Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Aside from receiving plenty of emails well in advanced from my PKI telling me one of my certificates is about to expire, how can I setup an alert that checks the health of an SSL?

What I want to check for:

  1. Hasn't expired
  2. Hasn't been revoked
  3. Hasn't been removed from the server accidentally

Currently we use Hostmon internally and SiteUptime externally. The latter can use HTTPS, but it doesn't appear to have the ability to validate certificates.

share|improve this question
I guess you mean a "SSL certificate"? SSL itself is a protocol, there's no such thing as "an SSL". – grawity Nov 6 '09 at 16:30
up vote 4 down vote accepted

We use Nagios for this. The check_http program included with it knows how to talk SSL, and can return a "warning" or "critical" status based on how close the certificate is to expiration. From the command's help output:

CHECK CERTIFICATE: check_http -H -C 14

When the certificate of '' is valid for more than 14 days, a STATE_OK is returned. When the certificate is still valid, but for less than 14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when the certificate is expired.

share|improve this answer

Just enter the hostname at to see if the certificate is valid, trusted, unexpired, and contains the correct names in the certificate. You just need to the site with https in any new web browser to see if it is revoked.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.