Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently using nagios to do monitoring, including using the check_http options to check for an SSL cert that expires soon, etc. What I'd like to do is include testing for revoked certs for each of the sites that I monitor. Sounds easy, right? Well:

  • check_http doesn't seem to check for revoked certs. At least, it didn't beep when it happened recently, which lead to some confusion
  • Openssl's verify has -crl_check and -crl_check_all, which would be great, but I care about OSCP more than CRLs (since that's what browsers will care about)
  • Openssl has an oscp mode, but it looks like I'd have to do a bunch of work to get the cert in the right place, figure out where the OSCP server is, etc.

I've found a bunch of articles about writing code to do OSCP checking, but there's got to be a nice program that does it, right? What I want is a Nagios check, or something that I could use as one. In my perfect world it would look something like:

check_http_with_oscp -I (IP) -H (hostname) -p 443


share|improve this question
OSCP is supposed to supplement CRL for the near future, not replace it yet. Still, what you propose will be needed eventually. – Chris S Aug 18 '10 at 2:36
The browsers seem to all do OSCP, which means that's what we should be monitoring. Right? – Bill Weiss Aug 18 '10 at 15:48
up vote 2 down vote accepted

I'm afraid that I can only give pointers here, but you should be able to put something together without too much pain.

openssl's s_client -showcerts will dump the PEM encoded certs. You can extract each of them with a regexp pretty easily. Then pipe them through openssl x509 -text to extract the OCSP url. Then openssl ocsp can be used to send an OCSP request to the responder:

You'll need the parent certificate in each case, which you'll have except for the root certificate. So, apart from maybe hardcoding that, it's quite self contained. (You could also download the root certificate via the AIA extension URL.)

share|improve this answer
Yuck! Yep, that's what I'm looking at. I'd prefer not having to regex out the certs, but I can probably write a little code to do that in a cleaner way. Thanks, though it's not what I wanted to hear. – Bill Weiss Aug 26 '10 at 15:47
Since there haven't been any answers I wanted to hear more than this, you're it :) – Bill Weiss Sep 14 '10 at 21:41

We use a very different approach to this, maybe it works for you, too: We start a web browser with iMacros for Firefox, have it navigate to the website and if the certificate is expired, iMacros will "see" the same error message as a real user. I check on that message... and return it to our monitoring system.

I do that on Windows Server, but you can also use it on Linux via the iMacros command line support. This is part of the free iMacros Firefox and Chrome addons.

Alternatively, consider simply using a free account with the AlertFox monitoring service. You can run a free check every 4h, which is more than enough to check for expired certificates and trigger an alert.

share|improve this answer
I'd really prefer to not install Firefox (and a whole X stack, etc) on the monitoring servers just to test for this. I'm sure that it would work, but... bleh. AlertFox looks like it would work, though I have enough sites to monitor that it wouldn't be the free version anymore. I'll take a look. – Bill Weiss Aug 18 '10 at 18:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.