Cómo monitorear la expiración del certificado SSL/TLS de un sitio web con Zabbix

Now, Zabbix will keep an eye on that certificate and notify you when it’s about to go stale. Sort of a heads-up, not a surprise.

Monitor HTTPS Certificate Expiry with Custom Bash Script

This one’s for folks who wanna get down and dirty with scripts. Sometimes, you might not have the plugin or prefer something more customizable. The openssl command-line tool is the secret sauce here — can fetch cert expiration dates pretty reliably. So, create a little script like this:

#!/bin/bash data=`echo | openssl s_client -servername $1 -connect $1:${2:-443} 2>/dev/null | openssl x509 -noout -enddate | sed -e 's#notAfter=##'` ssldate=`date -d "${data}" '+%s'` nowdate=`date '+%s'` diff="$((${ssldate}-${nowdate}))" echo $((${diff}/24/3600))

Save it as /usr/lib/zabbix/externalscripts/sslcert_expiration.sh (yeah, you might need sudo to do that).Then, give it execution rights:

$ sudo chmod +x /usr/lib/zabbix/externalscripts/sslcert_expiration.sh

Test it out by running:

$ /usr/lib/zabbix/externalscripts/sslcert_expiration.sh woshub.com 443

If all’s good, it should show how many days are left before the cert expires. On one setup, it said 79 days — not bad. You just need to tell Zabbix to run this script via UserParameter. Edit your /etc/zabbix/zabbix_agent2.conf and add:

UserParameter=sslcertexpire[*], /usr/lib/zabbix/externalscripts/sslcert_expiration.sh $1 $2

After that, restart the agent because of course, Windows/Linux has to make it annoying:

$ sudo service zabbix-agent2 restart

Now you can test with:

$ zabbix_get -s 127.0.0.1 -p 10050 -k sslcertexpire[woshub.com, 443]

Zabbix will now receive days-left data for each monitored site. You can set up an item and trigger to warn before imminent expiration. Example trigger might be: “SSL for {$DOMAINNAME} about to expire in less than 20 days.”

• Name: Remaining SSL cert validity {$DOMAINNAME}
• Type: Zabbix Agent
• Key: sslcertexpire[{$DOMAINNAME}, {$SSL_PORT}]
• Trigger expression: last(/CheckSSLCertExpiration/sslcertexpire[{$DOMAINNAME}, {$SSL_PORT}])<20

Don’t forget to add relevant macros to your host, like {$DOMAINNAME} (like woshub.com) and {$SSL_PORT} (usually 443).Then, assign your custom template with the trigger set up. This way, Zabbix will alert you if your cert is about to get expired, helping you avoid surprises.

Pretty much, that’s the gist — both methods work, just depends if you prefer built-in tools or scripting. Either way, you’ll get that warning before things go south.

Summary

• Use WebCertificate plugin with Zabbix Agent 2 for easier setup if the plugin's available.
• Alternatively, deploy your own bash script with OpenSSL for custom checks.
• Set macros and triggers in Zabbix to get timely alerts about expiring SSL certs.

Wrap-up

So yeah, monitoring SSL expiry with Zabbix isn’t too tough, especially if you pick the method that suits your environment. On some machines, the built-in plugin just works right out of the box once configured. With scripting, you get a little more control but might need to do some troubleshooting with paths or permissions. Either way, keeping tabs on those certs can save a lot of headache — no more last-minute panic about expired certificates. Fingers crossed, this gets one update making your life easier.