Re: [munin-users] Plugin to check SSL cert validity?

[Bjørn R. <bj...@ru...>]

On 10/30/2012 11:31 PM, Simon Tennant wrote:
> It would give jagged lines just like the uptime plugin does.
>
> Having a visual glance along with all the other system health graphs 
> seems very useful to me.

Please don't top post, it breaks the reading order.

Which metric would you want to measure regarding the validity of a 
certificate? Two things spring to mind, both related to dates.

1) Valid or not (i.e. certificate expiry date is before or after today's 
date). This will give you a plugin where the possible values are e.g. 
'1' or '0', and you will have no warning before the certificate has 
suddenly expired.

2) Days until expiry date. This will give you a declining graph, and I 
guess this is what you're visualizing when comparing to the uptime 
plugin does.

IMHO, the difference in usefulness between measuring uptime and client 
certificate lies in the predictability. One often knows (or should know 
;-) when a certificate expires, but you can't be expected to predict 
when a server needs to be rebooted or if it was suddenly rebooted last 
night. Furthermore, the uptime plugin gives a nice visual alignment 
reference when comparing graphs, showing how other metrics changed after 
a reboot.

I'm not aware of such a plugin, but it would be quite easy for you to 
write one. Check e.g. 
http://www.brandonhutchinson.com/When_does_my_certificate_expire%3F.html 
for a few tips.

-- 
Bjørn