cert – cavaliba.com

Documentation

Modules

cert

Use case

Catch a TLS certificate before it expires (graduated notice/warning/error as days-left shrinks), and/or confirm the cert’s subject/SAN matches what’s expected - independently toggleable, so a chain-trust problem and a wrong-hostname problem are reported as distinct conditions.

Configuration

Field	Type	Meaning
`hostname`	string	remote host to connect to; default `localhost`
`port`	int	remote port; default 443
`subject`	string	expected CN/SAN in the cert; default `hostname`
`check_subject`	bool	require subject/SAN match; default true
`check_expiration`	bool	check days-left and alert on it; default true
`notice_in`	int	days-left below this => notice; default 30
`warning_in`	int	days-left below this => warning; default 14
`error_in`	int	days-left below this => error; default 7 (already expired or not-yet-valid => critical, regardless)
`check_ca`	bool	verify the chain of trust; default false, unless `ca_file` is set (then default true)
`ca_file`	string	PEM/CRT file: verify the chain against only this CA rather than the system trust store

The certificate is always fetched and its details always reported, even when chain verification is off or fails.

Output

In this order - all non-datapoint tags:

Item	Type	Meaning
`cert_host`	string	`hostname:port`
`cert_subject`	string	the configured expected subject
`cert_not_before`	string	certificate validity start (UTC)
`cert_not_after`	string	certificate validity end (UTC)
`cert_issuer`	string	issuer DN
`cert_sans`	string	cert’s real CN + all SAN DNS names, space-joined
`cert_days_left`	int (days)	always added, regardless of outcome
`cert_error`	string	`""` if every enabled check passed, else a `"; "`-joined summary of whichever failed

Example

checks:
  - module: cert
    name: cert_google
    conf:
      hostname: google.com
      port: 443
      subject: google.com
      notice_in: 30
      warning_in: 14
      error_in: 7

http mysql