Discussion thread for official Zabbix Template TLS/SSL certificates monitoring

[AlexL]

This thread is designed to provide grounds for discussion of the official Zabbix Template for TLS/SSL certificates monitoring.
The template and details of the template will be available in GIT repository.
Please note that this template requires Agent2 with compiled with TLS/SSL Certificate monitoring support.
To learn about Agent2 please see the documentation: https://www.zabbix.com/documentation...oncepts/agent2
Additional videos describing Agent2 are available on YouTube: https://www.youtube.com/watch?v=OWj2pk_I-rI


Zabbix is always looking for ways to improve our services and to make our users happier.
We pride ourselves on doing our best each and every day, but we know that there is always something more to learn.
We would like to hear back from you to know what have you liked and what would you improve in the template.

[Atsushi]

Hi bormo,
What is the detailed version of Zabbix Agent 2 you are using? If it is not 5.4.4, please upgrade to 5.4.4 and try it.

[bormo]

Thanks for the quick response.
I could solve it this way. On the documentation page there is no hint about this specific (latest) minor version to use.

[idmrty]

Does it check the revocation status? A crucial thing.

[altuhovsu]

And is it possible to check multiple tls/ssl certs on the same machine? For example, tls on IMAP, SMTP ports and ssl on HTTPS?

[bormo]

Hi all,

I get this error:

ZBX_NOTSUPPORTED: Unknown metric web.certificate.get

I'm using Zabbix Agent2 installed from the Zabbix 5.4 Repo for Ubuntu20.04

I see the hint: "Setup and configure zabbix-agent2 with the WebCertificate plugin." but no idea how to include this plugin although it is out-of-the-box regarding to this page:

https://www.zabbix.com/documentation/current/manual/config/items/plugins

[capvi]

Hi, you must update to version 5.4.4-1.

[Atsushi]

Hi bormo,
What is the detailed version of Zabbix Agent 2 you are using? If it is not 5.4.4, please upgrade to 5.4.4 and try it.

[bormo]

Thanks for the quick response.
I could solve it this way. On the documentation page there is no hint about this specific (latest) minor version to use.

[Daniel4711]

Hello all,

I would like to use this plugin.

https://www.zabbix.com/de/integrations/ssl

The note at point 1 that you should configure Agent2 to use the WebCertificate plugin is unfortunately very brief.
Is it possible to expand this with an example?

[AlexL]

Hello all,

I would like to use this plugin.

https://www.zabbix.com/de/integrations/ssl

The note at point 1 that you should configure Agent2 to use the WebCertificate plugin is unfortunately very brief.
Is it possible to expand this with an example?

For this plugin the configuration is done only through template or agent key. There is no requirements to do any configuration through config as there is none.
Hope that helps to answer the question.

[clarker4]

Hi I am current having the same issue and I am using zabbix agent 5.2 any suggestions because Im getting the ZBX_NOTSUPPORTED: Unknown metric web.certificate.get error

[Colttt]

the most disadvantage is that is not possible to use {HOST.DNS} in {$CERT.WEBSITE.HOSTNAME}, so I should use localhost (which give an error with a not valid cert) or I must edit it in all(!) web server - which is very annoying

[Bjorke]

Is it an issue using localhost (the zabbix servers) agent to monitor several SSL certificates?
Or is there another way of doing it if you want to monitor multiple certificates on servers you don't have the agent on?

[corinthe]

Hi everyone,

Bjorke, I have already think about that because I will have the same issues : I was thinking to create a template for each certificate for my side.

I am because I am facing the same issues as borno : ZBX_NOTSUPPORTED: Unknown metric web.certificate.get

But I have a Zabbix server 5.0 and I downloaded the 5.0 release : https://git.zabbix.com/projects/ZBX/...Frelease%2F5.0
I don't find the problem so I am coming to you if you have any idea of what I have to do.

Than you in advance !

[Colttt]

you need zabbix >=5.4.4 also on agent side

[corinthe]

Colttt, I just found : you don't need a 5.4.4 agent, I just installed a 5.0.16 agent and it works. I noticed that on the logs you have "WebCertificate Plugin" so I checked if I have on my actual agent and it was not the case.

[shoemocker]

I got this configured and working with 1 certificate. I was able to test a good SSL cert and a bad SSL cert and everything works as expected. Thank you!

I am running into issues figuring out how one can monitor multiple SSL certificates with this? If I try to clone the template and change the macro for {$CERT.WEBSITE.HOSTNAME} and then add it to the same machine it says the same keys are in use. So do we have to make unique keys and templates for every certificate we want to monitor or is there an easier way to do this I am not seeing?

[clarker4]

Recieving the same error: ZBX_NOTSUPPORTED: Unknown metric web.certificate.get

I am running on Zabbix 5.2.6 also running the same agent 5.2.6. what are my options?

[Atsushi]

web.certificate.get is not available in Zabbix 5.2. Zabbix Agent 2 with Zabbix 5.4.4 or later is required.

[guilhermeboczkovski]

I still have the same doubt as others who posted on this forum. Is there any way to check multiple tls/ssl certs on the same machine?

I tend to think that there isn't, because the documentation doesn't say it's possible, but it doesn't explicitly say that it's not possible either.

[oernii]

I just began using this. I also find it limiting to be able only to monitor 1 web on 1 host with this. Most my webservers have multiple virtualhosts with multiple certificates. I now have to either create separate hosts for each web


Edit: so, separate host for web isn't feasible either, as it need agent2 to run, so no "virtual" host.

[Atsushi]

You can specify the host name by using the item key web.certificate.get[] directly. You can set multiple FQDNs on one host, so please review the monitoring settings.

[oernii]

Atsushi: yes, you can use the item directly, but you'll lose all the work that has gone to the template (evaluation and triggers). For now I just copied the template to another template, changed the macros and so aplied them to one host.