# Is it possible to monitor SSL Certificate expiration using heartbeat without the CA certificate?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-monitor-ssl-certificate-expiration-using-heartbeat-without-the-ca-certificate/167110>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [February 5, 2019, 11:48am UTC](https://discuss.elastic.co/t/is-it-possible-to-monitor-ssl-certificate-expiration-using-heartbeat-without-the-ca-certificate/167110 "2019-02-05T11:48:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 5, 2019, 11:48am UTC](https://discuss.elastic.co/t/is-it-possible-to-monitor-ssl-certificate-expiration-using-heartbeat-without-the-ca-certificate/167110/1 "2019-02-05T11:48:47Z")

</div>

Hello,

I have to monitor the expiration of some SSL Certificates and was making some tests with heartbeat.

I know that if you have a http monitor using ssl and the ca certificate you will be able to have the expiration date of the certificate on the field `tls.certificate_not_valid_after`, something like that:

```auto
- type: http
  schedule: '@every 60m'
  tags: ["https"]
  urls: ["https://SITE:443"]
  ssl:
    certificate_authorities: ["/path/to/the/CA.crt"]

```

But I would need to have the CA certificate file on the server, I was wondering if it is possible to have a monitor that works like the `check_http` plugin from nagios, where you pass the site as a parameter and it returns the expiration date.

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 28, 2019, 2:09pm UTC](https://discuss.elastic.co/t/is-it-possible-to-monitor-ssl-certificate-expiration-using-heartbeat-without-the-ca-certificate/167110/2 "2019-02-28T14:09:08Z")

</div>

I'm a bit confused. Are you saying that your server doesn't send an x509 certificate when the TLS connection is established?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 28, 2019, 2:39pm UTC](https://discuss.elastic.co/t/is-it-possible-to-monitor-ssl-certificate-expiration-using-heartbeat-without-the-ca-certificate/167110/3 "2019-02-28T14:39:03Z")

</div>

Yes, it does not send a certificate.

I want to get the expiration date of a site certificate, today I'm using a nagios plugin for it where I pass the site as a parameter, like below

```auto
[user@server plugins]$ ./check_http -H site.com --ssl --sni -C 90
SSL OK - Certificate 'site.com' will expire in 527 days on 2020-08-08 16:42 -0300/-03.

```

This brings me the expiration date of the certificate, and will mark as a WARNING if the date is less then `90`, because of the parameter `-C 90`.

I do not need to have the certificate of `site.com` to do it.

I was planning to do the same with heartbeat, but if I do not have the site certificate on my machine and configured on the monitor, it will give me an error.

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [February 28, 2019, 3:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-monitor-ssl-certificate-expiration-using-heartbeat-without-the-ca-certificate/167110/4 "2019-02-28T15:34:24Z")

</div>

So, this is possible, but it's a bit different of a strategy.

My concern with marking a site down when its cert expires in X days is that it's not down _yet_.

The reason we built this without this feature is that you can query for sites expiring in X days using Elasticsearch or watcher. There's no need to hardcode that info in config files.

In the future, we'd like to make alerting on that condition easy using the new uptime UI, but we're not quite there yet.

What do you think of that plan?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2019, 3:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-monitor-ssl-certificate-expiration-using-heartbeat-without-the-ca-certificate/167110/5 "2019-03-28T15:34:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.