SSL accept error: error:00000000:lib(0):func(0):reason(0)

All my external Monit instances are logging the following error ~ every minute: in /var/log/user.log

monit[475]: SSL accept error: error:00000000:lib(0):func(0):reason(0)

‌

The SSL stuff in the configuration file .monitrc is as follows:

set ssl {
    verify     : enable, # verify SSL certificates (disabled by default but STRONGLY RECOMMENDED)
    selfsigned : reject   # allow self signed SSL certificates (reject by default)
}

[...]

set httpd port 2812 and
    use address X.X.X.X  # only accept connection from localhost (drop if you use M/Monit)
    allow domain.de           # allow localhost to connect to the server and
    allow admin:XXXX      # require user 'admin' with password 'monit'
    with ssl {            # enable SSL/TLS and set path to server certificate
        pemfile: /etc/ssl/monit.pem
    }

‌

The /etc/ssl/monit.pem contains

cat /root/.acme.sh/domain.de_ecc/domain.de.key /root/.acme.sh/domain.de_ecc/fullchain.cer > /etc/ssl/monit.pem

‌

Running openssl s_client -connect domain.de:443 returns the following:

CONNECTED(00000003)
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust ECC Certification Authority
verify return:1
depth=1 C = AT, O = ZeroSSL, CN = ZeroSSL ECC Domain Secure Site CA
verify return:1
depth=0 CN = domain.de
verify return:1
---
Certificate chain
 0 s:CN = domain.de
   i:C = AT, O = ZeroSSL, CN = ZeroSSL ECC Domain Secure Site CA
 1 s:C = AT, O = ZeroSSL, CN = ZeroSSL ECC Domain Secure Site CA
   i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust ECC Certification Authority
 2 s:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust ECC Certification Authority
   i:C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
---
Server certificate
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
subject=CN = domain.de

issuer=C = AT, O = ZeroSSL, CN = ZeroSSL ECC Domain Secure Site CA

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 3288 bytes and written 467 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
    Session-ID: 3DBD898A74DA32A6BAD3D2C61BB70BE5A72535BA6FA00960C0D2BA0EBCB12EC5
    Session-ID-ctx: 
    Master-Key: 7099B7369302DFFE7EE7BB67B694BEBB11C2B30660FE732B568681D11A3FC267DD0D00D97F6438CD1643618989F38A33
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1687882143
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes

‌

Changing verify : enable to verify : disable does not change anything.

I think this behaviour appeared after I switched from Let’s Encrypt to ZeroSSL. But as both CAs are trusted it should not return this kind of error.

Maybe it is helpful to notice that the cert for domain.de is a wildcard cert now.

Apart from that everything works fine – so the logs are only annoying and I couldn’t identify anything not working related to them.

Some articles related to similar problems (not monit related unfortunately):

https://community.microstrategy.com/s/article/SSL-accept-error-error-00000000-lib-0-func-0-reason-0-error-appears-in-the-DSSErrors-log-while-the-SSL-authentication-works-both-on-Developer-and-Web-in-MicroStrateg?language=en_US

https://openssl-dev.openssl.narkive.com/1eoBAAYa/ssl-negotiation-failed-error-00000000-lib-0-func-0-reason-0

Comments (6)