SSL_CERT UNKNOWN www.google.com: cannot find program: host

[YTS85205107]

when I test www.google.com, it is shown SSL_CERT UNKNOWN www.google.com: cannot find program: host

./check_ssl_cert -d -v --host www.google.com

[DBG] Shell: /bin/bash
[DBG] GNU bash, version 4.2.46(2)-release (x86_64-redhat-linux-gnu)
[DBG] Copyright (C) 2011 Free Software Foundation, Inc.
[DBG] License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
[DBG]
[DBG] This is free software; you are free to change and redistribute it.
[DBG] There is NO WARRANTY, to the extent permitted by law.
[DBG] grep: grep
[DBG] grep (GNU grep) 2.20
[DBG] Copyright (C) 2014 Free Software Foundation, Inc.
[DBG] License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html.
[DBG] This is free software: you are free to change and redistribute it.
[DBG] There is NO WARRANTY, to the extent permitted by law.
[DBG]
[DBG] Written by Mike Haertel and others, see http://git.sv.gnu.org/cgit/grep.git/tree/AUTHORS.
[DBG] hostname: /bin/hostname
[DBG] $PATH: /root/perl5/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
[DBG] Command line arguments: -d -v -H www.google.com
[DBG] TMPDIR = /tmp
[DBG] Required HTTP headers:
[DBG] Unrequired HTTP headers:
[DBG] Adding the domain if missing
[DBG] HOST = www.google.com
[DBG] SNI =
[DBG] HOST_NAME = www.google.com
[DBG] HOST_ADDR = www.google.com
[DBG] NAMES_TO_BE_CHECKED = HOST
[DBG] Checking if www.google.com is an IP address
[DBG] www.google.com is not an IP address
[DBG] HOST_IS_IP. = 0
[DBG] Checking if www.google.com is an IP address
[DBG] www.google.com is not an IP address
[DBG] Adding www.google.com to NAMES_TO_BE_CHECKED
[DBG] NAMES_TO_BE_CHECKED = www.google.com
[DBG] curl binary needed. SSL Labs = , OCSP = 1, CURL = , IGNORE_CONNECTION_STATE=, FILE_URI=
[DBG] curl binary not specified
[DBG] curl available: /bin/curl
[DBG] curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.53.1 zlib/1.2.7 libidn/1.28 libssh2/1.8.0
[DBG] Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
[DBG] Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz unix-sockets
[DBG] -c specified: 15
[DBG] -w specified: 20
[DBG] cleaning up temporary files
SSL_CERT UNKNOWN www.google.com: cannot find program: host

how can I resolve it?
thanks.

[matteocorti]

It seems that your system (RedHat?) is missing the host utility. You can install it with the bind-utils package.

[YTS85205107]

oh... yes!!! my system is centos 7.

after I installed, it seems work, thank you!!!

[Vamp898]

Please refer to the manual of your operating system on how to install the "host" application on it. Example for Debian: https://packages.debian.org/bullseye/bind9-host Am 2023-01-27 11:42, schrieb YTS85205107:

…

when I test www.google.com [1], it is shown SSL_CERT UNKNOWN www.google.com [1]: cannot find program: host ./check_ssl_cert -d -v --host www.google.com [1] [DBG] Shell: /bin/bash [DBG] GNU bash, version 4.2.46(2)-release (x86_64-redhat-linux-gnu) [DBG] Copyright (C) 2011 Free Software Foundation, Inc. [DBG] License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> [DBG] [DBG] This is free software; you are free to change and redistribute it. [DBG] There is NO WARRANTY, to the extent permitted by law. [DBG] grep: grep [DBG] grep (GNU grep) 2.20 [DBG] Copyright (C) 2014 Free Software Foundation, Inc. [DBG] License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>. [DBG] This is free software: you are free to change and redistribute it. [DBG] There is NO WARRANTY, to the extent permitted by law. [DBG] [DBG] Written by Mike Haertel and others, see <http://git.sv.gnu.org/cgit/grep.git/tree/AUTHORS>. [DBG] hostname: /bin/hostname [DBG] $PATH: /root/perl5/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin [DBG] Command line arguments: -d -v -H www.google.com [DBG] TMPDIR = /tmp [DBG] Required HTTP headers: [DBG] Unrequired HTTP headers: [DBG] Adding the domain if missing [DBG] HOST = www.google.com [DBG] SNI = [DBG] HOST_NAME = www.google.com [DBG] HOST_ADDR = www.google.com [DBG] NAMES_TO_BE_CHECKED = __HOST__ [DBG] Checking if www.google.com is an IP address [DBG] www.google.com is not an IP address [DBG] HOST_IS_IP. = 0 [DBG] Checking if www.google.com is an IP address [DBG] www.google.com is not an IP address [DBG] Adding www.google.com to NAMES_TO_BE_CHECKED [DBG] NAMES_TO_BE_CHECKED = www.google.com [DBG] curl binary needed. SSL Labs = , OCSP = 1, CURL = , IGNORE_CONNECTION_STATE=, FILE_URI= [DBG] curl binary not specified [DBG] curl available: /bin/curl [DBG] curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.53.1 zlib/1.2.7 libidn/1.28 libssh2/1.8.0 [DBG] Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp [DBG] Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz unix-sockets [DBG] -c specified: 15 [DBG] -w specified: 20 [DBG] cleaning up temporary files SSL_CERT UNKNOWN www.google.com: cannot find program: host how can I resolve it? thanks. -- Reply to this email directly, view it on GitHub [2], or unsubscribe [3]. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***> Links: ------ [1] http://www.google.com [2] #438 [3] https://github.com/notifications/unsubscribe-auth/AGIH5XVUPEXKEQRCKNJMQBDWUORCFANCNFSM6AAAAAAUIRMVZ4

[Vamp898]

Oh sorry, you already solved it. Please ignore my last message^^ Am 2023-01-27 12:26, schrieb YTS85205107:

…

oh... yes!!! my system is centos 7. after I installed, it seems work, thank you!!! -- Reply to this email directly, view it on GitHub [1], or unsubscribe [2]. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***> Links: ------ [1] #438 (comment) [2] https://github.com/notifications/unsubscribe-auth/AGIH5XSHXZZTSDUCCI2Q7QDWUOWF5ANCNFSM6AAAAAAUIRMVZ4

[YTS85205107]

Hi, @matteocorti

Sorry, can I ask one question again?

I can use check_ssl_cert to check expire days, but when I define commands got "SSL_CERT UNKNOWN www.mydomain.com: cannot find program: hostname"

I define the configure below

command.cfg

define command {
command_name check_domainssl
command_line $USER1$/check_ssl_cert -H $HOSTADDRESS$ -w $ARG1$ -c $ARG2$
}

hosts.cfg

define host{
use linux-server
host_name www.mydomain.com
address www.mydomain.com
}

service.cfg

define service{
use linux-service
host_name www.mydomain.com
service_description www.mydomain.com
check_command check_domainssl!30!10
}

nagios log
[1674829988] SERVICE NOTIFICATION: nagiosadmin;www.mydomain.com;www.mydomain.com;UNKNOWN;notify-service-by-email;SSL_CERT UNKNOWN www.mydomain.com: cannot find program: hostname
[1674829988] SERVICE ALERT: www.mydomain.com;www.mydomain.com;UNKNOWN;HARD;4;SSL_CERT UNKNOWN www.mydomain.com: cannot find program: hostname

may I know which setting is wrong?
thanks.

[matteocorti]

The problem is the same as before:

cannot find program: hostname

You need to install the hostname RPM

[matteocorti]

What is the output of "rpm -q hostname" and "command -v hostname"?

[YTS85205107]

rpm -q hostname
=> hostname-3.13-3.el7_7.1.x86_64

command -v hostname
=> /bin/hostname

[matteocorti]

In this case the problem is that the PATH is somehow wrong. What happens when you execute the plug-in on the command line?

[YTS85205107]

do u mean use command line to check?
use /usr/lib64/nagios/plugins/check_ssl_cert to check is normal.

/usr/lib64/nagios/plugins/check_ssl_cert -H www.google.com -w 30 -c 10
SSL_CERT OK - www.google.com:443, https, x509 certificate 'www.google.com' from 'Google Trust Services LLC' valid until Apr 3 08:19:11 2023 GMT (expires in 65 days)|days_chain_elem1=65;30;10;; days_chain_elem2=1706;30;10;; days_chain_elem3=1826;30;10;;

/usr/lib64/nagios/plugins/check_ssl_cert -H www.mydomain.com -w 30 -c 10
SSL_CERT OK - www.mydomain.com:443, https, x509 certificate 'www.mydomain.com' from 'Let's Encrypt' valid until Apr 20 18:18:01 2023 GMT (expires in 83 days)|days_chain_elem1=83;30;10;; days_chain_elem2=962;30;10;; days_chain_elem3=612;30;10;;

[matteocorti]

If the plug-in is finding the command then the problem is in your Nagios or Icinga configuration.

You can also specify a PATH just for this plug-in with --path

[EHEX-schildt]

Hi
i am running in that Problem with the new docker based icinga2 container (2.16.0)[based on debian trixie] there is no Program host anymore, at least in that container.
But Resolving in general works fine in the container with other Programs like ping and other checks like check_http.

In my Case i don't realy need to resolve at all. I can provide the ip.
I tryed flags like:
--resolve-over-http [server] Resolve the host over HTTP using Google or
the specified server
--resolve ip Provide a custom IP address for the
specified host
--do-not-resolve Do not check if the host can be resolved

But all of these want Program host - witch is weird in my Opinion, at least in Case of "--resolve ip" and "--do-not-resolve".

[matteocorti]

Hi, I just released a new version which does not require host when --do-not-resolve is specified.

[EHEX-schildt]

Wow that was fast - it is kind of working i still get cannot find program: host with --do-not-resolve but it work fine without resolve flags and with --resolve ip.

root@11412c64943a:/# ./check_ssl_cert --version
check_ssl_cert version 2.98.0

root@11412c64943a:/# ./check_ssl_cert -H 10.0.66.113 --match test.mydomain --selfsigned --port 8443 --warning 14 --critical 2 --do-not-resolve
SSL_CERT UNKNOWN 10.0.3.5: cannot find program: host

root@11412c64943a:/# ./check_ssl_cert -H 10.0.66.113 --match test.mydomain --selfsigned --port 8443 --warning 14 --critical 2
SSL_CERT OK - 10.0.3.5:8443, https, x509 self signed certificate 'test.mydomain' ( test.mydomain) from 'Self Signed' valid until May 22 08:28:21 2026 GMT (expires in 23 days)|days_chain_elem1=23;14;2;; days_chain_elem2=886;14;2;; days_chain_elem3=1364;14;2;;

root@b42ca88ffa47:/# ./check_ssl_cert -H mainproxy.mydomain --match *.mydomain --warning 14 --critical 2 --resolve 10.0.66.10
SSL_CERT OK - mainproxy.mydomain:443, https, x509 certificate '*.mydomain' (mainproxy.mydomain *.mydomain) from '...' valid until Jun  1 07:34:49 2026 GMT (expires in 33 days)|days_chain_elem1=33;14;2;; days_chain_elem2=317;14;2;;

[matteocorti]

Hi, sorry my fault. I just fixed the bug and released version 2.100.0