Hacker News Reader

Comment by gjsman-1000 | Hacker News Reader

I'm actually curious: Is there a market for a SaaS which simply keeps track of certificates and when they expire? (Perhaps even with an auto-Deploy new certificate mechanism?)

View on HN

Perhaps but I call it doing my job. I run up a SSL cert check on icinga for each system as needed. It is quite trivial to roll your own script or find one that can be run from cron. It would probably need more work maintaining an account with a saas.

Why is it needed or your job?

You work in an industry whose entire purpose is to automate such things.

Yes, but will your company remember to fill your job when you leave?

job security?

its a very, very simple update alert to add to Prometheus to monitor that, and alert if the cert is within so many days of expiring. You need the 'blackbox exporter' and a simple rule such as:

  alert: TlsCertExpiringSoon
  expr: (probe_ssl_earliest_cert_expiry
    - time()) < (86400 * 14)
  for: 10m
    labels:
    product: Name_of_Product
    severity: page
  annotations:
    description: the tls cert for the URL {{ $labels.instance }} expires in less than 14 days!
  summary: TLS cert for {{$labels.instance}} expiring

I run a SaaS where certificate expiration monitoring is one of the features. But that's more of a nice-to-have feature rather than a primary thing that brings in customers.

Love your site and ethos. Very cool.

Datadog does that https://www.datadoghq.com/blog/monitor-tls-with-datadog/

KeyChest.net does this and posts about it regularly to HN:

https://news.ycombinator.com/from?site=keychest.net

https://sslmate.com/certspotter/

It's s trivial to monitor certificates so I'm thinking that those who know they need it have it.

I think most monitoring services will let you know if your certificate is about to expire. For example, I use https://checklyhq.com and it lets you configure how far in advance it will alert you.

Just use whatever you use to monitor your production systems in the first place. E.g. we use nagios.

Uptime Robot is a simple SaaS that monitors TLS cert expiration dates (in addition to other things).

https://ohdear.app does that.

Datadog has agents to monitor that.

statuscake.com does it, but I just solved it with Datadog

Yes

I don't think so. The people who would need a service like this don't think they do, and everyone else uses let's encrypt.

It could be a freebie offered by cloud providers. Maybe MS should do this and eat its own dog food.

Reply on news.ycombinator.com