Nginx Plugin Doesn't Accept Self-Signed Certs

[njwhite]

Bug report

The nginx plugin doesn't allow you to specify a CA cert file to use,

Relevant telegraf.conf:

[[inputs.nginx]]
  ## An array of Nginx stub_status URI to gather stats.
  urls = ["https://myhost:3031/nginx_status"]

System info:

telegraf version: Telegraf v1.1.1 (git: release-1.1.0 94de9dca1fc6efb3a4bf3ec6869c356278c6755a)

uname -a: myhost 2.6.32-642.6.2.el6.x86_64 #1 SMP Wed Oct 26 06:52:09 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

Steps to reproduce:

1. Start an nginx server that uses a self-signed cert for SSL connections
2. Use the nginx plugin to gather metrics from it

Expected behavior:

The plugin gathers metrics from Nginx

Actual behavior:

2016/11/17 09:31:30 E! ERROR in input [inputs.nginx]: Errors encountered: [error making HTTP request to https://myhost:3031/nginx_status: Get https://myhost:3031/nginx_status: x509: certificate signed by unknown authority]

[phemmer]

Note you can put the cert in the system certs path: /etc/ssl/certs on unix (https://golang.org/src/crypto/x509/root_unix.go#L16)

Not saying the plugin shouldn't be able to load non-system CA certs, just providing it as a possible solution.

[njwhite]

@phemmer thanks - however I don't have root access on the machines I'm running telegraf on, so can't update the system certs. Separately, I don't think skipping SSL validation (#2142) should be encouraged by adding mainline support for it!

[bobmshannon]

@njwhite This should be fixed via #2883 which was recently merged, and included in the 1.4.0 release