Check_httpv2 no option for old TLS version in GUI

[KoMa666]

CMK version: Checkmk Raw Edition 2.3.0p2
OS version: Debian 12

Hi Team,

in check_httpv2 on commandline I am able to use “outdated” TLS versions tls10 and tls11 using “–min-tls-version”. This option is not available in GUI as stated in the help: This requires a direct call via Integrate Nagios plugins."

Can you please add tls10 and tls11 to the GUI? Checking unsafe sites is not unsafe at all. I agree the devices not supporting tls12 and tls13 should be replaced but there are many not supporting this (printer, IoT, …).

Thanks a lot,
Marco

[aeckstein (Andre Eckstein)]

Hi Marco,

checkmk has a blog article about that:

How to monitor servers with broken TLS in Checkmk 2.3

[KoMa666]

Hi Andre,

I know and I’m using this workaround but from my opinion it makes no sense to not provide this settings in the GUI on the monitoring system.

The ciphers are outdated, no question but this is an issue of the monitored device and nothing a monitoring device should restrict.

Especially if everything is available, only the GUI prevents selecting it.

Marco

[marcel.arentz]

Hi @KoMa666
You’re right, that you can choose TLS 1.1 and TLS 1.0 on command line. This is necessary for users like you who still have to use these versions for some reason. As this is not working out-of-the-box, but only after following the workaround guide in our blog article, we decided not to offer a functionality in the UI that will not work for most users.
Additionally being forced to use “Integrate Nagios plugins” is a reminder that you should switch as soon as possible to a save TLS version. Monitoring unsafe web sites can be unsafe – especially if a user adds authentication or sends other sensible data.

I’m sure you understand that we want to have Checkmk as save as possible for all our users. Still, we wanted to provide you a way to monitor legacy web endpoints. The current solution has been the trade-off.

[KoMa666]

Hi @marcel.arentz,

I understand and I totally ACK.

But sometimes there is no way to use TLS1.2 for example on IoT devices or Medical devices or printers, … where getting TLS1.2 is not possible or only possible by spending (a lot) of money (buying new devices).

Maybe it would be a good solution/compromise to put a warning into the device configuration website as a “friendly reminder” instead of preventing the configuration itself.

But this is up to you. I think issue is solved from my point of view except a possible way to improve (also from my point of view).

Thanks a lot

[marcel.arentz]

Hi @KoMa666 and thank you for your patience / understanding. Updating to OpenSSL 3.0 is a product wide decision and both (check_http and check_httpv2) are more or less dependent on that decision.
On the other hand, I totally understand that in reality there are many devices up and running that still have no support for TLS 1.2 or higher and it’s not always possible to replace them.
I can make the following promises: As soon as we find a proper way for a user to easily re-add support of TLS 1.0/1.1 while having it deactivated by default, we are open to implement that.