check_ssl_cert needs host command which is missing in docker image

I'm building up a Docker-hosted Icinga2 installation (with Incinga Web and Director) managed in Coolify, just for context.

When adding a check for certificates of websites, I get the following output (real domain replaced with example.com):

/usr/lib/nagios/plugins/check_ssl_cert: 4665: host: not found
SSL_CERT CRITICAL: Cannot resolve app.example.com

The executed command is:

'/usr/lib/nagios/plugins/check_ssl_cert' '-H' 'app.example.com' '-c' '3' '-p' '443' '-w' '7'

When I go into the icinga2 container to test this and add the debug option to check_ssl_cert I see the following (irrelevant output cut for brevity):

icinga@36943fb9a1da:/$ /usr/lib/nagios/plugins/check_ssl_cert -d -H app.example.com -c 3 -p 443 -w 7
[DBG] Converting 3 days into seconds by shell function
[DBG] Converted 3 days into seconds: 259200
[DBG] Converting 7 days into seconds by shell function
[DBG] Converted 7 days into seconds: 604800
[DBG] check_ssl_cert version: 2.81.1
[...]
[DBG] Checking if the host is listed in /etc/hosts
[DBG] Host not found in /etc/hosts: checking DNS
[DBG] Checking if the host (app.example.com) exists
/usr/lib/nagios/plugins/check_ssl_cert: 4665: host: not found
[DBG] Cannot resolve app.example.com
[DBG] cleaning up temporary files
[DBG] exiting with CRITICAL
[DBG] ALL_MSG = 
[DBG] number of errors = 0
SSL_CERT CRITICAL: Cannot resolve app.example.com

To verify, I tried to call the host command:

icinga@36943fb9a1da:/$ host app.example.com
bash: host: command not found

As checking certificate is quite relevant for many people, I hope this can be corrected and the host command be installed in the docker container in the future.

I did look up in an Ubuntu installation that the needed package is bind9-host.

And, just to confirm that this is all that is needed to fix this one, I did the following:

root@host:~# docker exec -ti -u root 36943fb9a1da bash
root@36943fb9a1da:/# apt-get update
[...]
Reading package lists... Done
root@36943fb9a1da:/# apt-get install bind9-host
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  bind9-libs libfstrm0 libjemalloc2 libjson-c5 liblmdb0 libmaxminddb0 libprotobuf-c1 liburcu8t64 libuv1t64 libxml2
Suggested packages:
  mmdb-bin
The following NEW packages will be installed:
  bind9-host bind9-libs libfstrm0 libjemalloc2 libjson-c5 liblmdb0 libmaxminddb0 libprotobuf-c1 liburcu8t64 libuv1t64 libxml2
0 upgraded, 11 newly installed, 0 to remove and 3 not upgraded.
Need to get 2670 kB of archives.
After this operation, 7856 kB of additional disk space will be used.
Do you want to continue? [Y/n] 
[...]
root@36943fb9a1da:/# exit
exit
root@host:~# docker exec -ti 36943fb9a1da bash
icinga@36943fb9a1da:/$ /usr/lib/nagios/plugins/check_ssl_cert -H app.example.com -c 3 -p 443 -w 7
SSL_CERT OK - app.example.com:443, https, x509 certificate 'app.example.com' from 'Let's Encrypt' valid until Jan 27 00:00:00 2027 GMT (expires in 81 days)|days_chain_elem1=81;7;3;; days_chain_elem2=666;7;3;; days_chain_elem3=2127;7;3;; days_chain_elem4=2127;7;3;;

Thanks for creating this issue. Since I am currently reworking parts of the Containerfile anyway, I have included this in Icinga/icinga2#11161, which also bumps the check plugin to its latest release.

Navigation Menu

Repository navigation

check_ssl_cert needs host command which is missing in docker image #170

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

check_ssl_cert needs host command which is missing in docker image #170

Description

Activity

KaiRo-at commented on Nov 6, 2026

oxzi commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions