Package: icinga2-common Version: 2.4.7-1 Severity: normal Ohai,
icinga2-common ships with /etc/icinga2/pki/ owned by root:root and no snipet in postinst to change that: root@9b8f92292cf6:/# ls -alh /etc/icinga2/pki/ total 8.0K drwxr-xr-x 2 root root 4.0K Apr 21 16:44 . drwxr-x--- 9 nagios nagios 4.0K May 16 15:09 .. Thus, generating certs on a newly installed intance fails: root@9b8f92292cf6:/# icinga2 pki new-cert --cn $(hostname -f) --key /etc/icinga2/pki/$(hostname -f).key --cert /etc/icinga2/pki/$(hostname -f).crt information/base: Writing private key to '/etc/icinga2/pki/9b8f92292cf6.key'. critical/SSL: Error while opening private RSA key file '/etc/icinga2/pki/9b8f92292cf6.key': 33558541, "error:0200100D:system library:fopen:Permission denied" Chowning the folder to nagios:nagios solves the issue: root@9b8f92292cf6:/# chown nagios.nagios /etc/icinga2/pki/ root@9b8f92292cf6:/# icinga2 pki new-cert --cn $(hostname -f) --key /etc/icinga2/pki/$(hostname -f).key --cert /etc/icinga2/pki/$(hostname -f).crt information/base: Writing private key to '/etc/icinga2/pki/9b8f92292cf6.key'. information/base: Writing X509 certificate to '/etc/icinga2/pki/9b8f92292cf6.crt'. Greets Evgeni -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.5.0-2-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system)
