Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Red Hat derived systems, there is a tool called certwatch(1) that does this for Apache websites. Every day it checks all the certificate listed in the Apache configuration file. If the script detects that the certificate will expire soon (say in 30 days), it sends out an email notification, that way you can renew the certificate before it expires. What I’m looking for is a tool that does the same job, except for websites hosted in IIS. How do other people out there handle this problem?

To be honest, I’d rather keep track of certificate expiration in a shared calendar system, however our business relies on Exchange. To my knowledge, there is no way with an Exchange calendar to send out a reminder on a given date to all members of a group, such that as people in the group are replaced they will automatically be added to the reminder (five years is a long time to assume that everyone originally assigned to the reminder will not have changed positions).


About our environment:

We do already have a “solution” in place fulfilling the role ;) of a network management system, however it is not able to monitor for certificate expiration (although I have submitted it as a feature request). We do have Linux hosts at our disposal, however I would prefer not to have to set up and manage a second, complex monitoring system (if it was a simple monitor running on Linux, that would be acceptable). I do understand, however, that the simple Windows script I am looking for may not exist (yet).

share|improve this question
1  
Do you already have a network management system in place like Nagios/Zenoss or something else? Do you have any linux boxes? –  Zoredache Feb 10 '12 at 19:54
    
@Zoredache Updated, thanks. –  Michael Kropat Feb 10 '12 at 20:13
    
I was mostly curious about Linux since I have a pretty basic script that I have on a Linux system that I run from cron. See my answer, it may be helpful. –  Zoredache Feb 10 '12 at 20:16

4 Answers 4

up vote 1 down vote accepted

If you have a linux box, or you can get it to run under Windows I have a python script that I hacked out a while ago to check certs on various systems (it probably isn't very pythonic or pretty). I basically just have call it from cron, which automatically emails me. It connects to defined systems retrieves and examples the dates of the certs. I had it checking the certs on HTTPS, IMAPs, POP3s, RDP services.

I am sure many network management systems like Nagios have extensions and check tools that could monitor this as well.

share|improve this answer
    
+1 ultimately I think this approach (remote scanning) is the way to go, rather than what I originally had in mind. That way all the expiry alerts can be rolled into one summary email. What I am actually going with is a new script I wrote, which can scan the network (rather than working from a list), that way if people add a new site and forget to add it to the cert monitor list, it will still be monitored. If/when I get it publish ready, I will link to it from this question. –  Michael Kropat Feb 13 '12 at 17:21

I do somewhat what you'd rather do. I schedule a 0-time (ie- 8:00 am-8:00 am same day) meeting with the people who I want to get the notification and make sure the reminder is set. It's not exactly the same as notifying a group, admittedly. Groups / distribution lists get resolved by Outlook / Exchange as you send.

In fact, that reminds me. I need to renew my certs....

share|improve this answer

Is there a specific part you're having a problem with?

There's a sample for detecting expiring certificates here: http://gallery.technet.microsoft.com/scriptcenter/a4760914-cf72-4505-97d3-94166c7d3521

If your existing monitoring system can watch for specific Event Log events, you could just leverage that system and write an event to the event log when expiration is approaching.

share|improve this answer
    
A simple PowerShell script was exactly the kind of solution I was looking for when I asked the question. I would +1, but the script you linked to only solves half my problem, because of the dozens of certificates it lists on my server, only a handful are of any interest to me (i.e. those associated with sites in IIS). –  Michael Kropat Feb 13 '12 at 17:21

You could try a script like this one: ssl-check which uses OpenSSL and will check the servers you tell it about.

There is also this SSL Certificate Discovery and Monitoring Tool. It will discover the SSL certificates you have deployed on your networks, catalogue them, and send email alerts when they are approaching expiry. This is a commercial product.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.