You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
yzl 93958d0fb0
zabbix6.0
1 year ago
..
README.md zabbix6.0 1 year ago
template_app_certificate_agent2.yaml zabbix6.0 1 year ago

README.md

Website certificate by Zabbix agent 2

Overview

The template to monitor TLS/SSL certificate on the website by Zabbix agent 2 that works without any external scripts. Zabbix agent 2 with the WebCertificate plugin requests certificate using the web.certificate.get key and returns JSON with certificate attributes.

Requirements

Zabbix version: 7.0 and higher.

Tested versions

This template has been tested on:

  • Website TLS/SSL certificate

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

1. Setup and configure zabbix-agent2 with the WebCertificate plugin.

2. Test availability: zabbix_get -s <zabbix_agent_addr> -k web.certificate.get[<website_DNS_name>]

3. Create a host for the TLS/SSL certificate with Zabbix agent interface.

4. Link the template to the host.

5. Customize the value of {$CERT.WEBSITE.HOSTNAME} macro.

Macros used

Name Description Default
{$CERT.EXPIRY.WARN}

Number of days until the certificate expires.

7
{$CERT.WEBSITE.HOSTNAME}

The website DNS name for the connection.

<Put DNS name>
{$CERT.WEBSITE.PORT}

The TLS/SSL port number of the website.

443
{$CERT.WEBSITE.IP}

The website IP address for the connection.

Items

Name Description Type Key and additional info
Cert: Get

Returns the JSON with attributes of a certificate of the requested site.

Zabbix agent web.certificate.get[{$CERT.WEBSITE.HOSTNAME},{$CERT.WEBSITE.PORT},{$CERT.WEBSITE.IP}]

Preprocessing

  • Discard unchanged with heartbeat: 6h

Cert: Validation result

The certificate validation result. Possible values: valid/invalid/valid-but-self-signed

Dependent item cert.validation

Preprocessing

  • JSON Path: $.result.value

Cert: Last validation status

Last check result message.

Dependent item cert.message

Preprocessing

  • JSON Path: $.result.message

Cert: Version

The version of the encoded certificate.

Dependent item cert.version

Preprocessing

  • JSON Path: $.x509.version

Cert: Serial number

The serial number is a positive integer assigned by the CA to each certificate. It is unique for each certificate issued by a given CA. Non-conforming CAs may issue certificates with serial numbers that are negative or zero.

Dependent item cert.serial_number

Preprocessing

  • JSON Path: $.x509.serial_number

Cert: Signature algorithm

The algorithm identifier for the algorithm used by the CA to sign the certificate.

Dependent item cert.signature_algorithm

Preprocessing

  • JSON Path: $.x509.signature_algorithm

Cert: Issuer

The field identifies the entity that has signed and issued the certificate.

Dependent item cert.issuer

Preprocessing

  • JSON Path: $.x509.issuer

Cert: Valid from

The date on which the certificate validity period begins.

Dependent item cert.not_before

Preprocessing

  • JSON Path: $.x509.not_before.timestamp

Cert: Expires on

The date on which the certificate validity period ends.

Dependent item cert.not_after

Preprocessing

  • JSON Path: $.x509.not_after.timestamp

Cert: Subject

The field identifies the entity associated with the public key stored in the subject public key field.

Dependent item cert.subject

Preprocessing

  • JSON Path: $.x509.subject

Cert: Subject alternative name

The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate. Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI).

Dependent item cert.alternative_names

Preprocessing

  • JSON Path: $.x509.alternative_names

Cert: Public key algorithm

The digital signature algorithm is used to verify the signature of a certificate.

Dependent item cert.public_key_algorithm

Preprocessing

  • JSON Path: $.x509.public_key_algorithm

Cert: Fingerprint

The Certificate Signature (SHA1 Fingerprint or Thumbprint) is the hash of the entire certificate in DER form.

Dependent item cert.sha1_fingerprint

Preprocessing

  • JSON Path: $.sha1_fingerprint

Triggers

Name Description Expression Severity Dependencies and additional info
Cert: SSL certificate is invalid

SSL certificate has expired or it is issued for another domain.

find(/Website certificate by Zabbix agent 2/cert.validation,,"like","invalid")=1 High
Cert: SSL certificate expires soon

The SSL certificate should be updated or it will become untrusted.

(last(/Website certificate by Zabbix agent 2/cert.not_after) - now()) / 86400 < {$CERT.EXPIRY.WARN} Warning Depends on:
  • Cert: SSL certificate is invalid
Cert: Fingerprint has changed

The SSL certificate fingerprint has changed. If you did not update the certificate, it may mean your certificate has been hacked. Acknowledge to close the problem manually.
There could be multiple valid certificates on some installations. In this case, the trigger will have a false positive. You can ignore it or disable the trigger.

last(/Website certificate by Zabbix agent 2/cert.sha1_fingerprint) <> last(/Website certificate by Zabbix agent 2/cert.sha1_fingerprint,#2) Info Manual close: Yes

Feedback

Please report any issues with the template at https://support.zabbix.com

You can also provide feedback, discuss the template, or ask for help at ZABBIX forums