**CHECK_NRPE: Error - Could not complete SSL handshake* - * NSClient++ version: **0.6.0.1**

[AntMCE]

Describe your issue and tell us how to reproduce it.
CHECK_NRPE: Error - Could not complete SSL handshake

PLEASE PROVIDE COMMAND HERE
check_nrpe -H x.x.x.x -p 5666 -u -t 180 -c CheckCPU -a warn=85 crit=90 time=10s

Expected Behavior

Should read check value output

• NSClient++ version: 0.6.0.1
• OS and Version: Windows Server 2012
• Checking from: Shinken installed on centos6 with OpenSSL 1.0.2k-fips
• Checking with: check_nrpe

Additional Details

[/settings/NRPE/server]

ssl options =

port = 5666

insecure = true

verify mode = none

allow nasty characters = true

allow arguments = true

use ssl = true

NSClient++ log:

nscp failed to establish secure connection: unsupported protocol

[Prathameshhankare]

@AntMCE, I am not sure if your issue was similar to mine. I used Centos7 on which the check_nrpe command worked with no issue however after I migrated to Ubuntu 22.04 the check_nrpe threw the same error you mentioned. To mitigate the problem I had to change the DH key size on my Windows server to 2048 bit instead of the default 512 bit. Since I am monitoring 1000+ domain controllers(Windows Servers) I could not make the change manually hence created a PowerShell script that does the work for me. Check out my GitHub repository if the script can help you as well.

https://github.com/Prathameshhankare/nsclientpp_dh-key-updater

[rvva]

The problem is that version 0.6.0.1 supports NRPE v3/4 and the Windows installer implements a 512-bit DH key which is not supported by NRPE v3:
nrpe-v3-enhanced-security

So users should manually deploy the 2048-bit DH key and place it in C:\Program Files\NSClient++\security\ and add a reference to this key in the ini file instead of the 512-bit key, and finally restart the nscp service.

cd "C:\Program Files\NSClient++\security\".
nscp settings --path /settings/NRPE/server --key dh --set “${certificate-path}/nrpe_dh_2048.pem”
net stop nscp && net start nscp

I think the package maintainer should add the 2048-bit key as the default key instead of the 512-bit key.
If someone else wants to use a 512-bit key, they should use version 0.5.X or lower. 512-bit keys should not be used in 2024. They cannot be supported forever.

[pozda2]

Yes, it would be a good idea for the installation package to at least generate the nrpe_dh_2048.pem file. If he was the default it would be even better.