Werk #20210: mk_jolokia: Trust the certificate store of the monitored host for HTTPS connections
| Component | Checks & agents | ||||||
| Title | mk_jolokia: Trust the certificate store of the monitored host for HTTPS connections | ||||||
| Date | Sep 16, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Bug Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
The agent plug-in mk_jolokia verifies the certificate of the Jolokia server when it connects via HTTPS.
Previously, only the CA bundle shipped with the Python requests library was consulted for this.
A CA that was only known to the operating system, for example a company CA imported into the Windows certificate store, was not trusted.
Connections to a Jolokia server using such a certificate failed with an error like [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain.
The plug-in now additionally trusts the certificate store of the monitored host.
On Windows this is the Windows certificate store, on Linux these are the CA certificates installed on the system.
The CA bundle shipped with requests is still trusted, so connections that worked before keep working.
This applies to the default configuration only.
If verify (or the legacy cert_path) in jolokia.cfg points to a CA file, only that file is trusted, as before.
Setting verify to False still disables the verification of the server certificate.