Need Check cert requireng cert,key and password as options
Posted: Fri Aug 02, 2013 3:23 pm
Is there a plugin that takes certs,keys and password for options to query & alert for certificate expirations? I can do this with openssl and I can identify the expiration date status but I don't know how to get Nagios to take notice and make alerts for warnings and critical.
My test script output that needs evaluated by Nagios to set alerts or better yet a plugin that you can enter certs,keys and passwords in. Thank you very much.
#!/bin/ksh
rm -f /tmp/certcheck.out
STATUS=0
TODAY=$(date +%s)
CERT=/home/monitor/ValidatePartnerCert/cert.pem
KEY=/home/monitor/ValidatePartnerCert/cert_key.pem
PASS=xxxxxxxx
CKDATE(){
CRTDATE=`date --utc --date "$EXPDATE" +%s`
if [[ $CRTDATE-$TODAY -lt 2592000 ]]; then
printf "\n Expiring in 90 days: Yes\n ", %s
STATUS=1
elif [[ $CRTDATE-$TODAY -lt 7776000 ]]
then
printf "\n Expiring in 90 days: No\n ", %s
STATUS=2
else
STATUS=0
fi
return $STATUS
}
for i in cert1.com:2222 cert2.com.:43 cert3:18443
do
EXPDATE=`openssl s_client -connect ${i} -cert ${CERT} -key ${KEY} -pass ${PASS} < /dev/null |openssl x509 -noout -enddate | sed s'/notAfter=//'`
#EXPDATE="Aug 2 14:13:30 GMT 2013" # for testing status
CKDATE
#cert=`openssl s_client -connect ${i} -cert ${CERT} -key ${KEY} -pass ${PASS} < /dev/null |openssl x509 -noout -subject| awk -F'CN=' '{print $2}'`
echo $i $STATUS
done > /tmp/certcheck.out
cat /tmp/certcheck.out
Expiring in 90 days: Yes
,cert1.com:2222 1
Expiring in 90 days: Yes
,cert2.com:443 1
Expiring in 90 days: Yes
,cert3.com:18443 1
My test script output that needs evaluated by Nagios to set alerts or better yet a plugin that you can enter certs,keys and passwords in. Thank you very much.
#!/bin/ksh
rm -f /tmp/certcheck.out
STATUS=0
TODAY=$(date +%s)
CERT=/home/monitor/ValidatePartnerCert/cert.pem
KEY=/home/monitor/ValidatePartnerCert/cert_key.pem
PASS=xxxxxxxx
CKDATE(){
CRTDATE=`date --utc --date "$EXPDATE" +%s`
if [[ $CRTDATE-$TODAY -lt 2592000 ]]; then
printf "\n Expiring in 90 days: Yes\n ", %s
STATUS=1
elif [[ $CRTDATE-$TODAY -lt 7776000 ]]
then
printf "\n Expiring in 90 days: No\n ", %s
STATUS=2
else
STATUS=0
fi
return $STATUS
}
for i in cert1.com:2222 cert2.com.:43 cert3:18443
do
EXPDATE=`openssl s_client -connect ${i} -cert ${CERT} -key ${KEY} -pass ${PASS} < /dev/null |openssl x509 -noout -enddate | sed s'/notAfter=//'`
#EXPDATE="Aug 2 14:13:30 GMT 2013" # for testing status
CKDATE
#cert=`openssl s_client -connect ${i} -cert ${CERT} -key ${KEY} -pass ${PASS} < /dev/null |openssl x509 -noout -subject| awk -F'CN=' '{print $2}'`
echo $i $STATUS
done > /tmp/certcheck.out
cat /tmp/certcheck.out
Expiring in 90 days: Yes
,cert1.com:2222 1
Expiring in 90 days: Yes
,cert2.com:443 1
Expiring in 90 days: Yes
,cert3.com:18443 1