as the first parame- ter, allowing to specify both HTTP and HTTPS protocols. As a prerequisite of SSL (HTTPS) functionality, the agent should be compiled with cURL support. Previously, only domain name various items and hosts, SNMPv3 authentication and privacy passphrases, passwords for media types; SSL key password and HTTP proxy fields used in web scenarios and HTTP items; usernames, passwords and components (server, proxy, agent, zabbix_sender and zabbix_get utilities) using Transport Layer Security (TLS) protocol. network discovery - automated discovery of network devices. low-level discovery - automated

1429533600 748791234 44 Secure connections to Zabbix database It is now possible to configure secure TLS connections to MySQL and PostgreSQL databases from: • Zabbix frontend • Zabbix server or proxy Restricting that are unavailable in the particular configuration will be disabled. For example, the Database TLS encryption checkbox cannot be checked if using MySQL and Database host is set to localhost. See Secure various items and hosts, SNMPv3 authentication and privacy passphrases, passwords for media types; SSL key password and HTTP proxy fields used in web scenarios and HTTP items; usernames, passwords and

various items and hosts, SNMPv3 authentication and privacy passphrases, passwords for media types; SSL key password and HTTP proxy fields used in web scenarios and HTTP items; usernames, passwords and components (server, proxy, agent, zabbix_sender and zabbix_get utilities) using Transport Layer Security (TLS) protocol. network discovery - automated discovery of network devices. low-level discovery - automated Setting up SSL for Zabbix frontend On RHEL/Centos, install mod_ssl package: yum install mod_ssl Create directory for SSL keys: mkdir -p /etc/httpd/ssl/private chmod 700 /etc/httpd/ssl/private Create

Autoregistration section accessible through the dropdown to the right. It is possible to select no encryption, TLS encryption with PSK authentication or both (so that some hosts may register without encryption while components (server, proxy, agent, zabbix_sender and zabbix_get utilities) using Transport Layer Security (TLS) protocol. network discovery - automated discovery of network devices. low-level discovery - automated XML XPath preprocessing. net-snmp Required for SNMP support. GnuTLS, OpenSSL, LibreSSL or mbed TLS Required when using encryption. Agent Requirement Status Description libpcre Mandatory PCRE library

as the first param- eter, allowing to specify both HTTP and HTTPS protocols. As a prerequisite of SSL (HTTPS) functionality, the agent should be compiled with cURL support. Previously, only domain name components (server, proxy, agent, zabbix_sender and zabbix_get utilities) using Transport Layer Security (TLS) protocol. network discovery - automated discovery of network devices. low-level discovery - automated Setting up SSL for Zabbix frontend On RHEL/Centos, install mod_ssl package: yum install mod_ssl Create directory for SSL keys: mkdir -p /etc/httpd/ssl/private chmod 700 /etc/httpd/ssl/private Create

. . . . . . . 183 5 Apache SSL/TLS Encryption 187 5.1 Apache SSL/TLS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 5.2 SSL/TLS Strong Encryption: An Introduction . . . . . . . . . . . . . . . . 189 5.3 SSL/TLS Strong Encryption: Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 5.4 SSL/TLS Strong Encryption: How-To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 5.5 SSL/TLS Strong Encryption: FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 6 Guides, Tutorials, and HowTos 221 6.1

. . . . . . . 183 5 Apache SSL/TLS Encryption 187 5.1 Apache SSL/TLS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 5.2 SSL/TLS Strong Encryption: An Introduction . . . . . . . . . . . . . . . . 189 5.3 SSL/TLS Strong Encryption: Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 5.4 SSL/TLS Strong Encryption: How-To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 5.5 SSL/TLS Strong Encryption: FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 6 Guides, Tutorials, and HowTos 221 6.1

validity and expiration dates of TLS/SSL website certificates. • Plugins MySQL and PostgreSQL now support encrypted TLS connection between the agent and monitored databases. TLS encryption parameters can traffic and DNS metrics via HTTP; • Website certificate by Zabbix agent 2 - native monitoring of TLS/SSL website certificates by Zabbix agent 2. You can get these templates: • In Configuration → Templates components (server, proxy, agent, zabbix_sender and zabbix_get utilities) using Transport Layer Security (TLS) protocol. network discovery - automated discovery of network devices. low-level discovery - automated

. . . . . . . 164 5 Apache SSL/TLS Encryption 167 5.1 Apache SSL/TLS Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 5.2 SSL/TLS Strong Encryption: An Introduction . . . . . . . . . . . . . . . . 169 5.3 SSL/TLS Strong Encryption: Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 5.4 SSL/TLS Strong Encryption: How-To . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 5.5 SSL/TLS Strong Encryption: FAQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 6 Guides, Tutorials, and HowTos 203 6.1

database Overview This section provides Zabbix setup steps and configuration examples for secure TLS connections between: Database Zabbix components MySQL Zabbix frontend, Zabbix server, Zabbix proxy to use TLS connection to database from Zabbix server/proxy and frontend to database: • required - connect using TLS as transport mode without identity checks; • verify_ca - connect using TLS and verify verify certificate; 17 • verify_full - connect using TLS, verify certificate and verify that database identity (CN) specified by DBHost matches its certificate; Zabbix configuration Frontend to the database