Integration - Certificate Expiry

Development
1

Hello everyone :waving_hand:

Every host becomes a Gladys device with:

  • :date: remaining days before expiration (kept in history, you can make a graph);
  • :spiral_calendar: expiration date;
  • :office_building: issuer (Let’s Encrypt, the NAS itself…).

It works for public sites as well as for local network devices (NAS, box, reverse proxy, mail server, Proxmox…).

The integration connects directly to each host from the Gladys machine. It performs a TLS negotiation, reads the certificate, and then closes the connection. No HTTP request, no account, no cloud.

:high_voltage: Scenes

3 triggers:

  • A certificate is about to expire: alert level (30 days), critical (7 days), or expired. Thresholds are adjustable.
  • A certificate has been renewed: useful to confirm that an automatic renewal worked.
  • A certificate check failed: the host is unreachable or the certificate is not recognized.

Each trigger is sent only once per change, not with every check. A Gladys restart does not resend the same alerts.

Example: « When a certificate goes to Critical → send me a message: {{triggerEvent.data.host}} expires in {{triggerEvent.data.days_remaining}} days »

2 scene actions:

  • « Check a certificate », which provides the remaining days, the level, etc. to the following actions;
  • « Check all certificates ».

:bar_chart: Dashboard widget

The « Certificates » widget displays:

  • 3 counters: valid, to renew, problems;
  • the list sorted by urgency;
  • a « Check » button.

You can display only what requires attention.

:hammer_and_wrench: Tools in the configuration

  • Check now: checks everything and displays the result.
  • Inspect a host: displays the entire certificate of any host, even if not monitored. You can see the covered names, the issuer, the dates, the trust, the TLS version, and the SHA-256 fingerprint. A kind of openssl s_client in Gladys :wink:

:gear: Settings

  • Alert threshold and critical threshold (in days)
  • Check frequency (12 hours by default)
  • Connection delay
  • Whether to report self-signed certificates. Disable if your local devices use them: their expiration is still monitored.

:package: Installation

  • You need Gladys 5.1 or newer.
  • Installation from the Gladys integrations store.
  • Languages: :france: :united_kingdom: :germany: :spain:

:warning: Known limitations

  • Only direct TLS is supported: HTTPS, IMAPS 993, SMTPS 465, LDAPS 636… STARTTLS (SMTP 587, IMAP 143) is not yet supported.
  • A private certificate authority appears « unrecognized ». In this case, disable the trust option.

:link: Links

This is the first version, your feedback is welcome: bugs, ideas, use cases :folded_hands:
If you want STARTTLS, let us know, it will be the next step!