ca.snmp.dev">ca.snmp.dev</a> --csr snmpd</span></p><p dir=3D"ltr" style= =3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-= size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rg= b(207,226,243);font-variant-numeric:normal;font-variant-east-asian:normal;f= ont-variant-alternates:normal;vertical-align:baseline">Signed Certificate S= igning Request:</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-t= op:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,s= ans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-n= umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal= ;vertical-align:baseline">=C2=A0=C2=A0newcerts/snmpd.csr</span></p><p dir= =3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span = style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);backg= round-color:rgb(207,226,243);font-variant-numeric:normal;font-variant-east-= asian:normal;font-variant-alternates:normal;vertical-align:baseline">with C= A:</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin= -bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;col= or:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-numeric:normal= ;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-ali= gn:baseline">=C2=A0=C2=A0ca-certs/ca.snmp.dev.crt</span></p><p dir=3D"ltr" = style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"= font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-col= or:rgb(207,226,243);font-variant-numeric:normal;font-variant-east-asian:nor= mal;font-variant-alternates:normal;vertical-align:baseline">=C2=A0=C2=A0pri= vate/ca.snmp.dev.key</span></p><p dir=3D"ltr" style=3D"line-height:1.38;mar= gin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family:Ar= ial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-vari= ant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:n= ormal;vertical-align:baseline">Generated Certificate:</span></p><p dir=3D"l= tr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style= =3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background= -color:rgb(207,226,243);font-variant-numeric:normal;font-variant-east-asian= :normal;font-variant-alternates:normal;vertical-align:baseline">=C2=A0=C2= =A0newcerts/snmpd.crt</span></p><br><p dir=3D"ltr" style=3D"line-height:1.3= 8;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-fami= ly:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);font= -variant-numeric:normal;font-variant-east-asian:normal;font-variant-alterna= tes:normal;vertical-align:baseline">~/.snmp$ net-snmp-cert signcsr -I --wit= h-ca <a href=3D"http://ca.snmp.dev">ca.snmp.dev</a> --csr manager</span></p= ><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"= ><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0= );background-color:rgb(207,226,243);font-variant-numeric:normal;font-varian= t-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"= >Signed Certificate Signing Request:</span></p><p dir=3D"ltr" style=3D"line= -height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10p= t;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,22= 6,243);font-variant-numeric:normal;font-variant-east-asian:normal;font-vari= ant-alternates:normal;vertical-align:baseline">=C2=A0=C2=A0newcerts/manager= .csr</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;marg= in-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;c= olor:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-numeric:norm= al;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-a= lign:baseline">with CA:</span></p><p dir=3D"ltr" style=3D"line-height:1.38;= margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family= :Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-v= ariant-numeric:normal;font-variant-east-asian:normal;font-variant-alternate= s:normal;vertical-align:baseline">=C2=A0=C2=A0ca-certs/ca.snmp.dev.crt</spa= n></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom= :0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(= 0,0,0);background-color:rgb(207,226,243);font-variant-numeric:normal;font-v= ariant-east-asian:normal;font-variant-alternates:normal;vertical-align:base= line">=C2=A0=C2=A0private/ca.snmp.dev.key</span></p><p dir=3D"ltr" style=3D= "line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-siz= e:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(2= 07,226,243);font-variant-numeric:normal;font-variant-east-asian:normal;font= -variant-alternates:normal;vertical-align:baseline">Generated Certificate:<= /span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bo= ttom:0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:= rgb(0,0,0);background-color:rgb(207,226,243);font-variant-numeric:normal;fo= nt-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:= baseline">=C2=A0=C2=A0newcerts/manager.crt</span></p><br><p dir=3D"ltr" sty= le=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"fon= t-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:= transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font= -variant-alternates:normal;vertical-align:baseline">Copy tls directory with= certificates to default file location</span></p><p dir=3D"ltr" style=3D"li= ne-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:1= 2pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transpar= ent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant= -alternates:normal;vertical-align:baseline">/usr/local/share/snmp</span></p= ><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:= 0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0= ,0,0);background-color:transparent;font-variant-numeric:normal;font-variant= -east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">= Server/Client fingerprints (manager/peer)</span></p><p dir=3D"ltr" style=3D= "line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-siz= e:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:trans= parent;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari= ant-alternates:normal;vertical-align:baseline">manager =3D 4A:DB:1F:38:C8:5= 9:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98</span></p><p dir=3D"ltr" style= =3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-= size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:tr= ansparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-v= ariant-alternates:normal;vertical-align:baseline">snmpd =3D 70:3E:91:F9:2D:= E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2D</span></p><br><p dir=3D"ltr" s= tyle=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"f= ont-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-colo= r:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;fo= nt-variant-alternates:normal;vertical-align:baseline">Config file snmpd.con= f - minimum lines required</span></p><p dir=3D"ltr" style=3D"line-height:1.= 38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-fam= ily:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-var= iant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:= normal;vertical-align:baseline">Step 1: Testing the server snmpd with just = these two lines</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-t= op:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,s= ans-serif;color:rgb(0,0,0);background-color:rgb(217,234,211);font-variant-n= umeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal= ;vertical-align:baseline">agentaddress tlstcp:<a href=3D"http://127.0.0.1:1= 0161">127.0.0.1:10161</a></span></p><p dir=3D"ltr" style=3D"line-height:1.3= 8;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-fami= ly:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(217,234,211);font= -variant-numeric:normal;font-variant-east-asian:normal;font-variant-alterna= tes:normal;vertical-align:baseline">[snmp] localCert 70:3E:91:F9:2D:E9:16:0= 5:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2D</span></p><br><p dir=3D"ltr" style=3D= "line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-siz= e:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:trans= parent;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari= ant-alternates:normal;vertical-align:baseline">Start Server with TLS Debug<= /span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bo= ttom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color:= rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-va= riant-east-asian:normal;font-variant-alternates:normal;vertical-align:basel= ine">sudo /usr/local/sbin/snmpd -f -Lo -Dtls -C -c snmpd.conf</span></p><br= ><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"= ><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0= );background-color:transparent;font-variant-numeric:normal;font-variant-eas= t-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Outp= ut</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin= -bottom:0pt"><span style=3D"font-size:9pt;font-family:Arial,sans-serif;colo= r:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-numeric:normal;= font-variant-east-asian:normal;font-variant-alternates:normal;vertical-alig= n:baseline">registered debug token tls, 1</span></p><p dir=3D"ltr" style=3D= "line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-siz= e:9pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(20= 7,226,243);font-variant-numeric:normal;font-variant-east-asian:normal;font-= variant-alternates:normal;vertical-align:baseline">tlstcp: registering TLS = constructor</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0= pt;margin-bottom:0pt"><span style=3D"font-size:9pt;font-family:Arial,sans-s= erif;color:rgb(0,0,0);background-color:rgb(207,226,243);font-variant-numeri= c:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vert= ical-align:baseline">tlstcp: listening on tlstcp port <a href=3D"http://127= .0.0.1:10161">127.0.0.1:10161</a></span></p><p dir=3D"ltr" style=3D"line-he= ight:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:9pt;fo= nt-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(207,226,24= 3);font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-= alternates:normal;vertical-align:baseline">NET-SNMP version 5.9.4</span></p= ><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:= 0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0= ,0,0);background-color:transparent;font-variant-numeric:normal;font-variant= -east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">= Step 2: Add manager details into snmpd.conf in order to use the TLS connect= ion</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margi= n-bottom:0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;co= lor:rgb(0,0,0);background-color:rgb(217,234,211);font-variant-numeric:norma= l;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-al= ign:baseline">certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4= A:53:FB:31:98 --sn danderson</span></p><p dir=3D"ltr" style=3D"line-height:= 1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10pt;font-f= amily:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(217,234,211);f= ont-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alte= rnates:normal;vertical-align:baseline">rwuser -s tsm danderson auth</span><= /p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0p= t"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0= ,0);background-color:rgb(217,234,211);font-variant-numeric:normal;font-vari= ant-east-asian:normal;font-variant-alternates:normal;vertical-align:baselin= e">rwuser=C2=A0 danderson auth system</span></p><p dir=3D"ltr" style=3D"lin= e-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:10= pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:rgb(217,2= 34,211);font-variant-numeric:normal;font-variant-east-asian:normal;font-var= iant-alternates:normal;vertical-align:baseline">syscontact=C2=A0 david@xxxx= xxxxxx # Add in some information we will transfer from server to client</sp= an></p><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-b= ottom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color= :rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-v= ariant-east-asian:normal;font-variant-alternates:normal;vertical-align:base= line">Start snmpd server in a Linux terminal in the same directory as snmpd= .conf</span></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;mar= gin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-serif;= color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;f= ont-variant-east-asian:normal;font-variant-alternates:normal;vertical-align= :baseline">Run the following in another terminal from any directory (no snm= p.conf file yet) With debugging -D of tls optional e.g. -Dtls=C2=A0</span><= /p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0p= t"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0= ,0);background-color:transparent;font-variant-numeric:normal;font-variant-e= ast-asian:normal;font-variant-alternates:normal;vertical-align:baseline">su= do snmpget -v 3 --defSecurityModel=3Dtsm -u manager \</span></p><p dir=3D"l= tr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style= =3D"font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background= -color:transparent;font-variant-numeric:normal;font-variant-east-asian:norm= al;font-variant-alternates:normal;vertical-align:baseline">-l authPriv -T l= ocalCert=3D4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 \</s= pan></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bott= om:0pt"><span style=3D"font-size:10pt;font-family:Arial,sans-serif;color:rg= b(0,0,0);background-color:transparent;font-variant-numeric:normal;font-vari= ant-east-asian:normal;font-variant-alternates:normal;vertical-align:baselin= e">-T peerCert=3D70:3E:91:F9:2D:E9:16:05:F8:6F:D0:A3:BD:85:1D:CC:45:7D:56:2= D -Dtls \ tlstcp:<a href=3D"http://127.0.0.1:10161">127.0.0.1:10161</a> sys= Contact.0</span></p><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top= :0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Arial,san= s-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:= normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertic= al-align:baseline">Result=C2=A0</span></p><p dir=3D"ltr" style=3D"line-heig= ht:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;fon= t-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;fon= t-variant-numeric:normal;font-variant-east-asian:normal;font-variant-altern= ates:normal;vertical-align:baseline">NMPv2-MIB::sysContact.0 =3D STRING: da= vid@xxxxxxxxxxx</span></p><br><p dir=3D"ltr" style=3D"line-height:1.38;marg= in-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-family:Ari= al,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-nu= meric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;= vertical-align:baseline">Not much output. In this case, just a line from sn= mpd.conf transferred from server to client. But it proves the SNMP over TLS= /TCP has been successful. This should now work for more useful exercises us= ing snmpget/snmpwalk etc.</span></p><br><p dir=3D"ltr" style=3D"line-height= :1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-= family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-= variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternat= es:normal;vertical-align:baseline">Debugging options (when things predictab= ly don=E2=80=99t go to plan)</span></p><p dir=3D"ltr" style=3D"line-height:= 1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-f= amily:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-v= ariant-numeric:normal;font-variant-east-asian:normal;font-variant-alternate= s:normal;vertical-align:baseline">Checking the server is listening</span></= p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt= "><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,= 0);background-color:transparent;font-variant-numeric:normal;font-variant-ea= st-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Com= mand: sudo netstat -tlnp | grep 10161</span></p><br><p dir=3D"ltr" style=3D= "line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-siz= e:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:trans= parent;font-variant-numeric:normal;font-variant-east-asian:normal;font-vari= ant-alternates:normal;vertical-align:baseline">For checking the output for = tls, certs information use -Dtls or -DCerts</span></p><p dir=3D"ltr" style= =3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"font-= size:12pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:tr= ansparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-v= ariant-alternates:normal;vertical-align:baseline">When things got tough I f= ound -D9 useful=C2=A0</span></p><p dir=3D"ltr" style=3D"line-height:1.38;ma= rgin-top:0pt;margin-bottom:0pt"><span style=3D"font-size:12pt;font-family:A= rial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-= numeric:normal;font-variant-east-asian:normal;font-variant-alternates:norma= l;vertical-align:baseline">See: </span><a href=3D"https://net-snmp.sourcefo= rge.io/wiki/index.php/Debug_tokens" style=3D"text-decoration-line:none"><sp= an style=3D"font-size:12pt;font-family:Arial,sans-serif;background-color:tr= ansparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-v= ariant-alternates:normal;text-decoration-line:underline;vertical-align:base= line">https://net-snmp.sourceforge.io/wiki/index.php/Debug_tokens</span></a= ></p><br><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-bot= tom:0pt"><span style=3D"font-size:12pt;font-family:Arial,sans-serif;color:r= gb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-var= iant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseli= ne">References that I found helpful</span></p><p dir=3D"ltr" style=3D"line-= height:1.38;margin-top:0pt;margin-bottom:0pt"><a href=3D"https://www.youtub= e.com/watch?v=3DBTEFwYbGJ-8" style=3D"text-decoration-line:none"><span styl= e=3D"font-size:12pt;font-family:Arial,sans-serif;background-color:transpare= nt;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-= alternates:normal;text-decoration-line:underline;vertical-align:baseline">Q= uick setup of SNMP v3 DTLS/TLS access in CentOS/RHEL 7 Linux - net-snmp</sp= an></a></p><p dir=3D"ltr" style=3D"line-height:1.38;margin-top:0pt;margin-b= ottom:0pt"><a href=3D"https://net-snmp.sourceforge.io/wiki/index.php/TUT:Us= ing_TLS" style=3D"text-decoration-line:none"><span style=3D"font-size:12pt;= font-family:Arial,sans-serif;background-color:transparent;font-variant-nume= ric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;te= xt-decoration-line:underline;vertical-align:baseline">https://net-snmp.sour= ceforge.io/wiki/index.php/TUT:Using_TLS</span></a></p></span><br class=3D"g= mail-Apple-interchange-newline"></div><div><br></div></div><br><div class= =3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr= ">On Fri, Dec 13, 2024 at 11:09=E2=80=AFAM David R Anderson <<a href=3D"= mailto:[email protected]">[email protected]</a>> wrote:<br></d= iv><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bord= er-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">NET-S= NMP version: 5.9.4<div>=C2=A0net-snmp-config --config-options<br>=C2=A0'= ;--with-security-modules=3Dtsm' '--with-transports=3DTLSTCP,DTLSUDP= ' '--with-mib-modules=3Dtsm-mib'</div><div><br></div><div>OpenS= SL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.4.0 22 Oct 2024)<br><div><br></di= v></div><div>OS</div><div>Welcome to Ubuntu 24.04.1 LTS (GNU/Linux 5.15.167= .4-microsoft-standard-WSL2 x86_64)</div><div><br></div><div>Relevant config= lines snmpd.conf - No snmp.conf used</div><div>agentaddress tlstcp:1161<br= ><br># certificate local defines the default X.509 public key to use as =C2= =A0the =C2=A0server's =C2=A0identity (man pgs Ubuntu snmpd.conf)<br>[sn= mp] localCert /usr/local/share/snmp/tls/certs/snmpd.crt<br><br># certificat= e common name danderson e.g CN =3D danderson<br># /usr/local/share/snmp/tls= /certs/manager.crt: SHA1 Fingerprint=3D4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:= 5F:30:39:4A:53:FB:31:98<br>certSecName 10 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:= 4A:5F:30:39:4A:53:FB:31:98 --cn<br><br># SNMP v3 user. Security model -s<br= >rwuser -s tsm danderson auth</div><div><br></div><div>Output from snmpd us= ing:=C2=A0sudo /usr/local/sbin/snmpd -f -Lo -Dcert -C -c snmpd.conf</div><d= iv>---->snip<---</div><div>cert:dump: ------------------------ End --= --------------------<br>cert:util:config: parsing 10 4A:DB:1F:38:C8:59:E9:0= 9:58:DF:CC:4A:5F:30:39:4A:53:FB:31:98 --cn<br>cert:find:params: looking for= remote_peer(2) in MULTIPLE(0x200), hint 0x7ffd493e92d0<br>cert:find:params= : looking for remote_peer(2) in FINGERPRINT(0x2), hint 0x7ffd493e92d0<br>ce= rt:find:params: =C2=A0hint =3D 4A:DB:1F:38:C8:59:E9:09:58:DF:CC:4A:5F:30:39= :4A:53:FB:31:98<br>cert:find:found: using cert manager.crt / 4adb1f38c859e9= 0958dfcc4a5f30394a53fb3198 for remote_peer(2) (uses=3Didentity+remote_peer = (3))<br>cert:find:found: using cert manager.crt / 4adb1f38c859e90958dfcc4a5= f30394a53fb3198 for remote_peer(2) (uses=3Didentity+remote_peer (3))<br>cer= t:map:add: pri 10, fp 4adb1f38c859e90958dfcc4a5f30394a53fb3198<br>cert:find= :params: looking for identity(1) in DEFAULT(0x0), hint (nil)<br>cert:find:p= arams: looking for identity(1) in MULTIPLE(0x200), hint 0x5573fdf68c60<br>c= ert:find:params: looking for identity(1) in FINGERPRINT(0x2), hint 0x5573fd= f68c60<br>cert:find:params: =C2=A0hint =3D /usr/local/share/snmp/tls/certs/= snmpd.crt<br>cert:find:params: looking for identity(1) in FILE(0x1), hint 0= x5573fdf68c60<br>cert:find:params: =C2=A0hint =3D /usr/local/share/snmp/tls= /certs/snmpd.crt<br>error finding server identity keys</div><div><br></div>= <div>I have tested the certificates/keys using:</div><div>sudo openssl s_se= rver -cert /usr/local/share/snmp/tls/certs/snmpd.crt -key /usr/local/share/= snmp/tls/private/snmpd.key -CAfile /usr/local/share/snmp/tls/ca-certs/ca.sn= mp.dev.crt =C2=A0 -accept 1161 -tls1_2 -www</div><div><br></div><div>sudo o= penssl s_client -connect <a href=3D"http://127.0.0.1:1161" target=3D"_blank= ">127.0.0.1:1161</a> -tls1_2 -CAfile /usr/local/share/snmp/tls/ca-certs/ca.= snmp.dev.crt -cert /usr/local/share/snmp/tls/certs/manager.crt -key /usr/lo= cal/share/snmp/tls/private/manager.key</div><div><br></div><div>All good wi= th the certificates generated using <b>net-snmp-cert</b>=C2=A0</div><div><b= r></div><div>This error appears a number of times in the net-snmp mailing l= ist archives - without any obvious explanation or fix. If this is a: "= well you're not running on a native Linux machine" problem then it= would be really helpful to have it fixed. Since Linux is being run more of= ten than ever on Windows machines.</div><div><br></div><div>I have found th= e code references and could possibly recompile with additional debug lines.= But I was hoping someone may have an easier solution.</div><div><br></div>= <div>Regards</div><div>David Anderson</div><div><br></div></div> </blockquote></div> --0000000000008d05970629558ed5-- --===============9000280382943239768== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============9000280382943239768== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users --===============9000280382943239768==--