OpenStack Core Infrastructure

Monitor SSL Certificate expiration

Bug #1133578 reported by Elizabeth K. Joseph
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Core Infrastructure
Fix Released
High
Elizabeth K. Joseph
OpenStack Core Infrastructure havana

Bug Description

Deploy a mechanism to monitor SSL Certificate expiration dates.

Ideas:

cron certwatch script

Nagios plugin (it's a bit much to set up Nagios just for this one check)

Hosts to check (possibly not an exhaustive list) & current expiration:

review.o.o expires July 29, 2013
jenkins.o.o expires July 29, 2013
etherpad.o.o expires October 13, 2013
wiki.o.o expires December 18, 2013
www.openstack.org expires July 22, 2013.

Elizabeth K. Joseph (lyz)
Changed in openstack-ci:
assignee: nobody → Elizabeth Krumbach (lyz)
Revision history for this message
Kevin Bringard (kbringard) wrote :

There's a nagios plugin to do this:

http://exchange.nagios.org/directory/Plugins/Network-Protocols/HTTP/check_ssl_certificate/details

I understand not wanting to setup nagios just for one check, but since it's just a perl script it should be somewhat easy to modify to run from cron and have it email a list of people when a certificate is about to expire:

./check_ssl_certificate -H host -p 443
m=Mar, d=19, h=23, m=59, s=59, y=2013, z=GMT
check_ssl_certificates: CRITICAL - only 0 day(s) left for this certificate.

Clark Boylan (cboylan)
Changed in openstack-ci:
status: New → Triaged
importance: Undecided → High
milestone: none → havana
Revision history for this message
Jeremy Stanley (fungi) wrote :

If certwatch doesn't work out, you can just install the nagios-plugins-contrib package without recommends and do something like I do to monitor my servers (my monitoring host just runs this out of /etc/cron.daily):

http://paste.openstack.org/show/37700/

Could certainly go fancier with it, but you get the idea...

Revision history for this message
Elizabeth K. Joseph (lyz) wrote :

I thought about it since Debian/Ubuntu doesn't currently package certwatch (it's more of a redhat thing). Turns out nagios-plugins-contrib doesn't exist in precise either. Testing now with ssl-cert-check configuration.

Revision history for this message
Elizabeth K. Joseph (lyz) wrote :

Ended up using ssl-cert-check package, change at https://review.openstack.org/#/c/30490/ to install everything via puppet to cacti server has been released.

Changed in openstack-ci:
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.