Skip to content

[sslcertificates] Stable check names on Windows #225

@mueller-ma

Description

@mueller-ma

The check names for Linux are based on the file where the certificate is found. When the cert is replaced by moving a new cert file to the old location, the remaining lifetime is updated on the server and everything is fine (i.e. the check is always green):

Image

On Windows the check name is based on the cert thumb, which changes when a certificate is renewed, e.g. by replacing it with a completly new one. This causes a warning for the discovery check:

Image

I don't want to use the auto discovery feature of Checkmk here as certs must only vanish when a new cert with the same subject appears. AFAIK this condition isn't possible in auto discovery.

Maybe use something else for the check name, e.g. SSL Certificate <subject> <issuer>. This way manual interaction is only required when the issuer or subject changes.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions