check httpv2: Certificate validity by age (ignore validation against RootCA)
The current check-httpv2 requires that the certificate be validated against a RootCA on the local server for certificate monitoring.
However, this makes absolutely no sense, especially when monitoring many customer systems, each with their own PKIs (and thus also custom RootCAs).
We would like to check the certificate age, but WITHOUT validating it against a RootCA. I don’t want to have to import all customer Root CA certificates into my CheckMK server just to check the validity period. As things stand now, if I were to monitor an SSL certificate from a customer that was issued by their own PKI (i.e., not by a public RootCA), I would first have to import that RootCA into the CheckMK server—and that is exactly what I don't want to do.
For this, I still have to use the external “check_http” (from Nagios, because here I can explicitly check only the validity period) and cannot use the new “Check HTTP web service”, because it simply expects you to trust the RootCA. Here, I expect an option to “check certificate validity period only”
Comments: 1
Oldest
•
Newest
•
Most likes
•
Fewest likes
-
21 Jul
Marcel Arentz AdminHighlighted comment
Hi Florian,
I hear you that importing every customer's Root CA just to watch an expiry date is impractical in an MSP setup.
The good thing is: this exact case — "tell me when the cert expires, I don't have the issuing CA" — is what check_cert is built for. It inspects the cert itself and tolerates a chain it can't verify locally, so you get the expiry without importing anything into the trust store. That should let you retire the external check_http.
We keep check_httpv2 strict because it monitors the actual service, where trust has to hold. The old check_http returns "HTTP OK" even for wrong.host.badssl.com where the hostname doesn't match the cert. That's what we don't want back: green exactly where a browser refuses to continue.
Would check_cert cover what you need for now?
Example:
OMD[mysite]:~/lib/nagios/plugins$ ./check_http -H wrong.host.badssl.com -S --sni
HTTP OK: HTTP/1.1 200 OK - 767 bytes in 0.719 second response time |time=0.719419s;;;0.000000;10.000000 size=767B;;;0;