x509/expiry: Add script
parent
9c7961bb5c
commit
3142db006a
|
@ -18,4 +18,5 @@ These scripts are intended to be used with the textfile exporter of
|
||||||
## Available Metrics
|
## Available Metrics
|
||||||
- [Printers](./printer/)
|
- [Printers](./printer/)
|
||||||
- [Epson ET-2720](./printer/epson/et-2720)
|
- [Epson ET-2720](./printer/epson/et-2720)
|
||||||
|
- [X.509](./x509/)
|
||||||
|
- [expiry](./x509/expiry/)
|
||||||
|
|
|
@ -0,0 +1,33 @@
|
||||||
|
X.509 Certificate Expiry Metrics
|
||||||
|
================================
|
||||||
|
|
||||||
|
This script simply retrieves a X.509 certificate from a given host and port
|
||||||
|
using OpenSSL and returns the number of seconds from the current time until
|
||||||
|
it expires (is no longer valid).
|
||||||
|
|
||||||
|
This script produces the following metrics:
|
||||||
|
|
||||||
|
- `x509_expire_seconds` with the number of seconds until the certificate
|
||||||
|
reaches its "not after" date, where a value of `0` means that it will
|
||||||
|
expire the next second;
|
||||||
|
- `x509_expire_success` holding `1` if OpenSSL succeeded retrieving and
|
||||||
|
parsing the certificate, otherwise `0`; and
|
||||||
|
- `x509_expire_scrape_duration_seconds` containing the number of seconds
|
||||||
|
that it took to produce `x509_expire_seconds`.
|
||||||
|
|
||||||
|
|
||||||
|
How To Use
|
||||||
|
----------
|
||||||
|
Provide the intended host and port number. Note that there is no parameter
|
||||||
|
for SNI, since I didn't need it.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
# Generate metrics
|
||||||
|
$ ./metrics HOST PORT > expiry.$$
|
||||||
|
|
||||||
|
# Atomic move to avoid Prometheus reading incomplete writes
|
||||||
|
$ mv expiry.$$ expiry.prom
|
||||||
|
```
|
||||||
|
|
||||||
|
_Warning:_ This script assumes trusted inputs and does not escape the
|
||||||
|
hostname in label value output.
|
|
@ -0,0 +1,74 @@
|
||||||
|
#!/bin/bash
|
||||||
|
# Retrieve X.509 certificate expiry information for a given host and port
|
||||||
|
#
|
||||||
|
# Copyright (C) 2021 Mike Gerwitz
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
# This will produce `x509_expire_seconds`, `x509_expire_success`, and
|
||||||
|
#`x509_expire_scrape_duration_seconds`.
|
||||||
|
#
|
||||||
|
# WARNING: This script assumes trusted input and does not perform escaping
|
||||||
|
# of label values.
|
||||||
|
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
cd "$(dirname "$0")"
|
||||||
|
|
||||||
|
|
||||||
|
main()
|
||||||
|
{
|
||||||
|
local host="${1?Missing domain}"
|
||||||
|
local -i port="${2?Missing port}"
|
||||||
|
|
||||||
|
local -ri start=$(date +%s)
|
||||||
|
|
||||||
|
local expire_date expire_ts=0 ok=0
|
||||||
|
expire_date=$( openssl s_client -showcerts \
|
||||||
|
-connect "$host":"$port" \
|
||||||
|
2>/dev/null \
|
||||||
|
</dev/null \
|
||||||
|
| openssl x509 -noout -dates \
|
||||||
|
| grep ^notAfter \
|
||||||
|
| cut -d= -f2 )
|
||||||
|
ok=$(( PIPESTATUS[0] == 0 ))
|
||||||
|
|
||||||
|
(( ok == 1 )) && expire_ts=$( date --date="$expire_date" +%s )
|
||||||
|
local -i expire_in=$(( expire_ts - EPOCHSECONDS ))
|
||||||
|
|
||||||
|
local -ri end=$(date +%s)
|
||||||
|
local -ri duration=$(( end - start ))
|
||||||
|
|
||||||
|
# Note that this does not perform any escaping; it assumes trusted input.
|
||||||
|
local labels=$( printf 'domain="%s", port="%d"' "$host" "$port" )
|
||||||
|
|
||||||
|
if [[ "$ok" == 1 ]]; then
|
||||||
|
echo -n '# HELP x509_expire_seconds '
|
||||||
|
echo 'Number of seconds until X.509 certificate reaches its "not after" date.'
|
||||||
|
echo '# TYPE x509_expire_seconds gauge'
|
||||||
|
printf 'x509_expire_seconds{%s} %d\n' "$labels" "$expire_in"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -n '# HELP x509_expire_success '
|
||||||
|
echo 'Whether the certificate was successfully retrieved and parsed.'
|
||||||
|
echo '# TYPE x509_expire_success gauge'
|
||||||
|
printf 'x509_expire_success{%s} %d\n' "$labels" "$ok"
|
||||||
|
|
||||||
|
echo -n '# HELP x509_expire_scrape_duration_seconds '
|
||||||
|
echo 'Number of seconds spent retrieving and parsing certificate expiry data.'
|
||||||
|
echo '# TYPE x509_expire_scrape_duration_seconds gauge'
|
||||||
|
printf 'x509_expire_scrape_duration_seconds{%s} %d\n' "$labels" "$duration"
|
||||||
|
}
|
||||||
|
|
||||||
|
main "$@"
|
Loading…
Reference in New Issue