tlsv1 alert protocol version for --switch with https

[krystwie]

I use one central file with my configuration for NSClient which is hosted on my Nagios server. I recently disabled TLS 1.0 and 1.1 on my Nagios server, and now my servers (or rather NSClient) are unable to download the configuration file.

PS C:\Program Files\NSClient++> .\nscp.exe settings --switch https://xxxxxxx/nsclient.ini
E settings Failed to download C:\Program Files\NSClient++/cache\nsclient.ini.tmp: Failed to connect to xxxxxxxx:443: tlsv1 alert protocol version
c:\source\master\include\settings/impl/settings_http.hpp:139

Although the correct versions of TLS on set on my Windows servers that I monitor, it looks that NSclient has hardcoded the configuration that it is supposed to use the old TLS 1.0.

Is there any way to improve/fix it ?

[mickem]

Which version of nsclient++ is it?

[krystwie]

This error is generated every time the Nsclient service is restarted or when manually invoking .\nscp.exe settings --switch https://xxxxxxx/nsclient.ini

[mickem]

https://github.com/mickem/nscp/releases/tag/0.8.1 Should fix this issue

[krystwie]

thanks! Now other errors have appeared in the log

2025-04-28 11:08:12: error:D:\a\nscp\nscp\include\socket/connection.hpp:164: Failed to read data: End of file
2025-04-28 11:08:35: error:D:\a\nscp\nscp\include\socket/connection.hpp:164: Failed to read data: End of file

[mickem]

What are you using to server the files? I have been trying tom replicate this with my "python server" but cannot.

[krystwie]

I checked it again and it looks like this error is not generated through NSclient when downloading configurations from a remote server. It turned out that this error is generated when Nagios checks if the NSclient port is open.

this check is carried out by the check_tcp plugin

[mickem]

Closing this as I assume from your comment that it is fixed :)

[krystwie]

I checked, after installation boot.ini files looks ok, but still the nsclient can not download remote configuration

for previous versions there was no such problem

[mickem]

So so so, sorry.. this is a silly typo... Will be fixed in a few hours (builds takes a while)

[mickem]

New version out: https://github.com/mickem/nscp/releases/tag/0.9.11 let me know how it goes...

[krystwie]

Yes, now everything works as it should. Thank you very much for your help.

[mickem]

Great to hear it, and thanks for reporting back... do let me know any other issues you find...