Monitoring SSL certs on windows

[Newtocheck (AJS)]

Hi,

Is there a way to monitor ssl certificates for each windows system / host? I have added the plug in I have come across trolling through forums however how are you meant to specify a file path to search for windows? Linux, fine i get it.

Thanks!

[andreas-doehler (Andreas)]

@Newtocheck

meant to specify a file path to search for windows?

On the Windows system you can leave this setting blank.
The Windows plugins looks inside the internal certificate store.
If you take a look at the Powershell script, you will see that it only does a Get-ChildItem inside Cert:.…
I think you use this plugin.

[Newtocheck (AJS)]

Hey Andreas,

I must be missing something here, So i downloaded the MKP file and enabled the extension package. Committed the changes.

The file path is no longer required, so i have left it blank.

I have set to to an explicit host just as a test and committed the changed however when i do a service configuration on the host in question, nothing appears? should it?

I did save the PS script as .VBS and placed it on the host - C:\Program Files (x86)\checkmk\service\plugins again nothing…

I haven’t done much in terms of using “3rd party” plug in’s withing checkMK so i am most likely missing something here? Any idea’s?

Regards
Aaron Sutton

[kribbit (I. Hambrock)]

Hi there,
you should try to execute the ps1 Script on the server’s command line prior to digging around for errors within checkmk. I don’t have a Windows system at hand to test that it does work on the server. Specifically, you should try to run it with the same credentials your checkmk agent uses.

You should get a quick response listing the contents of your cert Stores which allows you to check wheter your expected certificates are there at all. If the script is not able to run, you have somthing to fix before you try to debug checkmk.

It could very well be that your server dows not allow ps1 files to be executed or does not trust unsigned files. In any case the file has to work - otherwise you won’t see anything in Checkmk itself.

The file you want to have executed needs to be placed here: C:\ProgramData\checkmk\agent\plugins according to Monitoring Windows - The new agent for Windows in detail (checkmk.com)