Re: certificate monitoring

On 5/29/2026 23:13 PM, Marco Moock wrote:
> Am 24.05.26 um 20:49 schrieb [email protected]:
>> The following should work for SMTP with STARTTLS: will alert when the 
>> certificate is invalid, or when it will expire in less than 30 days:
>>
>>     if failed
>>         port 25
>>         protocol smtps
>>         and certificate valid > 30 days
>>     then alert
>
> Thanks.
>
> Is there also an option to limit that test to one time a day, as it 
> fills the log. 

I test a couple of dozen website SSL certs daily; I use the 'cron' like 
function to stagger them across the course of an hour once a day -

check host SSL-redacted-a.com with address redacted-a.com
every "09-11 19 * * *"
if failed port 443 protocol https and certificate checksum =
7C27EAA4FAFFFFFFB310BDBAAAAAA9B3FAD4E3FE
and certificate valid > 4 days with ssl options {verify:enable} with 
timeout 66 seconds for 2 cycles
then exec /usr/local/bin/pushover
repeat every 5 cycle

check host SSL-redacted-b.com with address redacted-b.com
every "11-13 19 * * *"
if failed port 443 protocol https and certificate checksum =
8B27EAA4FAF71698BBBBBBBA148AAAAAAAD4E33F
and certificate valid > 4 days with ssl options {verify:enable} with 
timeout 66 seconds for 2 cycles
then exec /usr/local/bin/pushover
repeat every 5 cycle

etc.

Obviously i've munged the shasums, even though there's no particularly 
good reason to! The reason the checksum is on its own line is so that it 
simplifies programmatically updating the sum using sed after renewal.

-- 
Paul Theodoropoulos
www.anastrophe.com