In this chapter, we explored the built-in Zabbix encryption that is supported between all components—server, proxy, agent, zabbix_sender, and zabbix_get. While not supported for the Java gateway, a Zabbix proxy could easily be put in front of the gateway to provide encryption back to the Zabbix server.
Zabbix supports pre-shared key and TLS certificate-based encryption and can use one of three different backend libraries—OpenSSL, GnuTLS, or mbedTLS. In case of security or other issues with one library, users have an option to switch to another library.
The upgrade and encryption deployment can be done in steps. All Zabbix components can accept multiple connection types at the same time. In our example, the agent would be set up to accept both encrypted and unencrypted connections, and when we would be done with configuring all agents for encryption, we would switch to encrypted connections on the server side. Once that would be verified to work as expected, unencrypted connections...