Certificate validation date check

[lado]

I needed quite some time to figure out how to check certificate validity, but I am still not certain if this is correct. The goal is to be reminded 10 days before certificate expiration date.

As item I use SSH agent and foloowing command to get epoch time of certificate expiration date:

date --date="$(openssl x509 -enddate -noout -in /root/mycert.pem | cut -d= -f 2)" +'%s'

For trigger expression I use:

{KDD:ssh.run[certificate_validity_item].fuzzytime(86400)} = 0

My question is if this is correct way to test validity of certificate. The documentation for fuzzytime just states that fuzzytime checks the difference between item timestamp value and Zabbix server timestamp. But what does this difference mean? Is server timestamp extracted from item timestamp or vice versa? Whill I get notification 10 days before the expiration date or 10 days after it? Are there any better ways to do this.

[Ivo]

I think "86400" seconds - it is one day no 10..

[lado]

You are right. It should be 864000.

[Ivo]

Not sure where is the problem..
Create the item, create the trigger and set fuzzy time smaller than certificate's remaining time and you'll see -will it work or not...

[lado]

The problem is within understanding fuzzytime function.

Should it be
{KDD:ssh.run[certificate_validity_item].fuzzytime(86400)} = 0
or
{KDD:ssh.run[certificate_validity_item].fuzzytime(-86400)} = 0

I would like to be notified 10 days before certificate expires, not 10 days after that.

[Ivo]

D'oh..
Create few test items with past and future unix timestamps values, add the fuzzytime triggers an you will see then how it works