[Bug]: check_mysql plugin, AWS SSL certificate error

[bleve97]

What happened?

After updating today, I'm seeing this :

`4410e37eebbc:/opt/nagios/libexec# ./check_mysql -H my.aws.servername -u aname -papassword
TLS/SSL error: Certificate verification failure: The certificate is NOT trusted.
4410e37eebbc:/opt/nagios/libexec# ./check_mysql -H my.aws.servername -n
TLS/SSL error: self-signed certificate in certificate chain
4410e37eebbc:/opt/nagios/libexec# ./check_mysql -V
check_mysql v2.4.12.git (nagios-plugins 2.4.12)
`

Same setup has been fine since 2022

Image information

@mgt01:/usr/local/bin# docker inspect --format='{{range $k,$v := .Config.Labels}}{{printf "* %s: " $k}}{{if not $v}}{{$v}}{{else}}{{$v}}{{end}}{{"\n"}}{{end}}' avsoftaustralia/avsoft-nagios:latest

• build: 32
• gitCommit: 29a8acf
• homepage: https://www.nagios.com/
• maintainer: Christos Manios maniopaido@gmail.com
• nagiosPluginsVersion: 2.4.12
• nagiosVersion: 4.5.10
• name: Nagios
• nrpeVersion: 4.1.3
• org.opencontainers.image.authors: Christos Manios maniopaido@gmail.com
• org.opencontainers.image.description: Nagios, the Industry Standard In IT Infrastructure Monitoring
• org.opencontainers.image.documentation: https://github.com/manios/docker-nagios/blob/master/README.md
• org.opencontainers.image.licenses: MIT
• org.opencontainers.image.revision: 29a8acf
• org.opencontainers.image.source: https://github.com/manios/docker-nagios
• org.opencontainers.image.title: Nagios
• org.opencontainers.image.url: https://hub.docker.com/r/manios/nagios
• org.opencontainers.image.vendor: Nagios
• org.opencontainers.image.version: 32

Image architecture

amd64

Relevant log output

[manios]

Hi @bleve97!

It seems that the certificate of your MySQL server has changed. If you have a closer look to the error, it notes that:

TLS/SSL error: Certificate verification failure: The certificate is NOT trusted.

You can fix it in two steps:

1. If you have a self signed certificate set up in your MySQL server, you can provided the certificate and the CA (certificate authority certificate) as parameters in your plugin call: ./check_mysql -H my.aws.servername -u aname -papassword --cert="server-certificate.crt" --ca-cert=ca.crt --ssl. You can read more in check_mysql documentation.
2. If the server certificate is not a self signed certificate please contact the database server administrator to check if something is misconfigured on their side.

This image uses the same Nagios Plugins version since Build 22 (2024-08-30). Also based on the returned error, it looks like this is not a plugin bug.

Best regards,
Chris

[bleve97]

Understood, but we're not using SSL, it's an internal LAN connection. The -ssl option isn't being used, so it should just check the MySQL socket. Something's changed ..

…

On 5/12/2025 10:10 pm, Christos Manios wrote: *manios* left a comment (manios/docker-nagios#98) <https://github.com/ manios/docker-nagios#98#issuecomment-3616422741> Hi @bleve97 <https://github.com/bleve97>! It seems that the certificate of your MySQL server has changed. If you have a closer look to the error, it notes that: |TLS/SSL error: Certificate verification failure: The certificate is NOT trusted. | You can fix it in two steps: 1. If you have a self signed certificate set up in your MySQL server, you can provided the certificate and the CA (certificate authority certificate) as parameters in your plugin call: |./check_mysql -H my.aws.servername -u aname -papassword --cert="server- certificate.crt" --ca-cert=ca.crt --ssl|. You can read more in check_mysql documentation <https://nagios-plugins.org/doc/man/ check_mysql.html>. 2. If the server certificate is not a self signed certificate please contact the database server administrator to check if something is misconfigured on their side. This image uses the same Nagios Plugins version since Build 22 (2024-08-30) <https://github.com/manios/docker-nagios/blob/master/ CHANGELOG.md#build-22-2024-08-30>. Also based on the returned error, it looks like this is not a plugin bug. Best regards, Chris — Reply to this email directly, view it on GitHub <https://github.com/ manios/docker-nagios#98#issuecomment-3616422741>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ AD7TRSKLSHOSXUUZYJIVLTT4AFR3JAVCNFSM6AAAAACODJ2RXWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTMMJWGQZDENZUGE>. You are receiving this because you were mentioned.Message ID: <manios/ ***@***.***>

[manios]

Hi @bleve97!

I have managed to reproduce the issue locally. It seems that check_mysql plugin uses an old version of openssl. There are multiple warnings when the docker image is built:

I can verify that this issue exists when building Nagios Plugins 2.4.11 in Alpine 3.23.0. The logs show deprecation warnings:

2025-12-04T13:33:00.6412442Z #47 318.8 libtool: link: gcc "-DNP_VERSION=\"2.4.12.git\"" -g -O2 -o check_uptime check_uptime.o  -L. libnpcommon.a ../lib/libnagiosplug.a ../gl/libgnu.a -lssl -lcrypto -lrt -lintl -lpthread -ldl
2025-12-04T13:33:00.6415639Z #47 318.8 gcc -DLOCALEDIR=\"/opt/nagios/share/locale\" -DHAVE_CONFIG_H -I. -I..  -I.. -I../lib -I../gl -I../intl -I/usr/include/ldap -I/usr/include/postgresql -I/usr/include -I/usr/include/mysql -I/usr/include/mysql/mysql  -DNP_VERSION='"2.4.12.git"' -I/usr/include/mysql -I/usr/include/mysql/mysql -g -O2 -MT check_mysql-check_mysql.o -MD -MP -MF .deps/check_mysql-check_mysql.Tpo -c -o check_mysql-check_mysql.o `test -f 'check_mysql.c' || echo './'`check_mysql.c
2025-12-04T13:33:00.6428549Z #47 319.2 In file included from ../gl/sha1.h:37,
2025-12-04T13:33:00.6429100Z #47 319.2                  from ../lib/utils_base.h:5,
2025-12-04T13:33:00.6429841Z #47 319.2                  from utils.h:17,
2025-12-04T13:33:00.6430326Z #47 319.2                  from check_mysql.c:40:
2025-12-04T13:33:00.6430942Z #47 319.2 ../gl/gl_openssl.h: In function 'sha1_init_ctx':
2025-12-04T13:33:00.6431780Z #47 319.2 ../gl/gl_openssl.h:79:1: warning: 'SHA1_Init' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
2025-12-04T13:33:00.6432642Z #47 319.2    79 | { (void) OPENSSL_FN (_Init) ((_gl_CTX *) ctx); }
2025-12-04T13:33:00.6433142Z #47 319.2       | ^
2025-12-04T13:33:00.6433589Z #47 319.2 In file included from /usr/include/openssl/x509.h:41,
2025-12-04T13:33:00.6434142Z #47 319.2                  from common.h:159,
2025-12-04T13:33:00.6434639Z #47 319.2                  from check_mysql.c:39:
2025-12-04T13:33:00.6435214Z #47 319.2 /usr/include/openssl/sha.h:49:27: note: declared here
2025-12-04T13:33:00.6435861Z #47 319.2    49 | OSSL_DEPRECATEDIN_3_0 int SHA1_Init(SHA_CTX *c);
2025-12-04T13:33:00.6436652Z #47 319.2       |                           ^~~~~~~~~
2025-12-04T13:33:00.6437225Z #47 319.2 ../gl/gl_openssl.h: In function 'sha1_process_bytes':
2025-12-04T13:33:00.6438343Z #47 319.2 ../gl/gl_openssl.h:85:1: warning: 'SHA1_Update' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
2025-12-04T13:33:00.6439228Z #47 319.2    85 | { OPENSSL_FN (_Update) ((_gl_CTX *) ctx, buf, len); }
2025-12-04T13:33:00.6439714Z #47 319.2       | ^
2025-12-04T13:33:00.6440117Z #47 319.2 /usr/include/openssl/sha.h:50:27: note: declared here
2025-12-04T13:33:00.6440840Z #47 319.2    50 | OSSL_DEPRECATEDIN_3_0 int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
2025-12-04T13:33:00.6441534Z #47 319.2       |                           ^~~~~~~~~~~
2025-12-04T13:33:00.6442059Z #47 319.2 ../gl/gl_openssl.h: In function 'sha1_finish_ctx':
2025-12-04T13:33:00.6442896Z #47 319.2 ../gl/gl_openssl.h:94:1: warning: 'SHA1_Final' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
2025-12-04T13:33:00.6443875Z #47 319.2    94 | { OPENSSL_FN (_Final) ((unsigned char *) res, (_gl_CTX *) ctx); return res; }
2025-12-04T13:33:00.6444485Z #47 319.2       | ^
2025-12-04T13:33:00.6444925Z #47 319.2 /usr/include/openssl/sha.h:51:27: note: declared here
2025-12-04T13:33:00.6445635Z #47 319.2    51 | OSSL_DEPRECATEDIN_3_0 int SHA1_Final(unsigned char *md, SHA_CTX *c);
2025-12-04T13:33:00.6446288Z #47 319.2       |                           ^~~~~~~~~~
2025-12-04T13:33:00.6446820Z #47 319.2 ../gl/gl_openssl.h: In function 'sha1_read_ctx':
2025-12-04T13:33:00.6447861Z #47 319.2 ../gl/gl_openssl.h:105:3: warning: 'SHA1_Final' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
2025-12-04T13:33:00.6448774Z #47 319.2   105 |   OPENSSL_FN (_Final) ((unsigned char *) res, &tmp_ctx);
2025-12-04T13:33:00.6449323Z #47 319.2       |   ^~~~~~~~~~
2025-12-04T13:33:00.6449816Z #47 319.2 /usr/include/openssl/sha.h:51:27: note: declared here
2025-12-04T13:33:00.6450538Z #47 319.2    51 | OSSL_DEPRECATEDIN_3_0 int SHA1_Final(unsigned char *md, SHA_CTX *c);
2025-12-04T13:33:00.6451217Z #47 319.2       |                           ^~~~~~~~~~
2025-12-04T13:33:00.6451854Z #47 319.5 mv -f .deps/check_mysql-check_mysql.Tpo .deps/check_mysql-check_mysql.Po

I also see that there are other issues mentioning similar behaviour:

1. check_mysql: caching_sha2_password support needed nagios-plugins/nagios-plugins#805
2. check_mysql not working with mysql 8.4.0 LTS nagios-plugins/nagios-plugins#771
3. check_mysql is checking SSL Certs when -ssl is NOT a command line argument nagios-plugins/nagios-plugins#824 (yours)

I guess at the moment until these issues are resolved, you can use this Nagios image with a previous build version, earlier build-32.

Steps to reproduce

I have tested quickly the check_mysql plugin with the following docker-compose.yaml file by bringing up Nagios and MySQL in the same bridged network without a SSL connection:

services:
  nagios:
    image: manios/nagios:build-32
    ports:
        - "8080:80"
    networks:
      - nagios-net
    environment:
      NAGIOS_TIMEZONE: "Australia/Sydney"

  mysql:
    image: mysql:8.0.44-debian
    ports:
        - "3306:3306"
    networks:
      - nagios-net
    environment:
      MYSQL_ROOT_PASSWORD: 'root'
networks:
  nagios-net:
    driver: bridge

As you can see, the check_mysql works without any issue:

# run the containers
docker-compose up -d

# log into the mysql container
docker exec -it docker-nagios-nagios-1 /bin/sh

# call the check_mysql plugin
/opt/nagios $ ./libexec/check_mysql -H mysql -u root -proot
TLS/SSL error: self-signed certificate in certificate chain

Best regards,
Chris

[bleve97]

Thank you for looking into it!

[bleve97]

Do we know if this has been fixed in :latest yet?