cert-checker is a certificate monitoring utility for watching tls certificates. These checks get exposed as Prometheus metrics to be viewed on a dashboard, or soft alert cluster operators.
This tool is heavily inspired by the awesome version-checker by jetstack.
cert-checker supports the following types of certificate errors (and possible more):
- Expired certificates
- Wrong host
- Bad root certificates
- Revoked certificate
- Cipher suites not allowed
- dh480
- dh512
- null
- rc4
cert-checker can be installed as a standalone static binary from the release page
Create a config file like the below example:
config.yaml
:
loglevel: debug
intervalminutes: 10
certificates:
- dns: google.com
- dns: expired.badssl.com
You can use the published docker image like this:
First create a config file as above.
# Start docker container (mounting the config file may be different on OSX and Windows)
docker run -p 8080:8080 -v ${PWD}/config.yaml:/app/config.yaml mogensen/cert-checker:latest
# Now open browser at http://localhost:8080/metrics
See released docker images on DockerHub
cert-checker can be installed as static manifests:
$ kubectl apply -k ./deploy/yaml
Remember to edit the configmap with the actual domains you want to monitor..
cert-checker can be installed as as helm release:
$ kubectl create namespace cert-checker
$ helm install cert-checker deploy/charts/cert-checker --namespace cert-checker
Depending on your setup, you may need to modify the ServiceMonitor
to get Prometheus to scrape it in a particular namespace.
See this.
You may also need to add additional labels to the ServiceMonitor
.
If you have installed the prometheus-community/kube-prometheus-stack
with the name of prometheus
the following should work:
$ helm upgrade cert-checker deploy/charts/cert-checker \
--namespace cert-checker \
--set=grafanaDashboard.enabled=true \
--set=serviceMonitor.enabled=true \
--set=serviceMonitor.additionalLabels.release=prometheus
cert-checker can be installed using kustomize:
Create a kustomization.yaml
file:
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cert-checker
resources:
- github.com/mogensen/cert-checker/deploy/yaml
# optionally pin to a specific git tag
# - github.com/mogensen/cert-checker/deploy/yaml?ref=cert-checker-0.0.1
# override confimap with your required settings
patchesStrategicMerge:
- |-
apiVersion: v1
kind: ConfigMap
metadata:
name: cert-checker
namespace: cert-checker
data:
config.yaml: |
loglevel: info
intervalminutes: 60
certificates:
- dns: my-very-own-domain.com
Use the kustomization.yaml
file to preview and deploy cert-checker:
$ kustomize build kustomization.yaml | less # preview yaml manifests
$ kustomize build kustomization.yaml | kubectl apply --dry-run=client -f - # dry-run apply manifests
$ kustomize build kustomization.yaml | kubectl apply -f - # deploy manifests
By default, cert-checker will expose the version information as Prometheus
metrics on 0.0.0.0:8080/metrics
.
A Grafana dashboard is also included in this repository.
It is located in the deployment folder: deploy/yaml/grafana-dashboard-cm.yaml
Grafana Dashboard
The dashboard shows the following
- Number of Broken Certificates
- Number of Certificates about to expire
- Number of Good Certificates
- A list with Certificates with errors
- A list of Certificates Expirations for valid certificates
By default, without the flag -c, --config
, cert-checker will
use a config file located next to the binary named config.yaml
.
This is currently the only flag / option available.
$ cert-checker -h
Certificate monitoring utility for watching tls certificates and reporting the result as metrics.
Usage:
version-checker [flags]
Flags:
-c, --config string config file (default is config.yaml) (default "config.yaml")
-h, --help help for version-checker
Test the full setup in Kubernetes with Prometheus and Grafana dashboards:
# First create a new kind cluster locally, and install prometheus
make dev.kind.create
# Build a docker image, load it into kind and deploy cert-checker and promeheus/grafana stuff
make image dev.kind.install
Access the local infrastructure here:
System | URL |
---|---|
Prometheus | http://prometheus.localtest.me/graph?g0.expr=cert_checker_is_valid&g0.tab=1&g0.stacked=0&g0.range_input=1h |
Grafana | http://grafana.localtest.me/d/cert-checker/certificate-checker |