Do many people still monitor their SSL certificates for expiry/validity, given certificate providers like AWS ACM handle refreshing certificates automatically?
(I run the 200th uptime monitoring service, and SSL validity checking doesn't seem to be a particularly high priority for my users, hence the question)
check_tls () {
# Check two weeks in the future to give us time to fix certs
faketime +14days \
openssl s_client -showcerts -verify_return_error "$@" \
</dev/null || exit 1
}
An example with dual stack IPv4/v6 https/smtp/imap support:
for af in -4 -6; do
for connect in \
www.example.org:443 \
\
mail.example.org:465 \
mail.example.org:993 \
;
do
check_tls $af -connect $connect
done
check_tls $af -starttls smtp -connect mail.example.org:25
check_tls $af -starttls smtp -connect mail.example.org:587
check_tls $af -starttls imap -connect mail.example.org:143
done
I guess it’s a low-hanging fruit (easy) external thing to monitor alongside the normal HTTP checks so I just throw it in there and keep an eye on it.
Over time I continue to delegate/offload things to external providers, like PaaS/IaaS services, SSL termination, logging etc, but I’m still ultimately responsible if any of my systems go down. It doesn’t really matter whether it happens to be my direct fault or that of the provider. So monitoring seems just as important. In fact there’s an argument for increasing monitoring the more you automate/delegate something. Otherwise you might lose sight of it altogether and only be abruptly reminded of it’s existence when something unexpected happens!
We even monitor important (to us) external services' and FAANGs' certificates and services. We've surprised a number of external entities with "hey, the cert for $xyz expires tomorrow", including a popular fruit-based FAANG.
Also, check out the script in the other comment from dxld!