Page 1 of 1
check_http SSL Certificate expiration time
Posted: Tue Nov 03, 2015 4:50 pm
by jwelch
I don't know if this is a bug in check_http or a misconfiguration on my side, but when I check an SSL certificate in Nagios XI
the summary output shows the expiration time in localtime (EST), but the time is actually GMT.
I believe check_http *should* say (Sun 08 Nov 2015 8:59:00 PM EST)
I know, what's 5 hours, but it says it expires 5 hours after it actually does and it doesn't match the
expiration checks I have for F5 BigIP virtual servers so it confuses folks when they overlap.
From firefox:
Not After details:
11/08/2015 18:59:59
(11/08/2015 23:59:59 GMT)
from check_http:
(Sun 08 Nov 2015 11:59:00 PM EST)
Re: check_http SSL Certificate expiration time
Posted: Tue Nov 03, 2015 5:12 pm
by rkennedy
Can you verify what timezone your server is running in with
date?
I checked on two machines, and it looks to default to whatever timezone your machine is set at.
Code: Select all
[root@localhost libexec]# ./check_http -H google.com -f follow -C 1
OK - Certificate '*.google.com' will expire on Tue 19 Jan 2016 12:00:00 AM PST.
[root@localhost libexec]# date
Tue Nov 3 14:09:16 PST 2015
Code: Select all
[root@localhost libexec]# ./check_http -H google.com -f follow -C 1
OK - Certificate '*.google.com' will expire on Tue 19 Jan 2016 12:00:00 AM CST.
[root@localhost libexec]# date
Tue Nov 3 16:11:41 CST 2015
You have raised a good point though regarding when the certificate ACTUALLY expires. I will speak to the developers about this.
Re: check_http SSL Certificate expiration time
Posted: Wed Nov 04, 2015 11:35 am
by jwelch
Yes, it *says* EDT, but the rest is actually GMT with 'EDT' tacked on at the end (currently 5 hour offset).
It's compiled 'C' so I'm having trouble finding out where the date conversion is taking place.
I checked the latest (as of last week anyway) versions of nagios-plugsins and monitoring-plugins
and both gave the same results so it's either a misconfiguration on my end or an old bug that
nobody noticed from way back. I tried check_http on a couple of other RHEL 6 boxes and they
also gave the same results. It's not a critical bug, just annoying, but probably easy to fix.
Re: check_http SSL Certificate expiration time
Posted: Wed Nov 04, 2015 3:11 pm
by rkennedy
I spoke with our developers and this indeed is an issue. I have reported it to the nagios-plugins Github at this point. (
https://github.com/nagios-plugins/nagio ... issues/119 )
Feel free to contribute with your input on top of what I wrote, the more the merrier.
As this has been addressed, and a bug report filed - do you mind if I close this thread now?
Re: check_http SSL Certificate expiration time
Posted: Wed Nov 04, 2015 6:45 pm
by jwelch
Yes, please close this issue.
Thanks for your help!
Re: check_http SSL Certificate expiration time
Posted: Thu Nov 05, 2015 9:55 am
by lmiltchev
Locking the thread.