elaboration of: check-httpv2: Certificate validity by age (ignore validation against RootCA)
Please add an option to check_httpv2 that checks only the certificate validity period,
without validating the certificate chain against the local trusted RootCA store and
without failing on unknown/private RootCAs.
Suggested option:
--certificate-validity-only
Expected behavior:
- Establish TLS connection.
- Do not verify CA chain.
- Do not verify hostname/CN/SAN.
- Still retrieve and parse the peer certificate.
- Check notBefore/notAfter.
- Apply warning/critical thresholds to remaining validity days.
- Return CRITICAL if the certificate is expired.
This is different from --disable-cert. The purpose is not to ignore certificate
problems completely, but to monitor certificate age for customer systems using
private PKIs, without importing every customer RootCA into the Checkmk server.
Check only the certificate notBefore/notAfter validity period.
Do not validate the certificate chain against local trusted Root CAs.
Do not validate hostname/SAN/CN matching.
Still return CRITICAL if the certificate is expired or within the configured critical threshold.
This option is intended for monitoring certificate age on systems using private/customer PKIs.
check_cert_validity_only.py_oe5vxo.txt
Comments: 1
Oldest
•
Newest
•
Most likes
•
Fewest likes
-
2 days ago
Mohamed Saleh AdminHighlighted comment
Hi Marko, thanks for providing these details.
Do I understand correctly that you are providing more information regarding the exact idea?
https://ideas.checkmk.com/suggestions/707161/check-httpv2-certificate-validity-by-age-ignore-validation-against-rootca
I suggest to then put this info as a comment in that idea. Then, all the info is one place, and users can interact with the idea and its content (vote and comment) in one place. What do you think?