Checking HTTPS SSL / TLS Protocols with CheckMK

General
1

Hi there,
it comes often to the case that we have to monitor https pages and need to know for example that tls 1.0 is disabled and tls 1.2 is enabled. So it would be awesome if there would be an check where we can specify simply port and allowed protocols and ciphers for tls. If they dont match = Warning.

With check_mk board tools this is i guess not possible right? I’ve already check_ssl_cert in production (GitHub - matteocorti/check_ssl_cert: A shell script (that can be used as a Nagios/Icinga plugin) to check an SSL/TLS connection.) which is a lot more powerfull in https checks, to check aswell for correct intermediate certificates and more granular stuff.
But this does not help out in the case specified above.
I’ve aswell the ssllabs plugin active, for external pages.

For Internal cases we’re good with GitHub - rbsec/sslscan: sslscan tests SSL/TLS enabled services to discover supported cipher suites but i can’t embed this into checkmk :slight_smile:

Maybe some of you have some ideas how to check for those tls settings with checkmk?

Kind regards,
Constantin

1 Like
2

Have you tried forcing the version that you want to evaluate?

image

If the specified version is not being use an error should be generated.
You could monitor the same URL several times using different values in that field and in the service name you could add the version that is being utilized.

2 Likes
3

Thanks for the hint - but this means that we need to do for example at least 4 checks per HTTP Service to are sure that sslv3, sslv2, tlsv1 and tls v1.1 is disabled right? That makes it a bit messy :-/

4

It depends, if your URLs dont contain an URI you could create those 4 checks and point to a folder.
Then you could create hosts using the URL of your sites and use $HOSTNAME$ in the service name. Another alternative is to create a script using check_http and reading the URLs from a list.

5

I am just leaving this here:

6

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.