custom ssl certificate monitoring with zabbix

description

we are all supposed to use the official thing right? it goes as such

from the zabbix server

    apt install jq
    zabbix_get -s ZABBIX-AGENT2 -k web.certificate.get[some.domain.tld] | jq

however it is awful to handle multiple ssl endpoints at once, and requires zabbix server v7.4 for that matter.

custom ssl monitoring #1

agent setup

on the zabbix agent2

cd /etc/zabbix/
vi ssldomains

some.domain.tld
another.domain.tld

cd /etc/zabbix/
vi ssl.bash

#!/bin/bash
domains=`cat /etc/zabbix/ssldomains`
echo -n '{"data":['
for domain in $domains; do
    # all records as one line to catch the trailing comma
    echo -n "{\"{#SSLDOMAIN}\":\"$domain\"},"
done | sed 's/,$//'; unset domain
echo ']}'

chmod +x ssl.bash

cd /etc/zabbix/zabbix_agent2.d/plugins.d/
vi ssl.conf
UserParameter=ssl.discovery,/etc/zabbix/ssl.bash

template

import https://github.com/marcpope/zabbix-multisslperhost/blob/main/zbx_ssl_template.yaml

name: SSLCheckCustom
template groups: templates/applications
descr: https://github.com/marcpope/zabbix-multisslperhost

custom ssl monitoring #2

agent setup

on the zabbix agent2

wget https://github.com/szazeski/checkssl/releases/download/v0.5.0/checkssl_0.5.0_$(uname -s)_$(uname -m).tar.gz \
-O checkssl.tar.gz
tar -xf checkssl.tar.gz
rm -f README.md LICENSE
mv -i checkssl /usr/local/bin/
chmod +x /usr/local/bin/checkssl

cd /etc/zabbix/
vi zabbix_agent2.conf

AllowKey=system.run[*]

cd /etc/zabbix/
vi wrapper-checkssl

#!/bin/bash
[[ -z $1 ]] && echo domain? && exit 1
/usr/local/bin/checkssl -days=5 -no-color $1

chmod +x wrapper-checkssl

cd /etc/zabbix/zabbix_agent2.d/plugins.d/
vi ssl2.conf
UserParameter=ssl2.discovery,/etc/zabbix/ssl.bash

note we’re pointing to the same domain listing script as above

template
name        checkssl
groups      templates/applications
descr       https://www.checkssl.org/

discovery rules
name        checkssl discovery
key     ssl2.discovery
interval    10m
period      30d

item prototypes
name        checkssl item proto
key     system.run[/etc/zabbix/wrapper-checkssl {#SSLDOMAIN}]
type        text
interval    1m
period      90d

trigger prototypes
name        checkssl trigger proto
expression  find(/checkssl/system.run[/etc/zabbix/wrapper-checkssl {#SSLDOMAIN}],,"regexp","PASS")=0