zabbix监控ssl证书过期时间

获取证书过期时间脚本：

/etc/zabbix/scripts/check-cert-expire.sh

#!/bin/bash
host=$1
port=$2
end_date=`/usr/bin/openssl s_client -servername $host -host $host -port $port -showcerts </dev/null 2>/dev/null |
  sed -n '/BEGIN CERTIFICATE/,/END CERT/p' |
  /usr/bin/openssl  x509 -text 2>/dev/null |
  sed -n 's/ *Not After : *//p'`
# openssl 检验和验证SSL证书。
# -servername $host 因一台主机存在多个证书，利用SNI特性检查
# </dev/null 定向标准输入，防止交互式程序。从/dev/null 读时，直接读出0 。
# sed -n 和p 一起使用，仅显示匹配到的部分。 //,// 区间匹配。
# openssl x509 -text 解码证书信息，包含证书的有效期。

if [ -n "$end_date" ]
then
    end_date_seconds=`date '+%s' --date "$end_date"`
    now_seconds=`date '+%s'`
    echo "($end_date_seconds-$now_seconds)/24/3600" | bc
fi

#!/bin/bash

host=$1

port=$2

end_date=`/usr/bin/openssl s_client -servername $host -host $host -port $port -showcerts </dev/null 2>/dev/null |

sed -n '/BEGIN CERTIFICATE/,/END CERT/p' |

/usr/bin/openssl x509 -text 2>/dev/null |

sed -n 's/ *Not After : *//p'`

# openssl 检验和验证SSL证书。

# -servername $host 因一台主机存在多个证书，利用SNI特性检查

# </dev/null 定向标准输入，防止交互式程序。从/dev/null 读时，直接读出0 。

# sed -n 和p 一起使用，仅显示匹配到的部分。 //,// 区间匹配。

# openssl x509 -text 解码证书信息，包含证书的有效期。

if [ -n "$end_date" ]

then

end_date_seconds=`date '+%s' --date "$end_date"`

now_seconds=`date '+%s'`

echo "($end_date_seconds-$now_seconds)/24/3600" | bc

域名自动发现脚本：

/etc/zabbix/scripts/sshcert_discovery.py

#!/usr/bin/env python
#coding:utf-8

import os
import sys
import json

#这个函数主要是构造出一个特定格式的字典，用于zabbix
def ssl_cert_discovery():
    web_list=[]
    web_dict={"data":None}
    with open("/etc/zabbix/scripts/ssl_cert_list","r") as f:
        for sslcert in f:
            dict={}
            dict["{#DOMAINNAME}"]=sslcert.strip().split()[0]
            dict["{#PORT}"]=sslcert.strip().split()[1]
            web_list.append(dict)
    web_dict["data"]=web_list
    jsonStr = json.dumps(web_dict,indent=4)
    return jsonStr
if __name__ == "__main__":
    print ssl_cert_discovery()

#!/usr/bin/env python

#coding:utf-8

import os

import sys

import json

#这个函数主要是构造出一个特定格式的字典，用于zabbix

def ssl_cert_discovery():

web_list=[]

web_dict={"data":None}

with open("/etc/zabbix/scripts/ssl_cert_list","r") as f:

for sslcert in f:

dict={}

dict["{#DOMAINNAME}"]=sslcert.strip().split()[0]

dict["{#PORT}"]=sslcert.strip().split()[1]

web_list.append(dict)

web_dict["data"]=web_list

jsonStr = json.dumps(web_dict,indent=4)

return jsonStr

if __name__ == "__main__":

print ssl_cert_discovery()

域名列表：

/etc/zabbix/scripts/ssl_cert_list:
www.baidu.com 443
www.qq.com 443

/etc/zabbix/scripts/ssl_cert_list:

www.baidu.com 443

www.qq.com 443

zabbix配置：

/etc/zabbix/zabbix_agentd.conf.d/userparameter_sslcert.conf:
UserParameter=sslcert_discovery,/usr/bin/python  /etc/zabbix/scripts/sshcert_discovery.py
UserParameter=sslcert.info[*],/bin/bash /etc/zabbix/scripts/check-cert-expire.sh $1 $2

/etc/zabbix/zabbix_agentd.conf.d/userparameter_sslcert.conf:

UserParameter=sslcert_discovery,/usr/bin/python /etc/zabbix/scripts/sshcert_discovery.py

UserParameter=sslcert.info[*],/bin/bash /etc/zabbix/scripts/check-cert-expire.sh $1 $2

在zabbix中添加模板：

Template_ssl_cert_info

<?xml version="1.0" encoding="UTF-8"?>
<zabbix_export>
    <version>3.4</version>
    <date>2020-09-28T02:14:15Z</date>
    <groups>
        <group>
            <name>https证书监控</name>
        </group>
    </groups>
    <templates>
        <template>
            <template>Template_ssl_cert_Information</template>
            <name>Template_ssl_cert_Information</name>
            <description/>
            <groups>
                <group>
                    <name>https证书监控</name>
                </group>
            </groups>
            <applications/>
            <items/>
            <discovery_rules>
                <discovery_rule>
                    <name>ssl_cert_information</name>
                    <type>0</type>
                    <snmp_community/>
                    <snmp_oid/>
                    <key>sslcert_discovery</key>
                    <delay>10800</delay>
                    <status>0</status>
                    <allowed_hosts/>
                    <snmpv3_contextname/>
                    <snmpv3_securityname/>
                    <snmpv3_securitylevel>0</snmpv3_securitylevel>
                    <snmpv3_authprotocol>0</snmpv3_authprotocol>
                    <snmpv3_authpassphrase/>
                    <snmpv3_privprotocol>0</snmpv3_privprotocol>
                    <snmpv3_privpassphrase/>
                    <params/>
                    <ipmi_sensor/>
                    <authtype>0</authtype>
                    <username/>
                    <password/>
                    <publickey/>
                    <privatekey/>
                    <port/>
                    <filter>
                        <evaltype>0</evaltype>
                        <formula/>
                        <conditions/>
                    </filter>
                    <lifetime>30d</lifetime>
                    <description/>
                    <item_prototypes>
                        <item_prototype>
                            <name>sslinfo[{#DOMAINNAME}]</name>
                            <type>0</type>
                            <snmp_community/>
                            <snmp_oid/>
                            <key>sslcert.info[{#DOMAINNAME},{#PORT}]</key>
                            <delay>10800</delay>
                            <history>90d</history>
                            <trends>365d</trends>
                            <status>0</status>
                            <value_type>3</value_type>
                            <allowed_hosts/>
                            <units>day</units>
                            <snmpv3_contextname/>
                            <snmpv3_securityname/>
                            <snmpv3_securitylevel>0</snmpv3_securitylevel>
                            <snmpv3_authprotocol>0</snmpv3_authprotocol>
                            <snmpv3_authpassphrase/>
                            <snmpv3_privprotocol>0</snmpv3_privprotocol>
                            <snmpv3_privpassphrase/>
                            <params/>
                            <ipmi_sensor/>
                            <authtype>0</authtype>
                            <username/>
                            <password/>
                            <publickey/>
                            <privatekey/>
                            <port/>
                            <description/>
                            <inventory_link>0</inventory_link>
                            <applications/>
                            <valuemap/>
                            <logtimefmt/>
                            <preprocessing>
                                <step>
                                    <type>1</type>
                                    <params>1</params>
                                </step>
                            </preprocessing>
                            <jmx_endpoint/>
                            <application_prototypes/>
                            <master_item_prototype/>
                        </item_prototype>
                    </item_prototypes>
                    <trigger_prototypes>
                        <trigger_prototype>
                            <expression>{Template_ssl_cert_Information:sslcert.info[{#DOMAINNAME},{#PORT}].last()}&lt;30</expression>
                            <recovery_mode>0</recovery_mode>
                            <recovery_expression/>
                            <name>{#DOMAINNAME} https证书30天后到期请及时更换</name>
                            <correlation_mode>0</correlation_mode>
                            <correlation_tag/>
                            <url/>
                            <status>0</status>
                            <priority>4</priority>
                            <description/>
                            <type>0</type>
                            <manual_close>0</manual_close>
                            <dependencies/>
                            <tags/>
                        </trigger_prototype>
                    </trigger_prototypes>
                    <graph_prototypes>
                        <graph_prototype>
                            <name>sslinfo[{#DOMAINNAME}]</name>
                            <width>900</width>
                            <height>200</height>
                            <yaxismin>0.0000</yaxismin>
                            <yaxismax>100.0000</yaxismax>
                            <show_work_period>1</show_work_period>
                            <show_triggers>1</show_triggers>
                            <type>0</type>
                            <show_legend>1</show_legend>
                            <show_3d>0</show_3d>
                            <percent_left>0.0000</percent_left>
                            <percent_right>0.0000</percent_right>
                            <ymin_type_1>0</ymin_type_1>
                            <ymax_type_1>0</ymax_type_1>
                            <ymin_item_1>0</ymin_item_1>
                            <ymax_item_1>0</ymax_item_1>
                            <graph_items>
                                <graph_item>
                                    <sortorder>0</sortorder>
                                    <drawtype>0</drawtype>
                                    <color>1A7C11</color>
                                    <yaxisside>0</yaxisside>
                                    <calc_fnc>2</calc_fnc>
                                    <type>0</type>
                                    <item>
                                        <host>Template_ssl_cert_Information</host>
                                        <key>sslcert.info[{#DOMAINNAME},{#PORT}]</key>
                                    </item>
                                </graph_item>
                            </graph_items>
                        </graph_prototype>
                    </graph_prototypes>
                    <host_prototypes/>
                    <jmx_endpoint/>
                </discovery_rule>
            </discovery_rules>
            <httptests/>
            <macros/>
            <templates/>
            <screens/>
        </template>
    </templates>
</zabbix_export>

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

<?xml version="1.0" encoding="UTF-8"?>

<zabbix_export>

<group>

<name>https证书监控</name>

</group>

</groups>

<template>Template_ssl_cert_Information</template>

<name>Template_ssl_cert_Information</name>

<group>

<name>https证书监控</name>

</group>

</groups>

<discovery_rules>

<discovery_rule>

<name>ssl_cert_information</name>

<snmp_community/>

<snmp_oid/>

<key>sslcert_discovery</key>

<allowed_hosts/>

<snmpv3_contextname/>

<snmpv3_securityname/>

<snmpv3_securitylevel>0</snmpv3_securitylevel>

<snmpv3_authprotocol>0</snmpv3_authprotocol>

<snmpv3_authpassphrase/>

<snmpv3_privprotocol>0</snmpv3_privprotocol>

<snmpv3_privpassphrase/>

<ipmi_sensor/>

<port/>

</filter>

<item_prototypes>

<item_prototype>

<name>sslinfo[{#DOMAINNAME}]</name>

<snmp_community/>

<snmp_oid/>

<key>sslcert.info[{#DOMAINNAME},{#PORT}]</key>

<value_type>3</value_type>

<allowed_hosts/>

<snmpv3_contextname/>

<snmpv3_securityname/>

<snmpv3_securitylevel>0</snmpv3_securitylevel>

<snmpv3_authprotocol>0</snmpv3_authprotocol>

<snmpv3_authpassphrase/>

<snmpv3_privprotocol>0</snmpv3_privprotocol>

<snmpv3_privpassphrase/>

<ipmi_sensor/>

<port/>

<inventory_link>0</inventory_link>

<step>

</step>

</preprocessing>

<jmx_endpoint/>

<application_prototypes/>

<master_item_prototype/>

</item_prototype>

</item_prototypes>

<trigger_prototypes>

<trigger_prototype>

<expression>{Template_ssl_cert_Information:sslcert.info[{#DOMAINNAME},{#PORT}].last()}<30</expression>

<recovery_mode>0</recovery_mode>

<recovery_expression/>

<name>{#DOMAINNAME} https证书30天后到期请及时更换</name>

<correlation_mode>0</correlation_mode>

<correlation_tag/>

<url/>

<manual_close>0</manual_close>

<tags/>

</trigger_prototype>

</trigger_prototypes>

<graph_prototypes>

<graph_prototype>

<name>sslinfo[{#DOMAINNAME}]</name>

<show_work_period>1</show_work_period>

<show_triggers>1</show_triggers>

<show_legend>1</show_legend>

<show_3d>0</show_3d>

<percent_left>0.0000</percent_left>

<percent_right>0.0000</percent_right>

<ymin_type_1>0</ymin_type_1>

<ymax_type_1>0</ymax_type_1>

<ymin_item_1>0</ymin_item_1>

<ymax_item_1>0</ymax_item_1>

<graph_items>

<graph_item>

<calc_fnc>2</calc_fnc>

<item>

<host>Template_ssl_cert_Information</host>

<key>sslcert.info[{#DOMAINNAME},{#PORT}]</key>

</item>

</graph_item>

</graph_items>

</graph_prototype>

</graph_prototypes>

<host_prototypes/>

<jmx_endpoint/>

</discovery_rule>

</discovery_rules>

</template>

</templates>

</zabbix_export>

Leave a Reply Cancel reply