| 1 | plugin_name: go.d.plugin |
| 2 | modules: |
| 3 | - meta: |
| 4 | id: collector-go.d.plugin-x509check |
| 5 | plugin_name: go.d.plugin |
| 6 | module_name: x509check |
| 7 | monitored_instance: |
| 8 | name: X.509 certificate |
| 9 | link: "" |
| 10 | categories: |
| 11 | - data-collection.synthetic-testing |
| 12 | icon_filename: lock.svg |
| 13 | keywords: |
| 14 | - x509 |
| 15 | - certificate |
| 16 | info_provided_to_referring_integrations: |
| 17 | description: "" |
| 18 | related_resources: |
| 19 | integrations: |
| 20 | list: [] |
| 21 | overview: |
| 22 | data_collection: |
| 23 | metrics_description: "" |
| 24 | method_description: | |
| 25 | This collectors monitors x509 certificates expiration time and revocation status. |
| 26 | default_behavior: |
| 27 | auto_detection: |
| 28 | description: "" |
| 29 | limits: |
| 30 | description: "" |
| 31 | performance_impact: |
| 32 | description: "" |
| 33 | additional_permissions: |
| 34 | description: "" |
| 35 | multi_instance: true |
| 36 | supported_platforms: |
| 37 | include: [] |
| 38 | exclude: [] |
| 39 | setup: |
| 40 | prerequisites: |
| 41 | list: [] |
| 42 | configuration: |
| 43 | file: |
| 44 | name: "go.d/x509check.conf" |
| 45 | options: |
| 46 | description: | |
| 47 | The following options can be defined globally: update_every, autodetection_retry. |
| 48 | folding: |
| 49 | title: Config options |
| 50 | enabled: true |
| 51 | list: |
| 52 | - name: update_every |
| 53 | description: Data collection interval (seconds). |
| 54 | default_value: 1 |
| 55 | required: false |
| 56 | group: Collection |
| 57 | - name: autodetection_retry |
| 58 | description: Autodetection retry interval (seconds). Set 0 to disable. |
| 59 | default_value: 0 |
| 60 | required: false |
| 61 | group: Collection |
| 62 | |
| 63 | - name: source |
| 64 | description: "Certificate source. Allowed schemes: https, tcp, tcp4, tcp6, udp, udp4, udp6, file, smtp." |
| 65 | default_value: "" |
| 66 | required: false |
| 67 | group: Target |
| 68 | - name: timeout |
| 69 | description: SSL connection timeout (seconds). |
| 70 | default_value: 2 |
| 71 | required: false |
| 72 | group: Target |
| 73 | |
| 74 | - name: check_full_chain |
| 75 | description: Monitor expiration time for all certificates in the chain (including intermediates and root). |
| 76 | default_value: no |
| 77 | required: false |
| 78 | group: Validation |
| 79 | - name: check_revocation_status |
| 80 | description: Check the revocation status of the certificate. |
| 81 | default_value: no |
| 82 | required: false |
| 83 | group: Validation |
| 84 | |
| 85 | - name: tls_skip_verify |
| 86 | description: Skip TLS certificate and hostname verification (insecure). |
| 87 | default_value: no |
| 88 | required: false |
| 89 | group: TLS |
| 90 | - name: tls_ca |
| 91 | description: Path to CA bundle used to validate the server certificate. |
| 92 | default_value: "" |
| 93 | required: false |
| 94 | group: TLS |
| 95 | - name: tls_cert |
| 96 | description: Path to client TLS certificate (for mTLS). |
| 97 | default_value: "" |
| 98 | required: false |
| 99 | group: TLS |
| 100 | - name: tls_key |
| 101 | description: Path to client TLS private key (for mTLS). |
| 102 | default_value: "" |
| 103 | required: false |
| 104 | group: TLS |
| 105 | |
| 106 | - name: vnode |
| 107 | description: Associates this data collection job with a [Virtual Node](https://learn.netdata.cloud/docs/netdata-agent/configuration/organize-systems-metrics-and-alerts#virtual-nodes). |
| 108 | default_value: "" |
| 109 | required: false |
| 110 | group: Virtual Node |
| 111 | examples: |
| 112 | folding: |
| 113 | title: Config |
| 114 | enabled: true |
| 115 | list: |
| 116 | - name: Website certificate |
| 117 | description: Website certificate. |
| 118 | config: | |
| 119 | jobs: |
| 120 | - name: my_site_cert |
| 121 | source: https://my_site.org:443 |
| 122 | - name: Local file certificate |
| 123 | description: Local file certificate. |
| 124 | config: | |
| 125 | jobs: |
| 126 | - name: my_file_cert |
| 127 | source: file:///home/me/cert.pem |
| 128 | - name: SMTP certificate |
| 129 | description: SMTP certificate. |
| 130 | config: | |
| 131 | jobs: |
| 132 | - name: my_smtp_cert |
| 133 | source: smtp://smtp.my_mail.org:587 |
| 134 | - name: Multi-instance |
| 135 | description: | |
| 136 | > **Note**: When you define more than one job, their names must be unique. |
| 137 | |
| 138 | Check the expiration status of the multiple websites' certificates. |
| 139 | config: | |
| 140 | jobs: |
| 141 | - name: my_site_cert1 |
| 142 | source: https://my_site1.org:443 |
| 143 | |
| 144 | - name: my_site_cert2 |
| 145 | source: https://my_site1.org:443 |
| 146 | |
| 147 | - name: my_site_cert3 |
| 148 | source: https://my_site3.org:443 |
| 149 | troubleshooting: |
| 150 | problems: |
| 151 | list: [] |
| 152 | alerts: |
| 153 | - name: x509check_days_until_expiration |
| 154 | metric: x509check.time_until_expiration |
| 155 | info: "SSL cert expiring soon (${label:source} cn:${label:common_name})" |
| 156 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/x509check.conf |
| 157 | - name: x509check_revocation_status |
| 158 | metric: x509check.revocation_status |
| 159 | info: "SSL cert revoked (${label:source})" |
| 160 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/x509check.conf |
| 161 | metrics: |
| 162 | folding: |
| 163 | title: Metrics |
| 164 | enabled: false |
| 165 | description: "" |
| 166 | availability: [] |
| 167 | scopes: |
| 168 | - name: source |
| 169 | description: These metrics refer to the SSL certificate. |
| 170 | labels: |
| 171 | - name: source |
| 172 | description: Same as the "source" configuration option. |
| 173 | - name: common_name |
| 174 | description: The common name (CN) extracted from the certificate. |
| 175 | - name: depth |
| 176 | description: The depth of the certificate within the certificate chain. The leaf certificate has a depth of 0, and subsequent certificates (intermediate certificates) have increasing depth values. The root certificate is at the highest depth. |
| 177 | metrics: |
| 178 | - name: x509check.time_until_expiration |
| 179 | description: Time Until Certificate Expiration |
| 180 | unit: seconds |
| 181 | chart_type: line |
| 182 | dimensions: |
| 183 | - name: expiry |
| 184 | - name: x509check.revocation_status |
| 185 | description: Revocation Status |
| 186 | unit: boolean |
| 187 | chart_type: line |
| 188 | dimensions: |
| 189 | - name: not_revoked |
| 190 | - name: revoked |