How to monitor website SSL certificate expiration without agent

[Cidverk]

I have to monitor several websites certificates expiration date but without agent.
I know there is a template with Agent but I have to monitor several appliances where I can't install an agent.
Do you have any idea ? I am new to Zabbix

[key32981]

Did you ever figure out how to do this? I was able to setup the agent2 Certificate checks for some systems however i need to setup several SSL checks for sites living on systems without the ability for a Zabbix agent.

[kazzur]

Check this out

https://woshub.com/monitor-domain-name-expiration-zabbix/

[artyomtsybulkin]

You can execute and parse result of this script / command on server with curl 8.4.0. Ensure you have correct DNS settings too.

curl --cert-status -v https://google.com

[mfuk]

I use the agent installed on Zabbix Server v 6.0 and I created an Item like below:

[solution]

If you prefer ready-to-use solutions, visit:

https://www.zabbix.com/integrations/ssl

Note: you can use the zabbix server itself as a host for these checks.


Wellington

[kazzur]

Check this

https://github.com/a-stoyanov/zabbix-domain-expiry

[[email protected]]

If you prefer ready-to-use solutions, visit:

https://www.zabbix.com/integrations/ssl

Note: you can use the zabbix server itself as a host for these checks.


Wellington

Hmmm... I can't get the "Note: you can use the zabbix server itself as a host for these checks." to work.

[artyomtsybulkin]

Try to assign template on agent (you need Zabbix Agent 2 v5.0 - v7.0). Then follow instructions from here: https://www.zabbix.com/integrations/...ificate_agent2 - you need to define macroses. For sure, you can use server agent if it is agent 2, and your target must be reachable by fqdn.

[solution]

Using the Zabbix Server (if you are using zabbix agent 2) was just a suggestion.

You can use any host that is using "zabbix agent 2".

Screenshot of my usage **I use the Zabbix Server itself for this




Remembering that now there is the template for Zabbix Agent 2 Active too.
v7: https://git.zabbix.com/projects/ZBX/...Frelease%2F7.0

Wellington

[[email protected]]

I'm seeing this when I use 127.0.0.1: "Get value from agent failed: Cannot establish TCP connection to [[127.0.0.1]:10050]: [111] Connection refused"
and this when I use zabbix-agent: "Get value from agent failed: TCP successful, cannot establish TLS to [[zabbix-agent]:10050]: SSL_connect() I/O error: [104] Connection reset by peer"

I belive it is running from the Zabbix server but I can't check if it is agent 2 - I'll be back in a couple of days.

[solution]

If you are going to use the Zabbix Server and do not have SSH access to the server, you can use the "agent.variant" key

https://www.zabbix.com/documentation/7.2/en/manual/config/items/itemtypes/zabbix_agent#agent.variant

Create an item with this key and you will know if it is "Agent" or "Agent 2".

127.0.0.1: You should only create a host with this IP if you intend to use the Zabbix Server itself for the desired monitoring.
**See the "Zabbix Server" Host, it can be with localhost or with hostname and follow the same model when creating the new host for certificate monitoring.

Wellington

[[email protected]]

Nice - that should be a standard item in the template.

My problem was the encryption - it seems that the agent on the Zabbix server runs without encryption, I have to talk with the guy who installed it.