Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Nagios can do SSL checking, but it doesn't actually check if the certificate is valid for the connection address you're using (common name match).

On one of our servers, a postfix configuration file was replaced by a Plesk update without notice, resulting in a regression to a snake-oil certificate. Nagios checks SSL, but didn't see it. To that end, I'd like to check more than just the expiration date, and actually check the CA chain.

I've tried several SSL plugins for nagios, but none of them can do it.

Does anybody have advice?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

I don't have any experience with it but it looks like the check_ssl_cert plugin does what you are looking for.

Excerpt from the author's site:

check_ssl_cert is a Nagios plugin to check the CA and validity of an X.509 certificate

share|improve this answer
    
This seems to be one that does. I hadn't found it before. Thanks. I'm trying it now. –  Halfgaar Oct 28 '11 at 9:09
    
Hmm, it works, but it only checks the common name, not the additional domains... –  Halfgaar Oct 28 '11 at 10:03

I can't find a plugin that tests it, either, but it would be very easy to wrap some random GPLed plugin's guts around an openssl one-liner. Here's a one-liner comparing the output from two of my servers; www has an Equifax certificate on it, nagios is self-signed:

[madhatter@anni ~]$ echo "" | openssl s_client -connect nagios.teaparty.net:443 |& grep "verify error"
verify error:num=18:self signed certificate
[madhatter@anni ~]$ echo $?
0
[madhatter@anni ~]$

and

[madhatter@anni ~]$ echo "" | openssl s_client -connect www.teaparty.net:443 |& grep "verify error"
[madhatter@anni ~]$ echo $?
1
[madhatter@anni ~]$

note the nice, easy-to-test change in the exit status of grep, depending on whether or not it finds the "verify error" string.

How's that?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.