Monitoring SSL certificate expiration with Nagios

by

Hi Lads,

This is a post for nerds so I’m writing it in English. If you don’t understand English or technical stuff please close this page 😀
I’m at work and I’ve just finished to write a Nagios script to monitor expiration date of a SSL certificate.

I wanna share it with you.

To have the script working properly you just need to install OpenSSL and let the openssl
command be in your PATH environment.

This is the usage:

Usage:
check_ssl_cert.sh hostname port [warningdays]

Warning days default value is 30 days.

Some examples:

[afailla@terminus ~]$  /usr/local/nagios/bin/check_ssl_cert.sh google.com 443
OK: Certificate is valid for 289 days expires on May  2 17:02:55 2009 GMT

[afailla@terminus ~]$  /usr/local/nagios/bin/check_ssl_cert.sh google.com 443 400
CRITICAL: Certificate will expire in 289 days on May  2 17:02:55 2009 GMT

Download the script here and enjoy it.

12 thoughts on “Monitoring SSL certificate expiration with Nagios”

  1. Pingback: Bookmarks about Informatica
  2. Pingback: Recent URLs tagged Nagios - Urlrecorder

  4. check http in effetti controlla di default la porta https (443), ma con il parametro -p ovviamente si può deviare verso qualsiasi porta quindi ad esempio:
    /usr/lib/nagios/plugins/check_http http://www.verisign.com -C 14 -p 80
    CRITICAL – Cannot make SSL connection
    5888:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:583:
    CRITICAL – Cannot retrieve server certificate.

    Reply

  5. ah talaltro check_http funziona solo con https… guarda:

    fenix# ./check_http -w 5 -c 10 --ssl -H mail.dyne.org -C 10
OK - Certificate will expire on 02/04/2009 19:45

    ma tcpdump dice:

    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on fxp0, link-type EN10MB (Ethernet), capture size 96 bytes
23:48:17.876656 IP fenix.olocolors.org.54234 > tamarindo.dyne.org.https: S 2542887467:2542887467(0) win 65535

    quindi non ho scritto proprio qualcosa di inutile…

    Reply

  7. ok thanks,
    il problema e’ che nell’ambiente io cui lavoravo io c’e’ una versione dei plugin nagios purgata di tutto. e check_http e’ un binario C compilato, che in quella installazione non esiste 😀

    quindi cari lettori, dite grazie al mio omonimo.
    comunque per dare un servizio migliore ai lettori il comando giusto e’ per esempio:

    fenix# ./check_http -w 5 -c 10 --ssl -Hwww.verisign.com -C 10
OK - Certificate will expire on 05/08/2009 23:59.

    dove C indica il numero di giorni.

    This plugin can also check whether an SSL enabled web server is able to serve content (optionally within a specified time) or whether the X509 certificate is still valid for the specified number of days.
    Examples:

    CHECK CONTENT: check_http -w 5 -c 10 –ssl -H http://www.verisign.com

    When the ‘www.verisign.com’ server returns its content within 5 seconds, a STATE_OK will be returned. When the server returns its content but exceeds the 5-second threshold, a STATE_WARNING will be returned. When an error occurs, a STATE_CRITICAL will be returned.

    CHECK CERTIFICATE: check_http -H http://www.verisign.com -C 14

    When the certificate of ‘www.verisign.com’ is valid for more than 14 days, a STATE_OK is returned. When the certificate is still valid, but for less than 14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when the certificate is expired.

    Reply

  11. ci sono dei linguaggi di scripting per windows come WSH (windows scripting host) ma fanno cacare in confronto alle shell UNIX.
    se proprio devi farlo in windows installa cygwin.
    il .bat in realta’ e’ obsoleto. ms pusha WSH.

    per tenerti aggiornato usa qualsiasi aggregatore di FEED RSS (si, anche google reader).

    Reply

  12. Che post nerdoso! lol
    Domanda da noob: cmd e’ la shell di Windows ed e’ il corrispettivo di Bash (shell testuale). E’ possibile fare la stessa cosa in Windows? Oppure bisogna installarsi altre shell tipo cygwin o win-bash??? Il corrispettivo del file .sh nel mondo windows sarebbe il famoso .bat?
    saluti

    PS: per tenermi aggiornato su questo post in automatico senza dover rivisitare il tuo blog come faccio? vorrei usare “google reader” si puo’?

    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.