DOKK / manpages / debian 12 / monitoring-plugins-contrib / check_ssl_cert.1.en
check_ssl_cert(1) USER COMMANDS check_ssl_cert(1)

check_ssl_cert - checks the validity of X.509 certificates

check_ssl_cert -H host [OPTIONS]
check_ssl_cert -f file [OPTIONS]

check_ssl_cert A shell script (that can be used as a Nagios/Icinga plugin) to check an SSL/TLS connection

Local file path or URI. With -f you can not only pass a x509 certificate file but also a certificate revocation list (CRL) to check the validity period or a Java KeyStore file
server

Ignore authority warnings (expiration only)
Enable all the possible optional checks at the maximum level
Enable all the possible optional checks at the maximum level (without SSL-Labs)
Allow certificates without Subject Alternative Names (SANs)
Use client certificate to authenticate
Minimum number of days a certificate has to be valid to issue a critical status. Can be a floating point number, e.g., 0.5. Default: 15
The certificate chain cannot contain double or root certificates
Check the offered ciphers
Critical if nmap reports a warning for an offered cipher
Check the HTTP headers for best practices
SSL Labs grade on which to warn
Set passphrase for client certificate.
Read options from the specified file
Check revocation via CRL (requires --rootcert-file)
Path of the curl binary to be used
Custom HTTP header sent when getting the cert example: 'X-Check-Ssl-Cert: Foobar=1'
Verify that valid DANE records exist (since OpenSSL 1.1.0)
Verify that a valid DANE-TA(2) SPKI(1) SHA2-256(1) TLSA record exists
Verify that a valid DANE-EE(3) Cert(0) SHA2-256(1) TLSA record exists
Verify that a valid DANE-EE(3) Cert(0) SHA2-512(2) TLSA record exists
Verify that a valid DANE-EE(3) SPKI(1) SHA2-256(1) TLSA record exists
Verify that a valid DANE-EE(3) SPKI(1) SHA2-512(1) TLSA record exists
Path of the date binary to be used
Produce debugging output (can be specified more than once)
Store the retrieved certificates in the current directory
Write the debug messages to file
Store the retrieved HTLM headers in the headers.txt file
Write timing information in the debugging output
Print the default output format and exit
Path of the dig binary to be used
Use the DTLS protocol
Use the DTLS protocol 1.0
Use the DTLS protocol 1.2
Pattern to match the email address contained in the certificate
Signature algorithm selection: force ECDSA certificate
Check up to the N cert element from the beginning of the chain
Path of the file binary to be used
Pattern to match the SHA1-Fingerprint
Verify just the first cert element, not the whole chain
Force the usage of dconv for date computations
Force the usage of Perl for date computations
Format output template on success, for example: '%SHORTNAME% OK %CN% from %CA_ISSUER_MATCHED%'
List of possible variables:
- %CA_ISSUER_MATCHED%
- %CHECKEDNAMES%
- %CN%
- %DATE%
- %DAYS_VALID%
- %DYSPLAY_CN%
- %HOST%
- %OCSP_EXPIRES_IN_HOURS%
- %OPENSSL_COMMAND%
- %PORT%
- %SELFSIGNEDCERT%
- %SHORTNAME%
- %SIGALGO%
- %SSL_LABS_HOST_GRADE%
See --default-format for the default
Path of the grep binary to be used
This help message
The path to be used to fetch HTTP headers
Use GET instead of HEAD (default) for the HTTP related checks
Pattern to match the issuer of the certificate
Ignore alternative names when matching pattern specified in -n (or the host name)
In case of connection problems returns OK or the optional state
Ignore expiration date
Ignore checks on HTTP headers with --all and --all-local
Do not complain if the CN does not match the host name
Do not check chain integrity
Ignore the certificate maximum validity
Do not check revocation with OCSP
Continue if the OCSP status cannot be checked
Ignore OCSP result when timeout occurs while checking
Do not check for signed certificate timestamps (SCT)
Do not check if the certificate was signed with SHA1 or MD5
Force a new check by SSL Labs (see -L)
Ignore the TLS renegotiation check
Force IP version 4 or 6
Print certificate information
Initialize the host cache
Directory where to store issuer certificates cache
Alias name of the Java KeyStore entry (requires --file)
Use client certificate key to authenticate
SSL Labs assessment (please check https://www.ssllabs.com/about/terms.html). Critical if the grade is lower than specified.
Append the specified comma separated (no spaces) list of attributes to the plugin output on additional lines. Valid attributes are: enddate, startdate, subject, issuer, modulus, serial, hash, email, ocsp_uri and fingerprint. 'all' will include all the available attributes.
Pattern to match the CN or AltName (can be specified multiple times)
The maximum validity of the certificate must not exceed 'days' (default 397). This check is automatic for HTTPS
Path of the nmap binary to be used
Do not show performance data
Ignore the http_proxy and https_proxy environment variables
Ignore the http_proxy and https_proxy environment variables for curl
Ignore the http_proxy and https_proxy environment variables for openssl s_client
Disable SSL version 2
Disable SSL version 3
Disable TLS version 1
Disable TLS version 1.1
Disable TLS version 1.3
Disable TLS version 1.2
Check that the issuer of the certificate does not match the given pattern
Critical if the certificate validity is longer than the specified period
Pattern to match the organization of the certificate
Minimum number of hours an OCSP response has to be valid to issue a critical status
Minimum number of hours an OCSP response has to be valid to issue a warning status
Path of the openssl binary to be used
TCP port (default 443)
Number of decimal places for durations: defaults to 0 if critical or warning are integers, 2 otherwise
Use the specific protocol: dns, ftp, ftps, http, https (default), h2 (HTTP/2), imap, imaps, irc, ircs, ldap, ldaps, mysql, pop3, pop3s, postgres, sieve, smtp, smtps, tds, xmpp, xmpp-server, ftp, imap, irc, ldap, pop3, postgres, sieve, smtp: switch to TLS using StartTLS. These protocols switch to TLS using StartTLS: ftp, imap, irc, ldap, mysql, pop3, smtp.
Set the PATH variable to 'path'
Password source for a local certificate, see the PASS PHRASE ARGUMENTS section openssl(1)
Generate Prometheus/OpenMetrics output
Set http_proxy and the s_client -proxy option
Path of the python binary to be used
Do not produce any output
Root certificate or directory to be used for certificate validation (passed to openssl's -CAfile or -CApath)
The server must accept a client certificate. 'list' is an optional comma separated list of expected client certificate CAs
Require DNSSEC
Require the specified HTTP header (e.g., X-Frame-Options)
Require the absence of the specified HTTP header (e.g., X-Powered-By)
Critical if SSL version 2 is offered
Critical if SSL version 3 is offered
Critical if TLS 1 is offered
Critical if TLS 1.1 is offered
Require OCSP stapling
Require the specified key usage (can be specified more then once)
The key usage must be critical
Require the specified HTTP security header (e.g., X-Frame-Options)
Require all the HTTP security headers:
Content-Security-Policy
Permissions-Policy
Referrer-Policy
strict-transport-security
X-Content-Type-Options
X-Frame-Options
Provide a custom IP address for the specified host
Root directory to be used for certificate validation (passed to openssl's -CApath) overrides option -r,--rootcert
Root certificate to be used for certificate validation (passed to openssl's -CAfile) overrides option -r,--rootcert
Signature algorithm selection: force RSA certificate
Set the security level to specified value. See SSL_CTX_set_security_level(3) for a description of what each level means
Allow self-signed certificates
Pattern to match the serial number
Skip checks on the Nth cert element (can be specified multiple times)
Set the TLS SNI (Server Name Indication) extension in the ClientHello message to 'name'
Force SSL version 2
Force SSL version 3
Timeout after the specified time (defaults to 120 seconds)
Directory where to store the temporary files
Terse output (also see --verbose)
Force TLS version 1
Force TLS version 1.1
Force TLS version 1.2
Force TLS version 1.3
HTTP request URL
User agent that shall be used for HTTPS connections
Verbose output (can be specified more than once)
Version
Minimum number of days a certificate has to be valid to issue a warning status. Might be a floating point number, e.g., 0.5. Default: 20
Specify the host for the 'to' attribute of the stream element
-4
Force IPv4
-6
Force IPv6

Match the pattern specified in -n with alternate names too (enabled by default)
Pattern to match the CN or AltName (can be specified multiple times)
User agent that curl shall use to obtain the issuer cert
Minimum number of days a certificate has to be valid (see --critical and --warning)
Match CN with the host name (enabled by default)
Disable SSLv2 (deprecated use --no-ssl2)
Disable SSLv3 (deprecated use --no-ssl3)
Disable TLSv1 (deprecated use --no-tls1)
Disable TLSv1.1 (deprecated use --no-tls1_1)
Disable TLSv1.1 (deprecated use --no-tls1_2)
Disable TLSv1.1 (deprecated use --no-tls1_3)
Check revocation via OCSP (enabled by default)
Require HTTP Strict Transport Security (deprecated use --require-security-header strict-transport-security)
the path to be used to fetch HTTP security headers
Require the presence of a Subject Alternative Name extension
Require the presence of the X-Frame-Options HTTP header. 'path' is the optional path to be used in the URL to check for the header (deprecated use --require-security-header X-Frame-Options and --require-security-headers-path path)
Force SSL version (2,3) (see: --ssl2 or --ssl3)

Command line options can be specified in a configuration file (${HOME}/.check_ssl_certrc). For example


$ cat ${HOME}/.check_ssl_certrc
--verbose
--critical 20
--warning 40

Options specified in the configuration file are read before processing the arguments and can be overridden.

If the host has multiple certificates and the installed openssl version supports the -servername option it is possible to specify the TLS SNI (Server Name Identificator) with the -N (or --host-cn) option.

check_ssl_cert returns a zero exist status if it finds no errors, 1 for warnings, 2 for a critical errors and 3 for unknown problems

Please report bugs to: https://github.com/matteocorti/check_ssl_cert/issues

check_ssl_cert --host github.com --all-local

openssl(1), openssl-x509(1)

February, 2023 2.60.0