AHMED ZBYR

AHMED ZBYR

Biker, EV Enthusiast

Configuring HTTPS (TLS/SSL) on a Nagios XI server encrypts web UI logins, API calls (/nagiosxi/api/v1/), and passive check submissions (/nrdp/). Enabling HTTPS on Nagios XI (supported in Nagios XI 2011R1.6 and later) requires configuring Apache’s mod_ssl, redirecting HTTP requests to HTTPS, and updating Nagios XI’s internal application settings so local cron jobs and subcomponents use https://.

Step 1: Install mod_ssl and OpenSSL

Verify that Apache’s SSL module (mod_ssl) and openssl are installed on the Nagios XI host:

sudo yum install -y mod_ssl openssl

Step 2: Generate a TLS Private Key and Certificate

If your organization uses an internal or public Certificate Authority (CA), submit the generated Certificate Signing Request (.csr) to your CA. For an internal lab or self-signed setup, you can sign the certificate locally.

1. Generate a 2048-bit RSA Private Key

openssl genrsa -out ca.key 2048

Example output:

[ahmed@nagiosserver ~]$ openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
.................................................................................................................+++
.....................................+++
e is 65537 (0x10001)

2. Create a Certificate Signing Request (CSR)

Set the Common Name (CN) to the exact fully qualified domain name (FQDN) users and agents will use to connect (e.g., nagiosserver.ahmed.com):

openssl req -new -key ca.key -out ca.csr

Example interactive prompts:

Country Name (2 letter code) [XX]:TR
State or Province Name (full name) []:Istanbul
Locality Name (eg, city) [Default City]:Istanbul
Organization Name (eg, company) [Default Company Ltd]:Ahmed, Inc
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:nagiosserver.ahmed.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3. Generate the Self-Signed X.509 Certificate

Sign the CSR with your private key for 365 days:

openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt

[ahmed@nagiosserver ~]$ openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
Signature ok
subject=/C=TR/ST=Istanbul/L=Istanbul/O=Ahmed, Inc/CN=nagiosserver.ahmed.com
Getting Private key

Tip for Modern Browsers (Subject Alternative Name): Modern browsers (Chrome, Firefox, Edge) require the server’s DNS name to be present in a subjectAltName (SAN) extension in addition to CN. With OpenSSL 1.1.1+, you can add -addext "subjectAltName = DNS:nagiosserver.ahmed.com" when generating the certificate.

Step 3: Install the Certificate and Private Key

Copy the certificate and key into /etc/pki/tls/ and restrict permissions so only root can read the private key:

sudo cp ca.crt /etc/pki/tls/certs/ca.crt
sudo cp ca.key ca.csr /etc/pki/tls/private/
sudo chown root:root /etc/pki/tls/certs/ca.crt /etc/pki/tls/private/ca.key
sudo chmod 0644 /etc/pki/tls/certs/ca.crt
sudo chmod 0600 /etc/pki/tls/private/ca.key

Step 4: Configure Apache (ssl.conf and httpd.conf)

1. Update /etc/httpd/conf.d/ssl.conf

Open /etc/httpd/conf.d/ssl.conf and verify that SSLCertificateFile and SSLCertificateKeyFile point to your certificate and key:

SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key

ssl cert

In the same /etc/httpd/conf.d/ssl.conf file, add the Nagios XI REST API rewrite rules immediately above the closing </VirtualHost> tag:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
</IfModule>

IfModule

2. Redirect HTTP to HTTPS in /etc/httpd/conf/httpd.conf

Append the following rewrite rules to the end of /etc/httpd/conf/httpd.conf so plain HTTP requests on port 80 are automatically redirected to https://:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

httpd config

3. Test Apache Config and Restart httpd

Check the Apache configuration syntax before restarting:

sudo apachectl configtest
sudo service httpd restart

Step 5: Update Nagios XI Internal HTTPS Settings

For Nagios XI’s internal cron jobs, scheduled reports, and Core Config Manager (CCM) apply-configuration calls to work over HTTPS, update the following three settings:

1. Edit /usr/local/nagiosxi/html/config.inc.php

Open /usr/local/nagiosxi/html/config.inc.php:

sudo vim /usr/local/nagiosxi/html/config.inc.php

Change $cfg['use_https'] from false to true:

// force http/https
$cfg['use_https'] = true; // determines whether cron jobs and other scripts will force the use of HTTPS instead of HTTP

2. Update Program URL in System Settings

  1. Log in to the Nagios XI web interface as nagiosadmin.
  2. Navigate to Admin → System Config → System Settings → General.
  3. Update Program URL and External URL from http://... to https://<nagios-server-fqdn>/nagiosxi/.
  4. Click Update Settings.

3. Update Core Config Manager (CCM) Protocol

  1. Navigate to Configure → Core Config Manager → Config Manager Admin → Config Manager Settings.
  2. Set Server Protocol to HTTPS and save.

Restart nagios and httpd:

sudo service nagios restart
sudo service httpd restart

Step 6: Open TCP Port 443 in the Firewall

Ensure inbound TCP port 443 is permitted by the host firewall:

# CentOS / RHEL 6 (iptables)
sudo iptables -I INPUT -p tcp --dport 443 -j ACCEPT
sudo service iptables save

# CentOS / RHEL 7+ (firewalld)
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

You can now access the Nagios XI interface securely at https://nagiosserver.ahmed.com/nagiosxi/.

References

You May Also Enjoy