# Easy way to monitor SSL certificates

**URL:** <https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670>\
**Category:** Service Monitoring\
**Tags:** ssl\
**Created:** [March 2, 2020, 5:15pm UTC](https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670 "2020-03-02T17:15:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![n\_drew](https://community.icinga.com/letter_avatar_proxy/v4/letter/n/41988e/32.png) [@n\_drew](https://community.icinga.com/u/n_drew)\
**Post date:** [March 2, 2020, 5:15pm UTC](https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670/1 "2020-03-02T17:15:38Z")

</div>

Hi,  
could you recommend a method to check SSL certificates from websites?  
Basically something that check the validity of TLS certificates and to warn if they are about to exipire.  
I found this plugin, but I still don’t understand how to implement it on Icinga Web 2: [https://github.com/replicajune/sslvalidity](https://github.com/replicajune/sslvalidity)

thanks for your help

---

<div class="post-metadata">

**Author:** ![blakehartshorn](https://community.icinga.com/user_avatar/community.icinga.com/blakehartshorn/32/599_2.png) [@blakehartshorn](https://community.icinga.com/u/blakehartshorn)\
**Post date:** [March 2, 2020, 5:46pm UTC](https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670/2 "2020-03-02T17:46:40Z")

</div>

The stock nagios check\_http plugin can do this. The Icinga template is explained here:

[https://icinga.com/docs/icinga2/latest/doc/10-icinga-template-library/#http](https://icinga.com/docs/icinga2/latest/doc/10-icinga-template-library/#http)

---

<div class="post-metadata">

**Author:** ![unic](https://community.icinga.com/user_avatar/community.icinga.com/unic/32/200_2.png) [@unic](https://community.icinga.com/u/unic)\
**Post date:** [March 2, 2020, 6:26pm UTC](https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670/3 "2020-03-02T18:26:13Z")

</div>

Hi,

Do you know the Icinga Module?

[https://icinga.com/docs/certificate-monitoring/latest/doc/01-About/](https://icinga.com/docs/certificate-monitoring/latest/doc/01-About/)

Not sure if that is the “Easy Way” you are searching, but its a intresting one 🙂

---

<div class="post-metadata">

**Author:** ![lx183](https://community.icinga.com/user_avatar/community.icinga.com/lx183/32/2125_2.png) [@lx183](https://community.icinga.com/u/lx183)\
**Post date:** [March 6, 2020, 12:57pm UTC](https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670/4 "2020-03-06T12:57:31Z")

</div>

Hi,

-sh-4.2$ /usr/lib64/nagios/plugins/check\_tcp -H [google.com](http://google.com) -p 443 -D 60,5  
SSL WARNING - Certificate ‘\*.google.com’ expires in 60 day(s) (2020-05-06 13:37 +0200/CEST).

-D, --certificate=INTEGER[,INTEGER]  
Minimum number of days a certificate has to be valid.  
1st is #days for warning, 2nd is critical (if not specified - 0).

---

<div class="post-metadata">

**Author:** ![Peteer](https://community.icinga.com/letter_avatar_proxy/v4/letter/p/f14d63/32.png) [@Peteer](https://community.icinga.com/u/Peteer)\
**Post date:** [January 8, 2021, 11:03am UTC](https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670/5 "2021-01-08T11:03:45Z")

</div>

Hi, you can you SSL Certificate Monitor (its android app) - I need to monitor about 35 certificates from different clients, and this is really easy to use and well organized- [https://play.google.com/store/apps/details?id=cz.trilobite.android.app.certmon](https://play.google.com/store/apps/details?id=cz.trilobite.android.app.certmon) - it works great, and it has super widget.

---

<div class="post-metadata">

**Author:** ![Ilya](https://community.icinga.com/letter_avatar_proxy/v4/letter/i/58f4c7/32.png) [@Ilya](https://community.icinga.com/u/Ilya)\
**Post date:** [May 6, 2022, 9:16am UTC](https://community.icinga.com/t/easy-way-to-monitor-ssl-certificates/3670/6 "2022-05-06T09:16:44Z")

</div>

Hello!

Your suggestion works only for single SSL certificate/domain at the target host.

For multiple domains (virtual hosts) --sni should be added.  
For example:

```auto
DNS site1.company.com A 1.2.3.4
DNS site2.company.com A 1.2.3.4

```

to check both certificates:

```auto
/usr/lib/nagios/plugins/check_tcp -H site1.company.com -p 443 -D 60,5 --sni site1.company.com

/usr/lib/nagios/plugins/check_tcp -H site2.company.com -p 443 -D 60,5 --sni site2.company.com

```