Werk #22255: Linux agent: Fix encrypted agent output on hosts with OpenSSL older than 1.1.1

Component	Checks & agents
Title	Linux agent: Fix encrypted agent output on hosts with OpenSSL older than 1.1.1
Date	Oct 13, 2026
Level	Trivial Change
Class	Bug Fix
Compatibility	Compatible - no manual interaction needed
Checkmk versions & editions	3.0.0b1 Not yet released Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT 2.5.0p16 Not yet released Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

This werk affects you if you use symmetric agent encryption (ruleset Encryption (Linux, Windows) or encryption.cfg) with the legacy pull mode of the Linux agent, on hosts with an OpenSSL version older than 1.1.1, for example RHEL/CentOS 7. Hosts registered for TLS via cmk-agent-ctl are not affected.

Since Checkmk 2.5.0, the Linux agent sent garbage instead of the encrypted agent output on such hosts. When running check_mk_agent -d, you saw errors like printf: missing hex digit for \x. Checkmk failed to decrypt the output with Decryption failed: MAC mismatch, so these hosts could not be monitored any more. Encrypted real-time checks were affected in the same way.

To fix this, update the agent on the affected hosts.

To the list of all Werks