Virtual Server with HTTPS healtcheck failing TLS verification
I am running a Virtual server on my Fortigate 1500D with the following healtcheck:
config firewall ldb-monitor edit "PatroniMaster" set type https set interval 10 set timeout 2 set retry 3 set port 8008 set src-ip 0.0.0.0 set http-get "/master" set http-match "200 OK" set http-max-redirects 0 next endThe healtcheck is polling a Patroni service that runs with HTTPS with certificates signed by a private CA.
The private root CA has been loaded to the Global scope of the Fortigate for trust purposes.
The healtcheck is failing due to certificate verification issues.
Tried a few different setups:
1. Server certificate without chain
2. Server certificate with chain
3. Root CA with and without intermediate CA
Tested the Patroni solution with curl from a remote PC and it works as expected:
curl -k $PATRONI_HOST/replica --> returned: curl: (60) SSL certificate problem: unable to get local issuer certificate curl -k --cacert $PATH_TO_ROOT_CA $PATRONI_HOST/replica --> returned: 200 OK
Some logs from diagnose:
ipldbd::http_send_url(595): HTTP send() failed. errno=5 ipldbd::epoll_mod_event(67):modify epoll event failed! fd=19 errno=9 ipldbd::http_send_url(570): HTTP send get-url="GET /master HTTP/1.1 User-Agent: FortiGate (FortiOS 7.0) Chrome/ Safari/ Cache-Control: no-cache Pragma: no-cache Host: $PATRONI_HOST:8008 Keep-Alive: timeout=15 Connection: Keep-Alive Content-Length: 0 " ipldbd::http_handle_get_response(526): recv failed mon=PatroniMaster errno=5
Would appreciate some help
Thanks
