Re: OpenNMS HTTPS Monitor & IIS Rejecting connections

Hi Joe,

     I'm no IIS expert, but TLS/SSL can only be established using 
recognised names, so you'd typically not have an SSL certificate for the 
host's IP address unless you know that it's static and have issued the 
certificate to include the IP as one of the alternative names on the 
cert... Just maybe that's what's bothering curl??
Other thing to consider is Windows Firewall - I believe you could 
configure it to only allow requests to the hostname through. I'm 
assuming you've already checked that joe.test.co.uk definitely always 
resolves to the same IP Address as you're testing, and that you've done 
the curl tests from the OpenNMS host.

Regarding the monitor - From the stack, it looks to me like you're using 
HttpMonitor rather than HttpsMonitor which could be an issue (although 
it also looks from the stack like it's attempting to establish an SSL 
connection anyway).. Perhaps it's worth changing the class to the 
HttpsMonitor to see if that helps.
I'd also remove the leading and trailing spaces from the host-name value 
in case that's causing odd behaviour.

With my recent experiencing of trying to reload pollerd config 
on-the-fly, I'd not trust that such changes as above will actually take 
effect until OpenNMS is restarted.

I hope these ideas are useful in determining the cause of your problem.

Regards
Jonathan

On 21/08/17 13:21, Madden, Joe wrote:
>
> Hi all,
>
> The latest version of IIS seems to be giving me some headache on 
> monitoring using OpenNMS.
>
> Our IIS runs three web services using server name indication. Each one 
> is a TLS website on port 443.
>
> Our webserver will respond with this:
>
> https://joe.test.co.uk/login.asp
>
> HTTP request sent, awaiting response... 200 OK
>
> Length: 2591 (2.5K) [text/html]
>
> Saving to: ‘login.asp’
>
> but will not respond with this
>
> https://192.168.201.30/login.asp
>
> Connecting to 192.168.201.30:443... connected.
>
> Unable to establish SSL connection.
>
> curl -1 https://192.168.201.30/login.asp
>
> curl: (35) TCP connection reset by peer
>
> It seems that IIS rejects the connection when attempted to connect to 
> via IP address. Does anyone have any what setting I need to change to 
> permit it to connect via IP (And then use the SNI to check which 
> server it actually services up)
>
> The server I have setup is below – and it gets the java connection 
> error message as below. I guess it falls into the same issue.
>
>   <service name="CAB - TssPlansRegistry" interval="60000" 
> user-defined="false" status="on">
>
>          <parameter key="host-name" value=" joe.test.co.uk "/>
>
>          <parameter key="retry" value="3"/>
>
>          <parameter key="timeout" value="5000"/>
>
>          <parameter key="port" value="443"/>
>
>          <parameter key="url" value="/login.asp"/>
>
>          <parameter key="response" value="200"/>
>
>    </service>
>
> 2017-08-21 12:15:29,769 WARN [pool-9-thread-298] 
> o.o.n.p.m.HttpMonitor: SocketException while polling 
> cab/192.168.201.30:CAB - TssPlansRegistry:443
>
> java.net.SocketException: Connection reset
>
>         at java.net.SocketInputStream.read(SocketInputStream.java:209) 
> ~[?:1.8.0_112]
>
>         at java.net.SocketInputStream.read(SocketInputStream.java:141) 
> ~[?:1.8.0_112]
>
>         at 
> sun.security.ssl.InputRecord.readFully(InputRecord.java:465) 
> ~[?:1.8.0_112]
>
>         at sun.security.ssl.InputRecord.read(InputRecord.java:503) 
> ~[?:1.8.0_112]
>
>         at 
> sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973) 
> ~[?:1.8.0_112]
>
>         at 
> sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) 
> ~[?:1.8.0_112]
>
>         at 
> sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747) 
> ~[?:1.8.0_112]
>
>         at 
> sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) 
> ~[?:1.8.0_112]
>
>         at java.io.OutputStream.write(OutputStream.java:75) ~[?:1.8.0_112]
>
>         at 
> org.opennms.netmgt.poller.monitors.HttpMonitor$HttpMonitorClient.sendHttpCommand(HttpMonitor.java:543) 
> ~[opennms-services-20.0.1.jar:?]
>
>         at 
> org.opennms.netmgt.poller.monitors.HttpMonitor.poll(HttpMonitor.java:157) 
> [opennms-services-20.0.1.jar:?]
>
>         at 
> org.opennms.netmgt.poller.client.rpc.PollerClientRpcModule$1.get(PollerClientRpcModule.java:77) 
> [org.opennms.features.poller.client-rpc-20.0.1.jar:?]
>
>         at 
> org.opennms.netmgt.poller.client.rpc.PollerClientRpcModule$1.get(PollerClientRpcModule.java:71) 
> [org.opennms.features.poller.client-rpc-20.0.1.jar:?]
>
>         at 
> java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1590) 
> [?:1.8.0_112]
>
>         at 
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
> [?:1.8.0_112]
>
>         at 
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
> [?:1.8.0_112]
>
>         at java.lang.Thread.run(Thread.java:745) [?:1.8.0_112]
>
> Cheers for any help.
>
> Joe.
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> Please read the OpenNMS Mailing List FAQ:
> http://www.opennms.org/index.php/Mailing_List_FAQ
>
> opennms-discuss mailing list
>
> To *unsubscribe* or change your subscription options, see the bottom of this page:
> https://lists.sourceforge.net/lists/listinfo/opennms-discuss

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss