CheckMK 2.4.0 bug with agent_hp_msa integration

YowanDC · May 13, 2025, 10:09am

Hello,

Since upgrading to version 2.4.0, the integration ‘HP MSA via Web Interface’ (agent_hp_msa) available in Setup ➔ Agents ➔ Other integrations no longer works

The update guide mentions changes related to Python 3.12.3 but I have no such modules (find ~/local/lib/python3/ -type d -name ‘.-info’ returns nothing)

I tried clearing the TLS registration in my host settings but this has no effect
Below is the logs

CMK version: 2.4.0
OS version: Debian 12

Error message: When testing connection

Agent exited with code 1: Traceback (most recent call last):
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 466, in _make_request
self._validate_conn(conn)
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 1095, in _validate_conn
conn.connect()
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connection.py", line 730, in connect
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connection.py", line 909, in _ssl_wrap_socket_and_match_hostname
ssl_sock = ssl_wrap_socket(
^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 469, in ssl_wrap_socket
ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 513, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/ssl.py", line 455, in wrap_socket
return self.sslsocket_class._create(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/ssl.py", line 1041, in _create
self.do_handshake()
File "/omd/sites/mysite/lib/python3.12/ssl.py", line 1319, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 789, in urlopen
response = self._make_request(
^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 490, in _make_request
raise new_e
urllib3.exceptions.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/adapters.py", line 667, in send
resp = conn.urlopen(
^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 843, in urlopen
retries = retries.increment(
^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/util/retry.py", line 519, in increment
raise MaxRetryError(_pool, url, reason) from reason # type: ignore[arg-type]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='mydevice-ip', port=443): Max retries exceeded with url: /api/login/0f71f5b3d3200ab9c7185c67ed25ee7716b91a3280a1666149aefcfbd4b04dc7 (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/omd/sites/mysite/lib/python3/cmk/special_agents/agent_hp_msa.py", line 146, in login
session_key = self._get_session_key(hashlib.sha256, username, password)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3/cmk/special_agents/agent_hp_msa.py", line 158, in _get_session_key
response = self.get(login_url)
^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3/cmk/special_agents/agent_hp_msa.py", line 177, in get
response = self._session.get(url, timeout=self._timeout, verify=self._verify_ssl)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/sessions.py", line 602, in get
return self.request("GET", url, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/sessions.py", line 589, in request
resp = self.send(prep, **send_kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/sessions.py", line 703, in send
r = adapter.send(request, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/adapters.py", line 698, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='mydevice-ip', port=443): Max retries exceeded with url: /api/login/0f71f5b3d3200ab9c7185c67ed25ee7716b91a3280a1666149aefcfbd4b04dc7 (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 466, in _make_request
self._validate_conn(conn)
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 1095, in _validate_conn
conn.connect()
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connection.py", line 730, in connect
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connection.py", line 909, in _ssl_wrap_socket_and_match_hostname
ssl_sock = ssl_wrap_socket(
^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 469, in ssl_wrap_socket
ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 513, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/ssl.py", line 455, in wrap_socket
return self.sslsocket_class._create(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/ssl.py", line 1041, in _create
self.do_handshake()
File "/omd/sites/mysite/lib/python3.12/ssl.py", line 1319, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 789, in urlopen
response = self._make_request(
^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 490, in _make_request
raise new_e
urllib3.exceptions.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/adapters.py", line 667, in send
resp = conn.urlopen(
^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/connectionpool.py", line 843, in urlopen
retries = retries.increment(
^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/urllib3/util/retry.py", line 519, in increment
raise MaxRetryError(_pool, url, reason) from reason # type: ignore[arg-type]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='mydevice-ip', port=443): Max retries exceeded with url: /v3/api/login/539e12f63b693a9970a97b885e857f8b (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/omd/sites/mysite/share/check_mk/agents/special/agent_hp_msa", line 11, in <module>
sys.exit(main())
^^^^^^
File "/omd/sites/mysite/lib/python3/cmk/special_agents/agent_hp_msa.py", line 192, in main
connection.login(args.username, args.password)
File "/omd/sites/mysite/lib/python3/cmk/special_agents/agent_hp_msa.py", line 150, in login
session_key = self._get_session_key(hashlib.md5, username, password)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3/cmk/special_agents/agent_hp_msa.py", line 158, in _get_session_key
response = self.get(login_url)
^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3/cmk/special_agents/agent_hp_msa.py", line 177, in get
response = self._session.get(url, timeout=self._timeout, verify=self._verify_ssl)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/sessions.py", line 602, in get
return self.request("GET", url, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/sessions.py", line 589, in request
resp = self.send(prep, **send_kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/sessions.py", line 703, in send
r = adapter.send(request, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/omd/sites/mysite/lib/python3.12/site-packages/requests/adapters.py", line 698, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='mydevice-ip', port=443): Max retries exceeded with url: /v3/api/login/539e12f63b693a9970a97b885e857f8b (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1010)')))
SNMPv1
Recommencer ce test
SNMP Error on mydevice-ip: Ti

Output of “cmk --debug -vvn hostname”:

Trying to acquire lock on /omd/sites/mysite/var/check_mk/ipaddresses.cache
Got lock on /omd/sites/mysite/var/check_mk/ipaddresses.cache
Releasing lock on /omd/sites/mysite/var/check_mk/ipaddresses.cache
Released lock on /omd/sites/mysite/var/check_mk/ipaddresses.cache
+ FETCHING DATA
  Source: SourceInfo(hostname='mydevice-ip', ipaddress='mydevice-ip', ident='piggyback', fetcher_type=<FetcherType.PIGGYBACK: 4>, source_type=<SourceType.HOST: 1>)
[cpu_tracking] Start [7f7a733f3f80]
Read from cache: NoCache(path_template=/dev/null, max_age=MaxAge(checking=0.0, discovery=0.0, inventory=0.0), simulation=False, use_only_cache=False, file_cache_mode=1)
0 piggyback files for 'mydevice-ip'.
0 piggyback files for 'mydevice-ip'.
Get piggybacked data
[cpu_tracking] Stop [7f7a733f3f80 - Snapshot(process=posix.times_result(user=0.0, system=0.0, children_user=0.0, children_system=0.0, elapsed=0.009999997913837433))]
[cpu_tracking] Start [7f7a732c6f30]
0 piggyback files for 'mydevice-ip'.
+ PARSE FETCHER RESULTS
  HostKey(hostname='mydevice-ip', source_type=<SourceType.HOST: 1>)  -> Add sections: []
Received no piggyback data
[cpu_tracking] Stop [7f7a732c6f30 - Snapshot(process=posix.times_result(user=0.010000000000000231, system=0.0, children_user=0.0, children_system=0.0, elapsed=0.010000001639127731))]
[piggyback] Success (but no data found for this host), execution time 0.0 sec | execution_time=0.020 user_time=0.010 system_time=0.000 children_user_time=0.000 children_system_time=0.000 cmk_time_agent=0.010


<!--- Please make sure you do not include sensitive data in the post. Please avoid sharing data like: 
- Internal IP addresses/ URLs
- Passwords, API keys and tokens, private SSH keys
- Database connection strings, including hostnames, ports, and credentials etc
-->

Is this a known regression ?
Thanks

andreas-doehler · May 13, 2025, 10:33am

I would not say that it is a regression, but a problem of the newer version of Python libraries used for connection.
CMK 2.4 → urllib3 v2.2.3
CMK 2.3 → urllib3 v1.26.20

The biggest change between urllib3 v1 and v2 is the cipher handling for the TLS connection.

It is possible that some of the special agents need a little bit of attention to communicate with the older devices.
In the end you have to downgrade the security settings for the connection to the devices.

YowanDC · May 13, 2025, 12:05pm

Thanks for you reply!

To me it appears that this specific agent / integration is forced to use legacy SSL
From the HP MSA device side, I can confirm that it supports TLS1.2 with the AES256-GCM-SHA384 cipher with its self signed certificate

I enable http on the device for testing but the plugin seems to be hardcoded to use https with the hostname

github.com

Checkmk/checkmk/blob/c8ed7848b37538bdd0be211e65d8dbcc9f914327/cmk/special_agents/agent_hp_msa.py#L135


      
                      self.current_property.append(data.replace("\n", "").replace("\r", ""))
          
          
          class AuthError(RuntimeError):
              pass
          
          
          class HPMSAConnection:
              def __init__(self, hostaddress: str, opt_timeout: int) -> None:
                  self._host = hostaddress
                  self._base_url = "https://%s/api/" % self._host
                  self._timeout = opt_timeout
                  self._session = requests.Session()
                  self._session.headers = CaseInsensitiveDict({"User-agent": "Checkmk special agent_hp_msa"})
                  # we cannot use self._session.verify because it will be overwritten by
                  # the REQUESTS_CA_BUNDLE env variable
                  self._verify_ssl = False
                  urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
          
              def login(self, username: str, password: str) -> None:
                  try:

HartmutLeister · May 14, 2025, 7:33am

Good Morning @YowanDC,

thank you for the report.
Yes, that’s an issue and we’re working on it.

We think this might be the same problem as in RAW 2.4 vmware ESXi SSL error - #10 by genitguy3

Sunny Greetings
Hartmut

system · May 14, 2026, 7:34am

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.