Révision f0479a9a
[ssl-certificate-expiry] host name verification + proxy connection (#1126)
- optional verification of request to certificate hostname match (env.checkname yes)
- optional openssl proxy usage (env.proxy PROXYHOST:PORT)
| plugins/ssl/ssl-certificate-expiry | ||
|---|---|---|
| 23 | 23 |
[ssl-certificate-expiry] |
| 24 | 24 |
env.services ... |
| 25 | 25 |
env.warning 30: |
| 26 |
env.proxy PROXYHOST:PORT # optional, enables openssl operation over proxy |
|
| 27 |
env.checkname yes # optional, checks if used servername is covered by certificate |
|
| 26 | 28 |
|
| 27 | 29 |
Alternatively, if you want to monitor hosts separately, you can create multiple symlinks named as follows. |
| 28 | 30 |
|
| ... | ... | |
| 58 | 60 |
* Pactrick Domack (ssl_) |
| 59 | 61 |
* Olivier Mehani (ssl-certificate-expiry) |
| 60 | 62 |
* Martin Schobert (check for intermediate certs) |
| 63 |
* Arndt Kritzner (hostname verification and proxy usage) |
|
| 61 | 64 |
|
| 62 | 65 |
* Copyright (C) 2013 Patrick Domack <patrickdk@patrickdk.com> |
| 63 | 66 |
* Copyright (C) 2017, 2019 Olivier Mehani <shtrom+munin@ssji.net> |
| ... | ... | |
| 122 | 125 |
# Wrap IPv6 addresses in square brackets |
| 123 | 126 |
echo "$host" | grep -q ':' && host="[$host]" |
| 124 | 127 |
|
| 125 |
local s_client_args= |
|
| 126 |
[ -n "$starttls" ] && s_client_args="-starttls $starttls" |
|
| 128 |
local s_client_args='' |
|
| 129 |
[ -n "$starttls" ] && s_client_args="$s_client_args -starttls $starttls" |
|
| 130 |
[ -n "${proxy:-}" ] && s_client_args="$s_client_args -proxy $proxy"
|
|
| 131 |
[ -n "${checkname:-}" ] && [ "$checkname" = "yes" ] && s_client_args="$s_client_args -verify_hostname $host"
|
|
| 127 | 132 |
|
| 128 | 133 |
# We extract and check the server certificate, |
| 129 | 134 |
# but the end date also depends on intermediate certs. Therefore |
| ... | ... | |
| 138 | 143 |
# - get a list of the parse_valid_days_from_certificate |
| 139 | 144 |
# results and sort them |
| 140 | 145 |
|
| 146 |
local openssl_call |
|
| 147 |
local openssl_response |
|
| 141 | 148 |
# shellcheck disable=SC2086 |
| 142 |
echo "" | openssl s_client \ |
|
| 143 |
-servername "$host" -connect "${host}:${port}" \
|
|
| 144 |
-showcerts \ |
|
| 145 |
$s_client_args 2>/dev/null | \ |
|
| 149 |
openssl_call="s_client -servername $host -connect ${host}:${port} -showcerts $s_client_args"
|
|
| 150 |
# shellcheck disable=SC2086 |
|
| 151 |
openssl_response=$(echo "" | openssl ${openssl_call} 2>/dev/null)
|
|
| 152 |
if echo "$openssl_response" | grep -qi "Hostname mismatch"; then |
|
| 153 |
echo "<>" |
|
| 154 |
else |
|
| 155 |
echo "$openssl_response" | \ |
|
| 146 | 156 |
awk '{
|
| 147 | 157 |
if ($0 == "-----BEGIN CERTIFICATE-----") cert="" |
| 148 | 158 |
else if ($0 == "-----END CERTIFICATE-----") print cert |
| ... | ... | |
| 152 | 162 |
(printf '\n-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----\n' "$CERT") | \ |
| 153 | 163 |
parse_valid_days_from_certificate |
| 154 | 164 |
done | sort -n | head -n 1 |
| 155 |
|
|
| 165 |
fi |
|
| 156 | 166 |
} |
| 157 | 167 |
|
| 158 | 168 |
main() {
|
| ... | ... | |
| 168 | 178 |
fi |
| 169 | 179 |
fieldname="$(clean_fieldname "$service")" |
| 170 | 180 |
valid_days=$(print_expire_days "$host" "$port" "$starttls") |
| 181 |
extinfo="" |
|
| 171 | 182 |
[ -z "$valid_days" ] && valid_days="U" |
| 183 |
if [ "$valid_days" = "<>" ]; then |
|
| 184 |
extinfo="Error: hostname mismatch, " |
|
| 185 |
valid_days="-1" |
|
| 186 |
fi |
|
| 172 | 187 |
printf "%s.value %s\\n" "$fieldname" "$valid_days" |
| 173 |
echo "${fieldname}.extinfo Last checked: $(date)"
|
|
| 188 |
echo "${fieldname}.extinfo ${extinfo}Last checked: $(date)"
|
|
| 174 | 189 |
done |
| 175 | 190 |
} |
| 176 | 191 |
|
Formats disponibles : Unified diff