icinga2 option generates self signed certificates that are rejected by master

[mngoe]

Hello ,

I have exactly the same issue as here : Icinga/icinga2#4728
I already have a dozen of icinga2 working node (configured without problem with the icinga2 node wizard).

But one of my node is not working.

Here is my version :

icinga2 --version
icinga2 - The Icinga 2 network monitoring daemon (version: r2.8.0-1)
Application information:
  Installation root: /usr
  Sysconf directory: /etc
  Run directory: /run
  Local state directory: /var
  Package data directory: /usr/share/icinga2
  State path: /var/lib/icinga2/icinga2.state
  Modified attributes path: /var/lib/icinga2/modified-attributes.conf
  Objects path: /var/cache/icinga2/icinga2.debug
  Vars path: /var/cache/icinga2/icinga2.vars
  PID path: /run/icinga2/icinga2.pid

System information:
  Platform: Ubuntu
  Platform version: 16.04.3 LTS (Xenial Xerus)
  Kernel: Linux
  Kernel version: 4.4.0-98-generic
  Architecture: x86_64

Build information:
  Compiler: GNU 5.3.1
  Build host: e3e567db57ba

In my icinga2.log file , here is my error :

[2017-11-18 19:38:34 +0100] information/ApiListener: New client connection for identity 'mydomain.com' from [91.X.X.X]:34276 (certificate validation failed: code 18: self signed certificate)
[2017-11-18 19:38:34 +0100] information/JsonRpcConnection: Received certificate request for CN 'mydomain.com' not signed by our CA.
[2017-11-18 19:38:34 +0100] information/JsonRpcConnection: Sending certificate response for CN 'mydomain.com' to endpoint 'socimed.com' (auto-signing ticket).
[2017-11-18 19:38:34 +0100] warning/JsonRpcConnection: API client disconnected for identity 'mydomain.com'

My request ticket generated on my Icinga 2 master seems to work fine, but my configurations on this node monitoring is not working.

Any idea why this specific node is not working?

[lbetz]

Sorry that no one could help you. I close the ticket.

[cactushydrocodone]

I have the same problem right now, the second time.
Its REALLY annoying.
As soon as this happens, its a "deadlock". You cannot add new hosts, its not possible.
Every new host will have a unverified cert signed by itself, somehow.