Monitor SSL Certificate expiration

[Elizabeth K. Joseph]

Deploy a mechanism to monitor SSL Certificate expiration dates.

Ideas:

cron certwatch script

Nagios plugin (it's a bit much to set up Nagios just for this one check)

Hosts to check (possibly not an exhaustive list) & current expiration:

review.o.o expires July 29, 2013
jenkins.o.o expires July 29, 2013
etherpad.o.o expires October 13, 2013
wiki.o.o expires December 18, 2013
www.openstack.org expires July 22, 2013.

[Kevin Bringard (kbringard)]

There's a nagios plugin to do this:

http://exchange.nagios.org/directory/Plugins/Network-Protocols/HTTP/check_ssl_certificate/details

I understand not wanting to setup nagios just for one check, but since it's just a perl script it should be somewhat easy to modify to run from cron and have it email a list of people when a certificate is about to expire:

./check_ssl_certificate -H host -p 443
m=Mar, d=19, h=23, m=59, s=59, y=2013, z=GMT
check_ssl_certificates: CRITICAL - only 0 day(s) left for this certificate.

[Jeremy Stanley (fungi)]

If certwatch doesn't work out, you can just install the nagios-plugins-contrib package without recommends and do something like I do to monitor my servers (my monitoring host just runs this out of /etc/cron.daily):

http://paste.openstack.org/show/37700/

Could certainly go fancier with it, but you get the idea...

[Elizabeth K. Joseph (lyz)]

I thought about it since Debian/Ubuntu doesn't currently package certwatch (it's more of a redhat thing). Turns out nagios-plugins-contrib doesn't exist in precise either. Testing now with ssl-cert-check configuration.

[Elizabeth K. Joseph (lyz)]

Ended up using ssl-cert-check package, change at https://review.openstack.org/#/c/30490/ to install everything via puppet to cacti server has been released.