orangeCatDeveloper commented on issue #1132: URL: https://github.com/apache/hertzbeat/issues/1132#issuecomment-5312758706
For everyone hitting `PKIX path building failed` on self-signed certs (@leim @loupenghui): since #2221 (v1.6.1+) the ssl_cert monitor has a **"verify certificate" toggle** in its parameters — switch it off and chain validation is skipped, so the PKIX error goes away. However, the toggle was incomplete: with verify off, hostname verification still ran, so self-signed sites reached by IP (or any cert whose CN/SAN does not match the address) still failed with `No subject alternative names matching IP address ... found`. #4324 fixes that remaining gap — with verify off, the monitor can now read any certificate, which should fully cover the "can monitor all SSL certificates" ask of this issue. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: notifications-unsubscr...@hertzbeat.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: notifications-unsubscr...@hertzbeat.apache.org For additional commands, e-mail: notifications-h...@hertzbeat.apache.org
