How to get the Certificate Common Name (FQDN) in the alerts description

Are the alarms in your first screenshot coming from the right DS? Looks like that alarm is coming from "SSL Certificate Expiration". Is that the same DS you built?

The common name is stored in the instance description right? If so, it should show up under the instance description in the alarm.

2 hours ago, Stuart Weenig said:

Are the alarms in your first screenshot coming from the right DS? Looks like that alarm is coming from "SSL Certificate Expiration". Is that the same DS you built?

The common name is stored in the instance description right? If so, it should show up under the instance description in the alarm.

1. yes the alarm are coming from the SSL Certificate Expiration

2. No I did not see the common name anywhere in the current Datasource it is why I was creating a new one with the script in this thread.

Hello,

I want to see the common name in the alert description but for now it is not displayed anywhere...

Thanks,

Dom

Yeah, I think you're getting your DataSources crossed. The one from your screenshot is called "SSLCerts-" (displayname="SSL Certificate Expiration"). That DS is not a scripted DS, so the changes you are making to the scripted DS "_SSL_Certificates" will not impact the alerts opened by "SSLCerts-". 

The SSLCerts- DS isn't meant to check all certs on a system, just those that are presented on a live web service discovered when the collector probes the TCP ports 443, 465, 636, and 5671. 

Took a peek at your account and it looks like the current version of the script stores the CN as the WildAlias, which is perfectly fine (and probably preferable to what you were showing in your screenshot above).  Let's talk about assumptions...

I assume that you are writing _SSL_Certificates as a replacement for SSLCerts-. 
I assume that you can fix the script error that is currently causing the "No Data" error on collection.

Given those two assumptions, the output of your collection script should look something like this (actual values made up):

Days: 25

(Technically there are other simpler ways that you could output your data, but this way leaves the door open to adding more datapoints later on if desired.)

Your datapoint "CommonName" doesn't need to exist. Instead, you need to create a datapoint and the key would be "Days".  You'd need to set a threshold on this datapoint so alarms open.

When an alert opens, you'd have the instance name in the alert, which is currently set to the CN. 

Thanks Stuart,

The source of the question I am trying to resolve is coming from the datasource called "SSLCerts-" (displayname="SSL Certificate Expiration") which is incomplete and missing data (missing the "Common Name") for our team to be able to use it.

The DS "_SSL_Certificates" has been created to try to collect the information needed like the “common name”. I used this one as it seems simpler to use and update than “SSLCerts”, I might be wrong, let me know.

So the SSLCerts- DS is fine as is and for testing I didn’t want to touch it…. As it is already active in Production even if it is incomplete so far. 

I am writing _SSL_Certificates as a replacement for SSLCerts- or as addition to it to provide more information

I will check for this error I did not see thanks for pointing it out the one causing the "No Data" error on collection.

The output is not enough for our technician as they need the common name to be able to renew the certificate this is a company requirement

I need the Common Name to be displayed as well as the Days before expiration both fields needs to there.

If it is possible to add the “Common Name” to the DS “SSLCerts-“ directly it is fine with me but I could not get it, it is why I went to the “_SSL_Certificates” which looks like will be able to display the “Common Name” and then I will adjust it to get the expiration date as well.

Thanks,
Dom

All of that makes sense and you are on the right track. The only thing i would add is that once you are getting the expiration date collecting successfully and the threshold set on the _SSL_Certificates DS, you might as well disable the SSLCerts- DS as you would be double alerting.

Thanks Stuart but apparently I do not get the "common name" is it buried somewhere else than 

##--------------- Discovery ------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Select-Object {$_.Thumbprint + "##" + $_.Thumbprint + "##" + $_.Subject + $_.CommonName} `
| Format-Table -HideTableHeaders
##--------------------------------------------##

$ !SSLCerts 10.32.156.78 443
Total received certs: 2
No.1 certificate
    CN        : CN=soprdscirius1.ad.xxxxxx.yyyy.zzz, OU=X Information Technology Services (MITS), O="Local, Los Angeles", STREET=757 Ww Plaza, L=Los Angeles, ST=CA, OID.2.5.4.17=90095, C=US
    Issued At : Fri Jun 23 17:00:00 PDT 2017
    Expire At : Tue Jun 23 16:59:59 PDT 2020
    Valid for : 5 days
No.2 certificate
    CN        : CN=InCommon RSA Server CA, OU=InCommon, O=Internet2, L=Ann Arbor, ST=MI, C=US
    Issued At : Sun Oct 05 17:00:00 PDT 2014
    Expire At : Sat Oct 05 16:59:59 PDT 2024
    Valid for : 1570 days
 

Thank,
Dom

Isn't the CN in the $_.Subject variable? It looks like it is. That would mean that the instance name is the CN. 

You don't need the CN in a datapoint. The only datapoint you need is the "valid for". If you wanted to make more complex datapoints that compare the issued or expiration dates to now, you could do that, but it's not required for what it seems you need.

Thanks Stuart, Yes on the certificate, or with the SSLCerts it appears in the subject line but it never shows up in the Alert ...

ID: LMD20268926
The SSL Certificate on SOPRDSCIRIUS1, port 443 , is going to expire in 7.0 days.

Thanks,
Dom

Your collect script still isn't outputting anything and you don't have a threshold. There can't be any alerts where this would show up.  What you're showing here is the alarm message from a completely different datasource.

Order of operations:

1. Get your collect script returning the number of days until expiration

2. Get your datapoint configured to read in the number of days into an actual datapoint

3. Set a threshold on the datapoint

4. Either build a custom alert message for that one datapoint (or modify the global alert template) to include the ##INSTANCE## token so that the instance's name is included in the email.

Either way, one datasource isn't going to add information to an alert from a different datasource. No matter what you do in _SSL_Certificates, it will not have any impact whatsoever on SSLCerts- alerts.