Handy Tips #9: Native SSL/TLS certificate monitoring

Anonymous Anonymous

Technical Writer at Zabbix

October 29, 2021

Track TLS/SSL certificate validity and expiration using the new Zabbix agent 2 template. Previously, Zabbix users had to rely on custom scripts to monitor website certificates as there was no native out-of-the-box solution to check TLS or SSL certificate validity and expiration date. This problem has been solved with the introduction of the new WebCertificate […]

Track TLS/SSL certificate validity and expiration using the new Zabbix agent 2 template.

Previously, Zabbix users had to rely on custom scripts to monitor website certificates as there was no native out-of-the-box solution to check TLS or SSL certificate validity and expiration date.

This problem has been solved with the introduction of the new WebCertificate plugin available as a part of Zabbix agent 2 5.4.4 release (also back-ported to Zabbix 5.0.15):

New web.certificate.get item can be used to obtain certificate details
Works with Zabbix agent 2, the second-generation agent
Connects to either host IP or DNS name with the ability to verify the hostname

Supports TLS and SSL certificate monitoring
To ensure the least performance overhead, the official Website certificate template uses master and dependent items

Check out the video to learn how to configure the "Website certificate by Zabbix agent 2" template and start monitoring your web certificates.

How to configure the “Website certificate by Zabbix agent 2” template and start monitoring your web certificates:

Make sure Zabbix agent 2 is installed on the host
Create a host In the Configuration → Hosts section
Enter the host’s name
Create a new host group or select an existing one
Add an Agent interface in the host configuration
Specify the IP/DNS name of the Zabbix Agent interface
Switch to the Templates tab
Link the template “Website certificate by Zabbix agent 2”
Switch to the Macros tab
Switch to the Inherited and host macros mode.
Set the {$CERT.WEBSITE.HOSTNAME} macro as the website’s DNS name
Save the host configuration

Tips and best practices:

You can test the configuration with Zabbix Get: zabbix_get -s <zabbix_agent_addr> -k web.certificate.get[<website_DNS_name>]
The web.certificate.get item turns unsupported if TLS handshake fails with any error except an invalid certificate
If both IP and DNS are provided, the IP will be used for connection and the hostname will be used for SNI and hostname verification
You can override the template macros on the individual host level