DOKK / manpages / debian 11 / monitoring-plugins-contrib / check_ssl_cert.1.en
check_ssl_cert(1) USER COMMANDS check_ssl_cert(1)

check_ssl_cert - checks the validity of X.509 certificates

check_ssl_cert -H host [OPTIONS]

check_ssl_cert A Nagios plugin to check an X.509 certificate:
- checks if the server is running and delivers a valid certificate
- checks if the CA matches a given pattern
- checks the validity

server

ignore authority warnings (expiration only)
enables all the possible optional checks at the maximum level
matches the pattern specified in -n with alternate names too
checks the offered ciphers
critical if nmap reports a warning for an offered cipher
use client certificate to authenticate
set passphrase for client certificate.
minimum number of days a certificate has to be valid to issue a critical status
checks revokation via CRL (requires --rootcert-file)
path of the curl binary to be used
user agent that curl shall use to obtain the issuer cert
custom HTTP header sent when getting the cert
verifies there are valid TLSA records for the returned certificate, requires OpenSSL 1.1.0 or later
verify that a valid DANE-TA(2) SPKI(1) SHA2-256(1) TLSA record exists
verify that a valid DANE-EE(3) Cert(0) SHA2-256(1) TLSA record exists
verify that a valid DANE-EE(3) Cert(0) SHA2-512(2) TLSA record exists
verify that a valid DANE-EE(3) SPKI(1) SHA2-256(1) TLSA record exists
path of the date binary to be used
produces debugging output (can be specified more than once)
stores the retrieved certificates in the current directory
path of the dig binary to be used
signature algorithm selection: force ECDSA certificate
checks N cert element from the begining of the chain
pattern to match the email address contained in the certificate
local file path (works with -H localhost only) with -f you can not only pass a x509 certificate file but also a certificate revocation list (CRL) to check the validity period
path of the file binary to be used
pattern to match the SHA1-Fingerprint
verify just the first cert element, not the whole chain
force the usage of Perl for date computations
custom output format (e.g. "%SHORTNAME% OK %CN% from '%CA_ISSUER_MATCHED%'")
this help message
use GET instead of HEAD (default) for the HTTP related checks
ignores alternative names when matching pattern specified in -n (or the host name)
ignore expiration date
do not complain if the CN does not match the host name
do not check revocation with OCSP
ignore OCSP result when timeout occurs while checking
do not check if the certificate was signed with SHA1 or MD5
do not check for signed certificate timestamps (SCT)
Forces a new check by SSL Labs (see -L)
Ignores the TLS renegotiation check
Force IP version 4 or 6
directory where to store issuer certificates cache
pattern to match the issuer of the certificate
use client certificate key to authenticate
SSL Labs assestment (please check https://www.ssllabs.com/about/terms.html). Critical if the grade is lower than specified.
SSL Labs grade on which to warn
append the specified comma separated (no spaces) list of attributes to the plugin output on additional lines. Valid attributes are: enddate, startdate, subject, issuer, modulus, serial, hash, email, ocsp_uri and fingerprint. 'all' will include all the available attributes.
pattern to match the CN of the certificate (can be specified multiple times)
path of the nmap binary to be used
do not show performance data
ignores the http_proxy and https_proxy environment variables
disable SSL version 2
disable SSL version 3
disable TLS version 1
disable TLS version 1.1
disable TLS version 1.3
disable TLS version 1.2
check that the issuer of the certificate does not match the given pattern
critical if the certificate validity is longer than the specified period
match CN with the host name
minimum number of hours an OCSP response has to be valid to issue a critical status
minimum number of hours an OCSP response has to be valid to issue a warning status
pattern to match the organization of the certificate
path of the openssl binary to be used
password source for a local certificate, see the PASS PHRASE ARGUMENTS section openssl(1)
TCP port
use the specific protocol: ftp, ftps, http, https (default), h2 (http/2), imap, imaps, irc, ircs, ldap, ldaps, mysql, pop3, pop3s, postgres, sieve, smtp, smtps, xmpp, xmpp-server.
These protocols switch to TLS using StartTLS: ftp, imap, irc, ldap, mysql, pop3, smtp.
sets http_proxy
critical if SSL version 2 is offered
critical if SSL version 3 is offered
critical if TLS 1 is offered
critical if TLS 1.1 is offered
provides a custom IP address for the specified host
allows self-signed certificates
pattern to match the serial number
skip checks on N cert element from the begining of the chain
sets the TLS SNI (Server Name Indication) extension in the ClientHello message to 'name'
force SSL version 2
force SSL version 3
require OCSP stapling
require the presence of a Subject Alternative Name extension
root certificate or directory to be used for certificate validation (passed to openssl's -CAfile or -CApath)
root directory to be used for certificate validation (passed to openssl's -CApath) overrides option -r,--rootcert
root certificate to be used for certificate validation (passed to openssl's -CAfile) overrides option -r,--rootcert
signature algorithm selection: force RSA certificate
directory where to store the temporary files
terse output (also see --verbose)
seconds timeout after the specified time (defaults to 120 seconds)
force TLS version 1
force TLS version 1.1
force TLS version 1.2
force TLS version 1.3
HTTP request URL
verbose output (can be specified more than once)
version
minimum number of days a certificate has to be valid to issue a warning status
specifies the host for the "to" attribute of the stream element
-4
forces IPv4
-6
forces IPv6

minimum number of days a certificate has to be valid (see --critical and --warning)
check revocation via OCSP
force SSL version (2,3) (see: --ssl2 or --ssl3)

If the host has multiple certificates and the installed openssl version supports the -servername option it is possible to specify the TLS SNI (Server Name Idetificator) with the -N (or --host-cn) option.

x509(1), openssl(1), expect(1), timeout(1)

check_ssl_cert returns a zero exist status if it finds no errors, 1 for warnings, 2 for a critical errors and 3 for unknown problems

Please report bugs to:

https://github.com/matteocorti/check_ssl_cert/issues

Matteo Corti (matteo (at) corti.li ) See the AUTHORS file for the complete list of contributors

May, 2021 2.2.0