Simple Check for SSL Cert Expiration Monitoring

Can we use this to monitor SSL Certs on AWS ELB's discovered by Cloudwatch plugin? If not is there any way to monitor SSL certs on the ELB's using logicmonitor.

hi Kaushal, you can use this datasource if you can add the ELB as a device.

hi Anil, I have a doubt since SHA1 is slowly losing proponents due to its security flaw (& our collectors are more and more equipped with latest security patch :).You can try though, any device in your portal to test?

Please don't tell me here :)/emoticons/smile@2x.png 2x" title=":)" width="20"> You can open an email ticket to inform me the device and I will test it out. 

If you're monitoring a windows environment, you may have another DS in your deployment "WinCertCheck" that is turned off by default.  I have another thread on this forum with the changes that need to be made to make it work correctly, then just set it ti isWIndows() instead of false() in your appliesTo and you'll get a bit more data that allows for better diagnostics.  It's MUCH more aggressive about finding certs on your systems than the SSL DS is... so bear that in mind, you'll need to take a while turning off certs that you don't need to monitor.  At scale, this can be cumbersome.  I'm working on a script that will help alleviate that part... (i.e. stop alerting on all instances with a given thumbprint).

I've lightened the load slightly on the winCertCheck (which is technically no longer the same DS as I've replaced the entirety of the scripts with simplified .NET based powershell scripts to avoid using invoke-command which tends to lead to some resource constraint issues.  This should help though, will keep the same instances alive from the old code as the output is identical to the previous version by @Jonathan Arnold:

##--------------- Discovery ------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Select-Object {$_.Thumbprint + "##" + $_.Thumbprint + "##" + $_.Subject + $_.FriendlyName} `
| Format-Table -HideTableHeaders
##--------------------------------------------##

##-------------- Counters --------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Where-Object {($_.Thumbprint -like "##WILDVALUE##")} `
| Select-Object @{
	Name       = "DaysUntilExpire"
	Expression = {((Get-Date -Date $_.NotAfter) - (Get-Date)).Days}
} `
| Format-List
##--------------------------------------------##

(please note the line continuations to help readability of the code)

As always, neither I nor Beyond Impact warranty this code.  It's working in our environment, I can't guarantee it'll work in yours.  This doesn't account for anything that needs credentials other than what the collector uses.

On 8/22/2019 at 9:11 AM, Cole McDonald said:

I've lightened the load slightly on the winCertCheck (which is technically no longer the same DS as I've replaced the entirety of the scripts with simplified .NET based powershell scripts to avoid using invoke-command which tends to lead to some resource constraint issues.  This should help though, will keep the same instances alive from the old code as the output is identical to the previous version by @Jonathan Arnold:

##--------------- Discovery ------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Select-Object {$_.Thumbprint + "##" + $_.Thumbprint + "##" + $_.Subject + $_.FriendlyName} `
| Format-Table -HideTableHeaders
##--------------------------------------------##

##-------------- Counters --------------------##
$readOnly     = [System.Security.Cryptography.X509Certificates.OpenFlags]"ReadOnly"
$localMachine = [System.Security.Cryptography.X509Certificates.StoreLocation]"LocalMachine"
$store        = new-object System.Security.Cryptography.X509Certificates.X509Store( "\\##SYSTEM.SYSNAME##\root", $localMachine )

$store.Open( $readOnly )

$store.Certificates `
| Where-Object {($_.Thumbprint -like "##WILDVALUE##")} `
| Select-Object @{
	Name       = "DaysUntilExpire"
	Expression = {((Get-Date -Date $_.NotAfter) - (Get-Date)).Days}
} `
| Format-List
##--------------------------------------------##

(please note the line continuations to help readability of the code)

As always, neither I nor Beyond Impact warranty this code.  It's working in our environment, I can't guarantee it'll work in yours.  This doesn't account for anything that needs credentials other than what the collector uses.

Hello,

Where is the "winCertCheck"? I do not see it in our environment. Is it a standard DS ? Should it be imported from somewhere?

I would like to get the certificate "CommonName" displayed in the description of the Alert for SSL Expiration.

Thanks,

Dom

I'm not sure where it came from.  I'm no longer at Beyond Impact, so don't have access to that deployment any longer.  I didn't actually perform the deployment of LM at that location, so I'm not sure how it got in the DS list there.  It was originally written by an LM developer, but the code above should allow you to create your own implementation of it from scratch.

Thanks I created a DataSource with the code above and I am testing now... 

Thanks Again

Dom

Let us know how it goes :)/emoticons/smile@2x.png 2x" title=":)" width="20">

Hi Purnadi, Can we use this DS to test for SHA-1 Certs?

https://gallery.technet.microsoft.com/SHA1-Certificate-Signature-22c94da9

Thanks