SSL monitoring with Zabbix

[szremo]

Dear Zabbix forum,
I would like to share you my solution to monitoring SSL certificate on each website.

That has been configured based on external check.

First of all, simple script has been prepared and placed in /externalcheck directory

  
 root@zabbix:/# cat /etc/zabbix/externalscripts/ssl_valid.sh  
#!/bin/bash
#Prepared by Marcin 'szremo' Szremski'
SSL_DATE=$(echo | openssl s_client -servername $1 -connect $1:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | awk -F = '{ print $2 }' | awk 'BEGIN {OFS = "-"} {print $1,$2,$4}')
EXPTIME=$(date -d$SSL_DATE +%s)
TODAY=$(date +"%b-%d-%Y")
CURRENT=$(date -d$TODAY +%s)
NUM=$(($EXPTIME - $CURRENT))
RESULT=$(($NUM/86400))
echo $RESULT

Next, template has been prepared which execute that script once per day(value of Update interval):


Pls. note that if your host in Zabbix is different that FQDN of your web site you should replace{HOST.NAME} by FQDN. Last think is to setup a triggers, in my case as on picture below:



And result for host called Zabbix.com

[rvanderkooi]

Many thanks! This working perfect for me!

[sancho]

Great!!!!

Thank you szremo

[Hamardaban]

Thanks!
for FreeBSD:

#!/bin/sh
#Prepared by Marcin 'szremo' Szremski'
# set locale of date in cert
LC_ALL=en_GB.UTF-8
export LC_ALL
SSL_DATE=$(echo | openssl s_client -servername $1 -connect $1:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | awk -F = '{ print $2 }' | awk 'BEGIN {OFS = "-"} {print $1,$2,$4}')
EXPTIME=$(date -j -f "%b-%d-%Y" $SSL_DATE +%s)
CURRENT=$(date -j +%s)
NUM=$(($EXPTIME - $CURRENT))
RESULT=$(($NUM/86400))
echo $RESULT

[wladimir50]

good stuff! working like a dream for me.
THANKS!

[alientm]

Dziękuję

[nilldot]

Guys, Any chance you could attache the template please ?

[Alex G]

This is good, but it would be cool to do this in preprocessing on the JS.

[gofree]

This is good, but it would be cool to do this in preprocessing on the JS.

I think not as its "preprocessing". Maybe some ugly way with trapper item and after use preporcessing. But I dont think it will be possible with duktape ( javascript engine in zabbix ) what I've googled a bit. I found something for nodejs engine - this doesnt help I guess

https://github.com/dyaa/ssl-checker

[rafael.mendes]

I have a error in "Last Data"...

The error:

################################################## ###################
2020-12-08 00:13:22

unable to load certificate
140244526622608:error:0906D06C:PEM routines:PEM_read_bio:no start lineem_lib.c:707:Expecting: TRUSTED CERTIFICATE
date: invalid date '+%s'
-18604
################################################## ###################

[LenR]

You can also parameterize the port if it's not always 443 :-)

[DRO]

I have a error in "Last Data"...

The error:

################################################## ###################
2020-12-08 00:13:22

unable to load certificate
140244526622608:error:0906D06C:PEM routines:PEM_read_bio:no start lineem_lib.c:707:Expecting: TRUSTED CERTIFICATE
date: invalid date '+%s'
-18604
################################################## ###################

Same problem I have, did you ever fix it?