Cannot parse keystore-export/temp.cer as PEM X509

[zedalaye]

Bug reporting acknowledgment

Yes, I read it

Professional support

Yes, I know

Describe the bug

Hello,

I just installed and configured the GLPI Agent v1.15 on my Windows machine and I get this error in the log :

[Wed Jul 23 10:59:26 2025][error] cannot parse C:/Program Files/GLPI-Agent/var/keystore-export-2qSjQi/temp.cer as PEM X509 cert: error:0680007C:asn1 encoding routines::illegal characters at C:/Program Files/GLPI-Agent/perl/agent/GLPI/Agent/HTTP/Client.pm line 694 thread 1.****

The full log is :

[Wed Jul 23 10:59:23 2025][info] GLPI Agent service starting
[Wed Jul 23 10:59:24 2025][info] [http server] HTTPD service started on port 62354
[Wed Jul 23 10:59:24 2025][info] GLPI Agent memory usage: WSS=3899392 PFU=116789248
[Wed Jul 23 10:59:24 2025][info] target server0: next run: Wed Jul 23 10:59:23 2025 - https://glpi.crisalid.xyz/front/inventory.php
[Wed Jul 23 10:59:24 2025][info] target server0: server https://glpi.mycompany.xyz/front/inventory.php
[Wed Jul 23 10:59:24 2025][info] sending prolog request to server0
[Wed Jul 23 10:59:26 2025][error] cannot parse C:/Program Files/GLPI-Agent/var/keystore-export-2qSjQi/temp.cer as PEM X509 cert: error:0680007C:asn1 encoding routines::illegal characters at C:/Program Files/GLPI-Agent/perl/agent/GLPI/Agent/HTTP/Client.pm line 694 thread 1.
[Wed Jul 23 10:59:26 2025][info] target server0: next run: Wed Jul 23 11:54:20 2025 - https://glpi.mycompany.xyz/front/inventory.php

The Agent has been installed with these options :

SERVER=https://glpi.mycompany.xyz/front/inventory.php TAG=MyTag USER=MyUser PASSWORD=MyPassword RUNNOW=1

I found the server url, login and password as specified within the registry, so it seems that the install succeeded.

The server is installed in a Debian 12 VM with a local MariaDB, nginx and certbot to get LetsEncrypt certificates. The web app works as expected.

I also added a basic auth at location = /front/inventory.php { }

Here is my nginx configuration file :

server {

    server_name glpi.mycompany.xyz;

    root /var/www/glpi/public;

    location = /front/inventory.php {
        auth_basic "Inventaire GLPI - Accès Restreint";
        auth_basic_user_file /etc/apache2/.htpasswd;

        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    location / {
        try_files $uri /index.php$is_args$args;
    }

    location ~ ^/index\.php$ {
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/glpi.crisalid.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/glpi.crisalid.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = glpi.crisalid.xyz) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80;

    server_name glpi.mycompany.xyz;
    return 404; # managed by Certbot
}

To reproduce

Install the agent on a Windows machine ?

Expected behavior

The Agent can reach the server

Operating system

Windows

GLPI Agent version

v1.15

GLPI version

10.0.17, 10.0.18

GLPIInventory plugin or other plugin version

Not applicable

Additional context

No response

[zedalaye]

I tried to run the glpi-injector by hand :

C:\Program Files\GLPI-Agent>glpi-injector.bat --debug --file inventory.json --url https://glpi.mycompany.xyz
Loading inventory.json...[07985B9D] [agentid:a92887e3-6c3e-1014-bbe1-a478d83e2fff] ERROR: 500 Can't connect to glpi.mycompany.xyz:443 (certificate verify failed), Bad content as server response
DEBUG: Can't connect to glpi.mycompany.xyz:443 (certificate verify failed)

SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed at C:/Program Files/GLPI-Agent/perl/vendor/lib/LWP/Protocol/http.pm line 49.

These elements were not sent:
inventory.json

This is very bizarre.

[zedalaye]

It looks like it's due to the "Web Access Protection Policy" of ESET Endpoint Security.
If I exclude "perl/bin/glpi-agent.exe" from this service, the agent can send reports.