Check SSL Certificate Age - Unexpectet result when checking non-existing virtual host

[jreinh]

Hello *,

I am using Check-MK-Version: Raw-2.1.0p26 and have a questing regarding the “Check HTTP service” check.

While setting up a web-server (Apache on Ubuntu) I activated the monitoring for a virtual host, before it was configured. Requesting the virtual host now would result in getting the web-server’s main-page.

What I did not expect was, that the ‘Check SSL Certificate Age’-check returned OK, if a valid certificate was returned.
Even when the certificate returned by the web-server wasn’t valid for the requested virtual host.

I would like to know if it is possible to fail the check, if the returned certificate if not valid for the requested virtual host.

Any help is appreciated.

My check configuration:

My check result:

Keep in mind, that the certificate ‘main-server.*’ does not cover the domain ‘virtualHost’.

[gstolz (Gerd Stolz)]

Hi @jreinh,

check_http afaik only checks the validity in regards to time, which can change, hence it makes sense to check regularly.

The certificate validity in regards to hostname is fixed, i.e. you would normally notice that it fails the moment you install the certificate and test it with the right hostname/virtual host

Also, the check would then be a lot more difficult as it would include certificate revocation lists and what not.

However; you are not the first one to think about this and someone seems to cover all bases with a separate check plugin here: GitHub - matteocorti/check_ssl_cert: A shell script (that can be used as a Nagios/Icinga plugin) to check an SSL/TLS connection.