Simple Check for SSL Cert Expiration Monitoring

Monitoring SSL Certificate expiry days can be done in LogicMonitor by making use of datasource SSLCerts- (SSL Certificate Expiration). On the side note, SSL Certificate is used for certifying a web server that does the secured socket layer data encryption between a web server and a client (web browser). SSL Certificate is issued by several organizations/companies so called Certificate Authority (CA) for the purpose of providing the legitimacy of the web servers that encrypt the data for communication. The certificates issued will be digitally-signed by those CA and can be trusted by the client based on Root Certificates installed in the common browsers. It is, however, possible to create a self-signed certificate, which in this case is used for a testing purpose. Data will still be encrypted but the certificate will not be trusted by the client browsers.

When a device with SSL Cert installed has been added to LogicMonitor, rightfully that datasource will be auto-applied, as with other normal datasources, and after some collection cycles, the data of the certificate remaining days to expire should appear. Under the circumstances whereby the monitoring does not work as per normal, common recommendation will be to go through the following simple procedures:

1) Device check, whether or not the SSL Certification has been configured properly

2) Accessibility from collector

3) Data collection test from collector

1) For a start is to check if the SSL certificate configuration is properly done in the web server

- Each web server may have a different way of setting up the certificate, the following is an example for NGINX & IIS:


<span class="pln">ssl_certificate "/etc/cert/nginx/private/[cert name].crt";
ssl_certificate_key "/etc/cert/nginx/private/[cert name].key";</span>

- An open port check would be good as well with below output from the check (note: port is bound to any interfaces or possibly only one interface on the web server):

Linux:


<span class="pln">tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN</span>

Windows:


<span class="pln">TCP    0.0.0.0:443            0.0.0.0:0              LISTENING</span>

2) The next check will be to access the web server from the collector (obviously the collector must be able to reach to the device where the web server is installed):

Note: Collector debug window is needed for this check, please refer to this article: https://www.logicmonitor.com/support/settings/collectors/using-the-collector-debug-facility/

- the main command is simply: !http (help !http will give info for the command itself)


<span class="pln">$ </span><span class="pun">!</span><span class="pln">http https</span><span class="pun">:</span><span class="com">//10.13.13.9</span><span class="pln">
HTTP response received at at</span><span class="pun">:</span><span class="pln"> </span><span class="lit">2017</span><span class="pun">-</span><span class="lit">03</span><span class="pun">-</span><span class="lit">26</span><span class="pln"> </span><span class="lit">16</span><span class="pun">:</span><span class="lit">28</span><span class="pun">:</span><span class="lit">55.581</span><span class="pun">.</span><span class="pln"> </span><span>Time</span><span class="pln"> elapsed</span><span class="pun">:</span><span class="pln"> </span><span class="lit">20ms</span><span class="pln">
HTTP</span><span class="pun">/</span><span class="lit">1.1</span><span class="pln"> </span><span class="lit">200</span><span class="pln"> OK
</span><span>Server</span><span class="pun">:</span><span class="pln"> nginx</span><span class="pun">/</span><span class="lit">1.10</span><span class="pun">.</span><span class="lit">2</span><span class="pln">
</span><span>Date</span><span class="pun">:</span><span class="pln"> </span><span>Sun</span><span class="pun">,</span><span class="pln"> </span><span class="lit">26</span><span class="pln"> </span><span>Mar</span><span class="pln"> </span><span class="lit">2017</span><span class="pln"> </span><span class="lit">08</span><span class="pun">:</span><span class="lit">28</span><span class="pun">:</span><span class="lit">55</span><span class="pln"> GMT
</span><span>Content</span><span class="pun">-</span><span>Type</span><span class="pun">:</span><span class="pln"> text</span><span class="pun">/</span><span class="pln">html
</span><span>Content</span><span class="pun">-</span><span>Length</span><span class="pun">:</span><span class="pln"> </span><span class="lit">5948</span><span class="pln">
</span><span>Last</span><span class="pun">-</span><span>Modified</span><span class="pun">:</span><span class="pln"> </span><span>Wed</span><span class="pun">,</span><span class="pln"> </span><span class="lit">04</span><span class="pln"> </span><span>Jan</span><span class="pln"> </span><span class="lit">2017</span><span class="pln"> </span><span class="lit">08</span><span class="pun">:</span><span class="lit">44</span><span class="pun">:</span><span class="lit">56</span><span class="pln"> GMT
</span><span>Connection</span><span class="pun">:</span><span class="pln"> keep</span><span class="pun">-</span><span class="pln">alive
</span><span>ETag</span><span class="pun">:</span><span class="pln"> </span><span class="str">"586cb608-173c"</span><span class="pln">
</span><span>Accept</span><span class="pun">-</span><span>Ranges</span><span class="pun">:</span><span class="pln"> bytes</span>

It shows that the web server is accessible at port 443 (HTTPS) with response code 200 as follows:

3) The last one will be to check if data can be collected from the collector which is the remaining days to the expiry of the certificate. Collector debug window is still needed for this check.

For Linux collector:


<span class="pln">$ </span><span class="pun">!</span><span class="pln">java </span><span class="pun">-</span><span class="pln">cp </span><span class="pun">../</span><span class="pln">lib</span><span class="pun">/</span><span class="pln">certexpire</span><span class="pun">.</span><span class="pln">jar </span><span>CertificateExpire</span><span class="pln"> </span><span class="pun">/</span><span class="pln">usr</span><span class="pun">/</span><span class="pln">local</span><span class="pun">/</span><span class="pln">logicmonitor</span><span class="pun">/</span><span class="pln">agent </span><span class="lit">10.13</span><span class="pun">.</span><span class="lit">13.9</span><span class="pln">   </span><span class="lit">10.13</span><span class="pun">.</span><span class="lit">13.9</span><span class="pln">   </span><span class="lit">443</span><span class="pln">  </span><span class="kwd">true</span><span class="pln">
</span><span>Enable</span><span class="pln"> debug SSL cert
</span><span>Get</span><span class="pln"> the support protocol</span><span class="pun">,</span><span class="pln"> protocols</span><span class="pun">=</span><span>SSLv2Hello</span><span class="pun">,</span><span>SSLv3</span><span class="pun">,</span><span>TLSv1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">2</span><span class="pun">,</span><span class="pln">
</span><span>Get</span><span class="pln"> the enabled protocol</span><span class="pun">,</span><span class="pln"> protocols</span><span class="pun">=</span><span>TLSv1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">2</span><span class="pun">,</span><span class="pln">
</span><span>Try</span><span class="pln"> to send request to server</span><span class="pun">.</span><span class="pln">
</span><span>Request</span><span class="pln"> send </span><span class="pun">...</span><span class="pln">
</span><span>TrustManager</span><span class="pun">:</span><span class="pln"> checkServerTrusted got </span><span class="lit">1</span><span class="pln"> certs</span><span class="pun">.</span><span class="pln"> </span><span>Auth</span><span class="pln"> type</span><span class="pun">:</span><span class="pln"> ECDHE_RSA
</span><span>Exception</span><span class="pln"> caught </span><span class="pun">-</span><span class="pln"> java</span><span class="pun">.</span><span class="pln">security</span><span class="pun">.</span><span class="pln">cert</span><span class="pun">.</span><span>CertificateException</span><span class="pun">:</span><span class="pln"> </span><span>Certificate</span><span class="pln"> received</span><span class="pun">.</span><span class="pln">
    </span><span>Certification</span><span class="pln"> </span><span class="lit">1</span><span class="pln"> </span><span class="pun">[</span><span>Type</span><span class="pun">:</span><span class="pln"> X</span><span class="pun">.</span><span class="lit">509</span><span class="pun">]</span><span class="pln">
        </span><span>Issue</span><span class="pln"> </span><span>Date</span><span class="pun">:</span><span class="pln"> </span><span>Mon</span><span class="pln"> </span><span>Jan</span><span class="pln"> </span><span class="lit">02</span><span class="pln"> </span><span class="lit">17</span><span class="pun">:</span><span class="lit">51</span><span class="pun">:</span><span class="lit">51</span><span class="pln"> SGT </span><span class="lit">2017</span><span class="pun">,</span><span class="pln"> </span><span>Expiration</span><span class="pln"> </span><span>Date</span><span class="pun">:</span><span class="pln"> </span><span>Sat</span><span class="pln"> </span><span>Jul</span><span class="pln"> </span><span class="lit">01</span><span class="pln"> </span><span class="lit">17</span><span class="pun">:</span><span class="lit">51</span><span class="pun">:</span><span class="lit">51</span><span class="pln"> SGT </span><span class="lit">2017</span><span class="pln">
</span><span>Got</span><span class="pln"> issue date </span><span class="pun">-</span><span class="pln"> </span><span>Mon</span><span class="pln"> </span><span>Jan</span><span class="pln"> </span><span class="lit">02</span><span class="pln"> </span><span class="lit">17</span><span class="pun">:</span><span class="lit">51</span><span class="pun">:</span><span class="lit">51</span><span class="pln"> SGT </span><span class="lit">2017</span><span class="pun">,</span><span class="pln"> expiration date </span><span class="pun">-</span><span class="pln"> </span><span>Sat</span><span class="pln"> </span><span>Jul</span><span class="pln"> </span><span class="lit">01</span><span class="pln"> </span><span class="lit">17</span><span class="pun">:</span><span class="lit">51</span><span class="pun">:</span><span class="lit">51</span><span class="pln"> SGT </span><span class="lit">2017</span><span class="pln">
</span><span class="lit">97</span>

For Windows collector:


<span class="pln">$ </span><span class="pun">!</span><span class="pln">java </span><span class="pun">-</span><span class="pln">cp </span><span class="pun">../</span><span class="pln">lib</span><span class="pun">/</span><span class="pln">certexpire</span><span class="pun">.</span><span class="pln">jar </span><span>CertificateExpire</span><span class="pln"> </span><span class="str">"C:\Program Files (x86)\LogicMonitor\Agent"</span><span class="pln"> fspk</span><span class="pun">.</span><span class="pln">lmsupport</span><span class="pun">.</span><span class="pln">com fspk</span><span class="pun">.</span><span class="pln">lmsupport</span><span class="pun">.</span><span class="pln">com </span><span class="lit">443</span><span class="pln"> </span><span class="kwd">true</span><span class="pln">
</span><span>Enable</span><span class="pln"> debug SSL cert
</span><span>Get</span><span class="pln"> the support protocol</span><span class="pun">,</span><span class="pln"> protocols</span><span class="pun">=</span><span>SSLv2Hello</span><span class="pun">,</span><span>SSLv3</span><span class="pun">,</span><span>TLSv1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">2</span><span class="pun">,</span><span class="pln">
</span><span>Get</span><span class="pln"> the enabled protocol</span><span class="pun">,</span><span class="pln"> protocols</span><span class="pun">=</span><span>TLSv1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">1</span><span class="pun">,</span><span>TLSv1</span><span class="pun">.</span><span class="lit">2</span><span class="pun">,</span><span class="pln">
</span><span>Try</span><span class="pln"> to send request to server</span><span class="pun">.</span><span class="pln">
</span><span>Request</span><span class="pln"> send </span><span class="pun">...</span><span class="pln">
</span><span>TrustManager</span><span class="pun">:</span><span class="pln"> checkServerTrusted got </span><span class="lit">1</span><span class="pln"> certs</span><span class="pun">.</span><span class="pln"> </span><span>Auth</span><span class="pln"> type</span><span class="pun">:</span><span class="pln"> DHE_RSA
</span><span>Exception</span><span class="pln"> caught </span><span class="pun">-</span><span class="pln"> java</span><span class="pun">.</span><span class="pln">security</span><span class="pun">.</span><span class="pln">cert</span><span class="pun">.</span><span>CertificateException</span><span class="pun">:</span><span class="pln"> </span><span>Certificate</span><span class="pln"> received</span><span class="pun">.</span><span class="pln">
    </span><span>Certification</span><span class="pln"> </span><span class="lit">1</span><span class="pln"> </span><span class="pun">[</span><span>Type</span><span class="pun">:</span><span class="pln"> X</span><span class="pun">.</span><span class="lit">509</span><span class="pun">]</span><span class="pln">
        </span><span>Issue</span><span class="pln"> </span><span>Date</span><span class="pun">:</span><span class="pln"> </span><span>Thu</span><span class="pln"> </span><span>Feb</span><span class="pln"> </span><span class="lit">02</span><span class="pln"> </span><span class="lit">03</span><span class="pun">:</span><span class="lit">16</span><span class="pun">:</span><span class="lit">57</span><span class="pln"> PST </span><span class="lit">2017</span><span class="pun">,</span><span class="pln"> </span><span>Expiration</span><span class="pln"> </span><span>Date</span><span class="pun">:</span><span class="pln"> </span><span>Sat</span><span class="pln"> </span><span>Feb</span><span class="pln"> </span><span class="lit">02</span><span class="pln"> </span><span class="lit">03</span><span class="pun">:</span><span class="lit">16</span><span class="pun">:</span><span class="lit">57</span><span class="pln"> PST </span><span class="lit">2019</span><span class="pln">
</span><span>Got</span><span class="pln"> issue date </span><span class="pun">-</span><span class="pln"> </span><span>Thu</span><span class="pln"> </span><span>Feb</span><span class="pln"> </span><span class="lit">02</span><span class="pln"> </span><span class="lit">03</span><span class="pun">:</span><span class="lit">16</span><span class="pun">:</span><span class="lit">57</span><span class="pln"> PST </span><span class="lit">2017</span><span class="pun">,</span><span class="pln"> expiration date </span><span class="pun">-</span><span class="pln"> </span><span>Sat</span><span class="pln"> </span><span>Feb</span><span class="pln"> </span><span class="lit">02</span><span class="pln"> </span><span class="lit">03</span><span class="pun">:</span><span class="lit">16</span><span class="pun">:</span><span class="lit">57</span><span class="pln"> PST </span><span class="lit">2019</span><span class="pln">
</span><span class="lit">660</span>

- The basic command is: !java and complete format would be:

!java -cp ../lib/certexpire.jar CertificateExpire [collector installation folder] [device name/IP address] [device name/IP address] 443 true

Note:

* certexpire.jar is in the library of the collector agent

* device name/IP address is the web server that is registered/added into the LogicMonitor portal

* collector folder is: either "C:\Program Files (x86)\LogicMonitor\Agent" or /usr/local/logicmonitor/agent

The data collected can be verified on the device where the SSL Certificate is installed by accessing the web server in the browser and view the detail of the certificate loaded in the browser as follows:

Having gone through all the above-mentioned checks and the results are good, it will produce this monitoring in LogicMonitor as follows:

Purnadi_K

Posted 9 years ago·Last reply 6 years ago

12 comments

Cole McDonald

·6 years ago

Let us know how it goes :)/emoticons/smile@2x.png 2x" title=":)" width="20">

Dominique

·6 years ago

Thanks I created a DataSource with the code above and I am testing now...

Thanks Again

Dom

Cole McDonald

·6 years ago

I'm not sure where it came from. I'm no longer at Beyond Impact, so don't have access to that deployment any longer. I didn't actually perform the deployment of LM at that location, so I'm not sure how it got in the DS list there. It was originally written by an LM developer, but the code above should allow you to create your own implementation of it from scratch.

Dominique

·6 years ago

On 8/22/2019 at 9:11 AM, Cole McDonald said:
I've lightened the load slightly on the winCertCheck (which is technically no longer the same DS as I've replaced the entirety of the scripts with simplified .NET based powershell scripts to avoid using invoke-command which tends to lead to some resource constraint issues. This should help though, will keep the same instances alive from the old code as the output is identical to the previous version by @Jonathan Arnold:
<span class="pln">##--------------- Discovery ------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Select-Object {$_.Thumbprint + "##" + $_.Thumbprint + "##" + $_.Subject + $_.FriendlyName} `
| Format-Table -HideTableHeaders
##--------------------------------------------##</span>
<span class="pln">##-------------- Counters --------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Where-Object {($_.Thumbprint -like "##WILDVALUE##")} `
| Select-Object @{
	Name       = "DaysUntilExpire"
	Expression = {((Get-Date -Date $_.NotAfter) - (Get-Date)).Days}
} `
| Format-List
##--------------------------------------------##</span>
(please note the line continuations to help readability of the code)

As always, neither I nor Beyond Impact warranty this code. It's working in our environment, I can't guarantee it'll work in yours. This doesn't account for anything that needs credentials other than what the collector uses.

Hello,

Where is the "winCertCheck"? I do not see it in our environment. Is it a standard DS ? Should it be imported from somewhere?

I would like to get the certificate "CommonName" displayed in the description of the Alert for SSL Expiration.

Thanks,

Dom

Cole McDonald

·6 years ago

I've lightened the load slightly on the winCertCheck (which is technically no longer the same DS as I've replaced the entirety of the scripts with simplified .NET based powershell scripts to avoid using invoke-command which tends to lead to some resource constraint issues. This should help though, will keep the same instances alive from the old code as the output is identical to the previous version by @Jonathan Arnold:


<span class="pln">##--------------- Discovery ------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Select-Object {$_.Thumbprint + "##" + $_.Thumbprint + "##" + $_.Subject + $_.FriendlyName} `
| Format-Table -HideTableHeaders
##--------------------------------------------##</span>


<span class="pln">##-------------- Counters --------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Where-Object {($_.Thumbprint -like "##WILDVALUE##")} `
| Select-Object @{
	Name       = "DaysUntilExpire"
	Expression = {((Get-Date -Date $_.NotAfter) - (Get-Date)).Days}
} `
| Format-List
##--------------------------------------------##</span>

(please note the line continuations to help readability of the code)

As always, neither I nor Beyond Impact warranty this code. It's working in our environment, I can't guarantee it'll work in yours. This doesn't account for anything that needs credentials other than what the collector uses.

Cole McDonald

·7 years ago

If you're monitoring a windows environment, you may have another DS in your deployment "WinCertCheck" that is turned off by default. I have another thread on this forum with the changes that need to be made to make it work correctly, then just set it ti isWIndows() instead of false() in your appliesTo and you'll get a bit more data that allows for better diagnostics. It's MUCH more aggressive about finding certs on your systems than the SSL DS is... so bear that in mind, you'll need to take a while turning off certs that you don't need to monitor. At scale, this can be cumbersome. I'm working on a script that will help alleviate that part... (i.e. stop alerting on all instances with a given thumbprint).

Reynaldo_Mijare

·7 years ago

Is it possible to add for this script to retrieve more info from the cert, like all the details that you are showing in the screenshot above?

LM User

·7 years ago

Is it possible to add for this script to retrieve more info from the cert, like all the details that you are showing in the screenshot above?

Purnadi_K

OP8 years ago

hi Anil, I have a doubt since SHA1 is slowly losing proponents due to its security flaw (& our collectors are more and more equipped with latest security patch :).You can try though, any device in your portal to test?

Please don't tell me here :)/emoticons/smile@2x.png 2x" title=":)" width="20"> You can open an email ticket to inform me the device and I will test it out.

anil_perera

·8 years ago

Hi Purnadi, Can we use this DS to test for SHA-1 Certs?

https://gallery.technet.microsoft.com/SHA1-Certificate-Signature-22c94da9

Thanks

Purnadi_K

OP9 years ago

hi Kaushal, you can use this datasource if you can add the ELB as a device.

LM User

·9 years ago

Can we use this to monitor SSL Certs on AWS ELB's discovered by Cloudwatch plugin? If not is there any way to monitor SSL certs on the ELB's using logicmonitor.