Check Web site’ SSL certificate

Q: How I can be sure SSL certificate of monitored site is valid?

A: You can verify SSL certificate with a script. You would need a Linux computer with OpenSSL package installed (nowadays, this is default). Create a script (for the sake of example, we assume the location for the script is ~/bin (directory “bin” in home directory of current user).

Creating and setting up certificate checking script

1. Create a file ~/bin/test-site-certificate.sh and paste into it the following content:

#!/bin/bash

if [[ "z$1" == "z" ]]; then
    echo "-1"
    exit 0
else
    TESTHOST="$1"
fi

openssl s_client -CApath /etc/ssl/certs/ -connect ${TESTHOST}:443 < /dev/null 2> /dev/null | grep 'Verify return code' | awk '{ print $4 }'

Note: the last command (starting with ‘openssl’) should be entered as single line.

Note: depending on your OS and its version, default certificates storage may be located in directory different from ‘/etc/ssl/certs’ (example: ‘/etc/pki/tls/certs’). Please refer to openssl manual pages to get actual location of local certificates repository.

2. After you have created the file, make it executable and test it in action:

chmod +x ~/bin/
~/bin/test-site-certificate.sh www.google.com

If everything is configured properly, and there’s working Internet connection, the last command should print single digit 0.

3. Now add the host for the above Unix (Linux etc) server used in the above step and in “Main Parameters” section for it enter its Unix credentials to connect via SSH.

Now create new monitor for that host: New Monitor -> Custom Monitors -> SSH (Remote Script or Program). The monitor main parameters should look like this:

4. Run the monitor. For the given default parameter (www.google.com) it should return 0. To use it with actual domain to check, replace ‘www.google.com’ with domain name of your choice.

The script’s performance value, if certificate is OK, will be single digit 0. Non-null integer value will be output otherwise. Add, on “State conditions” tab, Warning and/or Down condition to raise alert if domain certificate isn’t valid. It is enough to use ‘>= 0’ single Down condition to do that.

Note: for self-signed certificates, if no valid local CA certificate is found in CA repository, error code 19 will most probably be returned.

Note: after you made and checked this monitor, you can make all monitors checking the site content depending on this one. That will ensure no checks are made if site’ security isn’t confirmed.

Certificate validation results

For your convenience, here are integer values the script will output if certificate is not valid – and their meaning. For more information please see this document: openssl verify.