Pushover Notification POST request to server failed

Troubleshooting
1

Pushover Notification weren’t send since 22.01.2022 ~14:30 (MEZ)
Error Message in event console: POST request to server failed

After some troubleshooting found an error.

CMK version: 2.0.0p18.cre
OS version: Debian 11

Error message:

2022-01-23 16:35:20,935 [20] [cmk.base.notify]      Output: requests.exceptions.SSLError: HTTPSConnectionPool(host='api.pushover.net', port=443): Max retries exceeded with url: /1/messages.json?....................... (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1125)')))

What ca-store is checkmk using?
The certificate of the API endpoint is valid and trusted.

“Hotfix”: Editing ./lib/python3/cmk/notification_plugins/pushover.py

    try:
        response = session.post(
            api_url,
            params=dict(params),
            proxies=proxies,
        )

to

    try:
        response = session.post(
            api_url,
            params=dict(params),
            proxies=proxies,
            verify=False,
        )
2

Hi,
did you check if the hostname in the certificate is the same as in the certificate? You can also try to install your certificate in your cert store of checkmk or the linux system.

Best regards,
Christian

3

The certificate for “api.pushover.net” is a wildcard cert for “*.pushover.net”.

I think that the certificate is allright. In my opinion there is a Problem netween the root-ca and checkmk.
Curl the API from shell returns no cert error so the cert-store of the linux system seems to be right.

Just checkmk breaks with an exception (ssl) while triggering the pushover api to send messages from the script above.

BR
Nico

4

Did you verify the certificate chain of api.pushover.com with openssl? Just to be sure, there is nothing wrong on their end.
Next have a look at “Trusted certificate authorities for SSL” in the global settings. Does your checkmk trust the system-wide CAs?

1 Like
5

Hi, can confirm this including your “hotfix”, thanks!
I am using master-latest docker image with external volume. But please explain how can i debug this and / or verify?

7

Hi,

the issue is solved by editing configuration:

Setup → Gloabl Settings → [Trusted certificate authorities for SSL]
Set: Use system wide CAs from “No” to “Yes”

I’m wondering why this issue happens after more than one year of using this system. Very strange …
What ever - it works

Special thanks to @robin.gierse for posting this solution!

KR
Nico

1 Like
8

You must have changed that sometime ago, as the default there is Yes.

9

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.