SSL on windows GLPI Agent proxy error 400

[robintheys-droid]

Hello,

I have configured a windows vm with GLPI Agent (version 1.15) as proxy relay, and it's working without issue as expected, but when I enable the ssl part , with lets-encrypt rsa cert, I get an error 400 Bad request.

How can I resolve ?

Regards,

[g-bougard]

Hello @robintheys-droid

I moved your issue as a Q&A discussion.

As you only shared part of this output, we are missing what you're trying to do. I understand you are using a curl client trying to contact the proxy agent on port 62355. But I don't understand why you're using curl and not an agent to test proxy.

[robintheys-droid]

So, I have:

• a glpi server on linux with ssl certificate --> working
• a windows agent send directly to glpi server --> working
• a windows agent as proxy , and a windows agent send inventory to proxy --> working
• a windows agent as proxy with ssl ,and a windows agent send inventory to proxy --> no working ( same config, just ssl enabled )

the curl command is only to show you the error, when I force an inventory on agent , it fails.

[g-bougard]

Use this FAQ to produce a really useful output:
https://help.glpi-project.org/faq/glpi/glpi#how-do-i-diagnose-an-ssl-connection-problem

You should also enable debug=2 on glpi-agent serving as proxy and share the log file part related to the connection attempt.

And also please share the configuration of the GLPI-Agent SSL server plugin you should have configure.

[robintheys-droid]

on the client who I try to send the inventory:

and on relay proxy:

ssl-server-plugin.local:

proxy-server-plugin.local:

[g-bougard]

The error here says it can't connect to server (here the proxy agent) as it "did not properly respond after a period of time". This means you have to check the proxy agent log to see if there's an error at the same time.
So can you share proxy agent log ?

[robintheys-droid]

[g-bougard]

I see indeed one problem: You setup ssl server on port 62355 and proxy is setup on the default port, here 62354.
If you need SSL and non-SSL proxy support, you may setup SecondaryProxy Server plugin with 62355 as port. If you only need proxy with SSL, don't forget to set port in proxy config to the same port than SSL config.

[robintheys-droid]

client side :

proxy side :

ssl config:

proxy config:

[g-bougard]

Now you have a certificate validation failure. You can try with --no-ssl-check. If you add --debug option, the output or the log will give you the value you can use for --ssl-fingerprint option. You can also try to use on proxy ssl configuration a certificate signed by a well-known certificate authority.

[robintheys-droid]

well the certificate is generated with lets encrypt dns challenge.

win11-relay:
logs:

[Wed Dec 10 10:34:16 2025][info] GLPI Agent service starting
[Wed Dec 10 10:34:16 2025][info] [http server] HTTPD Proxy Server plugin loaded
[Wed Dec 10 10:34:16 2025][info] [http server] HTTPD SSL Server plugin loaded
[Wed Dec 10 10:34:16 2025][info] [http server] HTTPD service started on port 62354
[Wed Dec 10 10:34:16 2025][info] [http server] HTTPD SSL Server plugin enabled on default port
[Wed Dec 10 10:34:19 2025][info] GLPI Agent memory usage: WSS=3833856 PFU=122212352
[Wed Dec 10 10:34:19 2025][info] target server0: next run: Thu Dec 11 08:49:20 2025 - https://test.glpi.xxxxx/

win11-client:
logs:

PS C:\Program Files\GLPI-Agent> .\glpi-agent.bat --logger=stderr --debug --force --no-ssl-check --ssl-fingerprint=00b5d5f648df335......
[debug] Logger backend Stderr initialized
[debug] Logger backend File initialized
[debug] GLPI Agent (1.15)
[debug] Configuration directory: C:/Program Files/GLPI-Agent/etc
[debug] Data directory: C:/Program Files/GLPI-Agent/share
[debug] Storage directory: C:\Program Files\GLPI-Agent\var
[debug] Lib directory: C:/Program Files/GLPI-Agent/perl/agent
[debug] Available tasks:
[debug] - Inventory: 1.22
[debug] - RemoteInventory: 1.8
[debug] target server0: server https://win11-relay.xxxxx:62354/proxy/glpi
[debug] Planned tasks for server0: Inventory,RemoteInventory
[debug] Provided by Teclib Edition
[debug] Installer built on Mon Jun  9 13:00:00 2025 UTC
[debug] Built with Strawberry Perl 5.40.2
[debug] Built on github actions windows image for glpi-project/glpi-agent repository
[debug] Running in foreground mode
[info] server0 is not ready yet, but run is forced
[info] target server0: server https://win11-relay.xxxxx:62354/proxy/glpi
[info] sending prolog request to server0
[error] [http client] internal response: 500 Server closed connection without sending any data back
[error] No supported answer from server at https://win11-relay.xxxxx:62354/proxy/glpi
PS C:\Program Files\GLPI-Agent>

[g-bougard]

If the proxy certificate is signed by let's encrypt, you can skip windows keystore by using --ssl-keystore=none. But the proxy hostname must match the certificate subject otherwise this won't work: for example, you can't reuse the certificate from the GLPI server without playing with client dns.

About your client try, --ssl-fingerprint=00b5d5f648df335...... seems wrong as it doesn't include the fingerprint algorithm at the beginning. For example, here is mine for a test server: --ssl-fingerprint="sha256$11ab97b452c5596d3aa50255d4e90700e6ed31103319807295464156946802bc"

Can you share the used public certificate in the private ticket so I can check it ?

[robintheys-droid]

as I don' t receive any new answer I will post here... so I removed the agent 1.15, because after all test , I receive an error 500. I installed the agent 1.14, with same config, and then I receive an error 400. SO I configured , port 80 and 443 for testing, port 80 works but 443 no...

clients logs:

• on port 443:

 Dec 12 17:24:38 2025][debug] Built with Strawberry Perl 5.40.2
[Fri Dec 12 17:24:38 2025][debug] Built on github actions windows image for glpi-project/glpi-agent repository
[Fri Dec 12 17:24:38 2025][debug] Running in foreground mode
[Fri Dec 12 17:24:38 2025][info] server0 is not ready yet, but run is forced
[Fri Dec 12 17:24:38 2025][info] target server0: server https://win11-relay.XXXXX/proxy/glpi
[Fri Dec 12 17:24:38 2025][debug2] [http client] Using Compress::Zlib for compression
[Fri Dec 12 17:24:38 2025][info] sending prolog request to server0
[Fri Dec 12 17:24:38 2025][debug2] [http client] sending message:
<?xml version="1.0" encoding="UTF-8"?>
<REQUEST>
  <DEVICEID>win11-client-2025-12-12-13-20-14</DEVICEID>
  <QUERY>PROLOG</QUERY>
  <TOKEN>12345678</TOKEN>
</REQUEST>
[Fri Dec 12 17:24:38 2025][error] [http client] communication error: 400 Bad Request
[Fri Dec 12 17:24:38 2025][error] No supported answer from server at https://win11-relay.XXXXX/proxy/glpi

....

• same config on port 80:

   "partial": true
}
[debug2] [http client] B1607EEC: received message:
{
   "expiration": "4s",
   "status": "pending"
}
[debug2] [http client] B1607EEC: retry request after pending status
[debug2] [http client] B1607EEC: received message:
{
   "expiration": "24",
   "status": "ok"
}
[debug] Remote inventory task execution disabled: no remote setup
[info] running task ESX
[debug2] [http client] Not using compression
[debug2] http://win11-relay.XXXXX/proxy/glpi?action=getConfig&machineid=win11-client-2025-12-12-13-20-14&task[ESX]=2.13
[info] No job schedule returned by server0
[debug] NetInventory task execution not requested
[debug] NetDiscovery task execution n

proxy agent:

on port 443

[Fri Dec 12 17:24:39 2025][debug] [ssl server plugin] HTTPD started new SSL session
[Fri Dec 12 17:24:39 2025][debug] [http server] POST request /proxy/glpi from client X.X.X.X via plugin
[Fri Dec 12 17:24:39 2025][error] [http server] unknown path: /proxy/glpi
[Fri Dec 12 17:24:39 2025][debug] [http server] response status 400

......

same config on port 80
[Fri Dec 12 17:29:50 2025][debug2] Proxy[-5912] finished
[Fri Dec 12 17:29:50 2025][debug] [http server] GET request /proxy/glpi from client X.X.X.X via plugin
[Fri Dec 12 17:29:50 2025][debug] forking process -6380 to handle Proxy request
[Fri Dec 12 17:29:50 2025][debug2] Proxy[-6380]: forked
[Fri Dec 12 17:29:50 2025][debug2] [proxy server plugin] application/json type request from X.X.X.X
[Fri Dec 12 17:29:50 2025][debug] [proxy server plugin] action=getConfig&machineid=win11-client-2025-12-12-13-20-14&task%5BESX%5D=2.13 request from X.X.X.X, sending nothing to do
[Fri Dec 12 17:29:50 2025][debug] [proxy server plugin] response status 200
[Fri Dec 12 17:29:50 2025][debug2] Proxy[-6380] finished

[g-bougard]

Hi @robintheys-droid

I took time to test myself with the datas you shared and it seems you're right this kind of configuration probably doesn't work on windows. To be honest, I don't remember if I tested myself during its writing if SSL plugin and Proxy plugin could work together in windows environment.

My advice would be to try setting SSL proxy on a linux computer.

Actually, I'm not sure to find how to implement correctly this feature on windows knowing glpi-agent is coded in perl on windows and in the context of adding ssl support with multi-threading support at the same time. I mean in a reasonable time of course.