Issue when using external script to monitor certificate expiration

[Scrabbi]

Hello,

I have created a small script to check how many days I have left before my website certificates expires. When I execute my script using the user "zabbix" (which is the one used when an external script is used if I understood well) on my zabbix server, the script works fine and I get the number of days before expiration. However, once I create a host with a template, I get " Could not read certificate from /tmp/tmp.xxxxxx unable to load certificate 0".


Here you can find the script and the item :
The name of the host is "mysite.com" and is monitored by my zabbix server :
I found the script here : https://askubuntu.com/questions/1198...s-in-a-website



I did a bit of troubleshooting, and when I execute the script form my server, the tmp file is created and contains the certificate, but if it's from the item, the tmp file is empty.

I don't really know how to go from here, any help would be greatly appreciated.

Scrabbi

[cyber]

I am no linux admin, but I think there might be a difference, if script is executed as logged in user from command line and as background process by same user... There can be difference in env vars, shell etc.. missing PATH etc...

[Morris567]

This issue usually happens when the script behaves differently under Zabbix “external check” execution compared to manual execution. Even though it works when you run it as the zabbix user, Zabbix may be running it in a different environment where temporary file handling or permissions differ, which can result in an empty /tmp certificate file.

Common causes include:

• Different environment variables when run by Zabbix (missing PATH, HOME, etc.)
• /tmp write/read permission or isolation issues
• Script using relative paths or expecting interactive shell behavior
• External check process running in a restricted context

You can try:

• Using absolute paths everywhere in the script
• Explicitly defining environment variables inside the script
• Writing the certificate to a controlled directory (not /tmp)
• Adding logging to confirm whether the cert is actually fetched before parsing

Also, this kind of server/service monitoring setup is very similar in principle to how external services work in hosting environments. For example, a similar idea of checking system health or configuration consistency can be seen in services like the website monitoring and maintenance solutions used in real-world infrastructure setups.