SSL Certificate Monitor
Introduction
An SSL certificate is a digital certificate that authenticates a website's identity and enables an encrypted connection. SSL certificates expire in specified time and that will make your website fail. So iIts critical to monitor expiry of SSL certificates.
Getting Started
Compatibility
vuSmartMaps support monitoring all types of X.509 SSL/TLS certificates used by various Web Services
Data Collection Method
vuSmartmaps collects health and performance data using VuNet's Internal Data Collector.
Prerequisites
Inputs for Configuring Data Source
- Data Source Name: Data source name to uniquely identify the source.
- Web Service URL for which SSL certificates should be monitored: The URL must starts with 'https' and should be a proper FQDN or an IP Address.
- Exclude Root Certificates: Should root certificates be excluded from monitoring or not
- Polling Frequency: Specifies the interval in seconds at which data is collected. Data collection occurs once every specified period.
Firewall Requirement
To collect data from this O11ySource, ensure the following ports are opened:
| Source IP | Destination IP | Destination Port | Protocol | Direction |
|---|---|---|---|---|
| IP address(es) of the vuSmartmaps Server | Web Services EndPoints | 443 | TCP | Outbound |
*Before providing the firewall requirements, please update the port based on the customer environment.
Configuring the Target
SSL Certificates are obtained directly by involing the Web Service so Web Services must be accessible from vuSmartMaps. There is no specific configuration required on the target server as such.
Configuration Steps
- Enable the O11ySource.
- Select the Sources tab and press the + button to add a new SSL Certificate Web Service to be monitored.
- Populate all the configurations. Click on Save to create the instance.
Metrics Collected
| Name | Description | Data Type |
|---|---|---|
| Age | Age of the SSL Certificate | UInt64 |
| Enddate | End date of SSL certificate | UInt64 |
| expiry | Expiry time of SSL certificate | Int64 |
| startdate | Start date of SSL certificate | UInt64 |
| verification_code | Verification Code of SSL certificate. | UInt64 |
| verification_error | Verification Error in String if there is an issue with SSL certificate | String |
| ocsp_status_code | Online Certificate Status Protocol Status Code | UInt64 |
| ocsp_next_update | when ocsp_stapled=yes, Date when OCSP will be next updated | UInt64 |
| ocsp_produced_at | when ocsp_stapled=yes, Date OCSP is produced at | UInt64 |
| ocsp_this_update | when ocsp_stapled=yes, Date OCSP is produced at | UInt64 |
| ocsp_verified | OCSP is verified or not | String |
| ocsp_status | Online Certificate Status Protocol Status | String |
| ocsp_stapled | OCSP Stapling improves performance by positioning a digitally-signed and time-stamped version of the OCSP response directly on the webserver. | String |
| san | The Subject Alternative Name (SAN) field in an SSL certificate is an extension that allows additional, alternative names to be associated with a certificate | String |
| issuer_serial_number | Certificate Issuer Serial number | String |
| issuer_common_name | Certificate Issuer Common Name | String |
| public_key_algorithm | Public Key Algorithm used for the certificate | String |
| signature_algorithm | Signature Algorithm used for the certificate | String |
| serial_number | The Serial Number is an alphanumeric string assigned by DigiCert to each SSL certificate | String |
| verification | Whether certificate is valid or not. | String |
| locality | This field denotes the city in which the organization is located. | String |
| province | The state/province where your company is legally located. | String |
| country | The country where your company is legally located. | String |
| organizational_unit | The name of your department within the organization | String |
| organization | The name of your organization | String |
| source | The URL with 443 port which is using the SSL certificate | String |
| source_url | The URL which is using the SSL certificate | String |
| type | Type of SSL certificate. Leaf, Intermediate, Root etc. | String |
| Tenant Id | Tenant Id | LowCardinality(String) |
| BU Id | BU Id | LowCardinality(String) |
| timestamp | timestamp | DateTime64 |
