I'm currently using nagios to do monitoring, including using the
check_http options to check for an SSL cert that expires soon, etc. What I'd like to do is include testing for revoked certs for each of the sites that I monitor. Sounds easy, right? Well:
check_httpdoesn't seem to check for revoked certs. At least, it didn't beep when it happened recently, which lead to some confusion
-crl_check_all, which would be great, but I care about OSCP more than CRLs (since that's what browsers will care about)
- Openssl has an
oscpmode, but it looks like I'd have to do a bunch of work to get the cert in the right place, figure out where the OSCP server is, etc.
I've found a bunch of articles about writing code to do OSCP checking, but there's got to be a nice program that does it, right? What I want is a Nagios check, or something that I could use as one. In my perfect world it would look something like:
check_http_with_oscp -I (IP) -H (hostname) -p 443