prometheus/ssl_exporter
1
0
Fork 0
mirror of https://github.com/ribbybibby/ssl_exporter.git synced 2024-11-27 08:31:02 +02:00
Code Issues Releases Activity
81ff845a10
ssl_exporter/README.md

167 lines
9.8 KiB
Markdown
Raw Normal View History

Initial commit
2017-08-20 20:30:02 +02:00
# SSL Certificate Exporter
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
The [blackbox_exporter](https://github.com/prometheus/blackbox_exporter) allows you to test the expiry date of a certificate as part of its HTTP(S) probe - which is great. It doesn't, however, tell you which certificate in the chain is nearing expiry or give you any other information that might be useful when sending alerts.
Initial commit
2017-08-20 20:30:02 +02:00
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
For instance, there's a definite value in knowing, upon first receiving an alert, if it's a certificate you manage directly or one further up the chain. It's also not always necessarily clear from the address you're polling what kind of certificate renewal you're looking at. Is it a Let's Encrypt, in which case it should be handled by automation? Or your organisation's wildcard? Maybe the domain is managed by a third-party and you need to submit a ticket to get it renewed.
Initial commit
2017-08-20 20:30:02 +02:00
Whatever it is, the SSL exporter gives you visibility over those dimensions at the point at which you receive an alert. It also allows you to produce more meaningful visualisations and consoles.
Add TOC to README
2019-08-15 18:08:43 +02:00
## Table of Contents
* [SSL Certificate Exporter](#ssl-certificate-exporter)
* [Building](#building)
* [Docker](#docker)
* [Flags](#flags)
* [Metrics](#metrics)
* [Prometheus](#prometheus)
* [Configuration](#configuration)
* [Targets](#targets)
* [Valid targets](#valid-targets)
* [Invalid targets](#invalid-targets)
* [Example Queries](#example-queries)
* [Client authentication](#client-authentication)
* [Proxying](#proxying)
* [Limitations](#limitations)
* [Acknowledgements](#acknowledgements)
Created by [gh-md-toc](https://github.com/ekalinin/github-markdown-toc)
Initial commit
2017-08-20 20:30:02 +02:00
## Building
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Add a Makefile that adheres to the Prometheus conventions
2017-12-02 20:55:31 +02:00
make
Initial commit
2017-08-20 20:30:02 +02:00
./ssl_exporter <flags>
It looks like there's a standard approach most Prometheus exporters use when building Dockerfiles, so I'm going to adhere to that. Rather than building the binary inside the container, it's built outside and then copied into the bin dir.
2017-12-02 21:03:36 +02:00
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Similarly to the blackbox_exporter, visiting [http://localhost:9219/probe?target=example.com:443](http://localhost:9219/probe?target=example.com:443) will return certificate metrics for example.com. The `ssl_tls_connect_success` metric indicates if the probe has been successful.
Initial commit
2017-08-20 20:30:02 +02:00
Update docker instructions in the README
2017-12-03 14:51:40 +02:00
## Docker
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Update docker instructions in the README
2017-12-03 14:51:40 +02:00
docker pull ribbybibby/ssl-exporter
docker run -p 9219:9219 ssl-exporter:latest <flags>
Initial commit
2017-08-20 20:30:02 +02:00
## Flags
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Switch to kingpin flags
2017-10-08 19:25:40 +02:00
./ssl_exporter --help
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
- **`--tls.insecure`:** Skip certificate verification (default false). This is insecure but does allow you to collect metrics in the case where a certificate has expired. That being said, I feel that it's more important to catch verification failures than it is to identify an expired certificate, especially as the former includes the latter.
- **`--tls.cacert`:** Provide the path to an alternative bundle of root CA certificates. By default the exporter will use the host's root CA set.
- **`--tls.client-auth`:** Enable client authentication (default false). When enabled the exporter will present the certificate and key configured by `--tls.cert` and `tls.key` to the other side of the connection.
- **`--tls.cert`:** The path to a local certificate for client authentication (default "cert.pem"). Only used when `--tls.client-auth` is toggled on.
- **`--tls.key`:** The path to a local key for client authentication (default "key.pem"). Only used when `--tls.client-auth` is toggled on.
- **`--web.listen-address`:** The port (default ":9219").
- **`--web.metrics-path`:** The path metrics are exposed under (default "/metrics")
- **`--web.probe-path`:** The path the probe endpoint is exposed under (default "/probe")
Initial commit
2017-08-20 20:30:02 +02:00
## Metrics
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Initial commit
2017-08-20 20:30:02 +02:00
Metrics are exported for each certificate in the chain individually. All of the metrics are labelled with the Issuer's Common Name and the Serial ID, which is pretty much a unique identifier.
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
I considered having a series for each `ssl_cert_subject_alternative_*` value but these labels aren't actually very cardinal, considering the most frequently they'll change is probably every three months, which is longer than most metric retention times anyway. Joining them within commas as I've done allows for easy parsing and relabelling.
Initial commit
2017-08-20 20:30:02 +02:00
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
| Metric | Meaning | Labels |
| ------------------------------------- | ----------------------------------------------------------------------------------- | -------------------------------- |
| ssl_cert_not_after | The date after which the certificate expires. Expressed as a Unix Epoch Time. | issuer_cn, serial_no |
| ssl_cert_not_before | The date before which the certificate is not valid. Expressed as a Unix Epoch Time. | issuer_cn, serial_no |
| ssl_cert_subject_common_name | The common name of the certificate. Always has a value of 1 | issuer_cn, serial_no, subject_cn |
| ssl_cert_subject_alternative_dnsnames | The subject alternative names (if any). Always has a value of 1 | issuer_cn, serial_no, dnsnames |
| ssl_cert_subject_alternative_emails | The subject alternative email addresses (if any). Always has a value of 1 | issuer_cn, serial_no, emails |
| ssl_cert_subject_alternative_ips | The subject alternative IP addresses (if any). Always has a value of 1 | issuer_cn, serial_no, ips |
| ssl_cert_subject_organization_units | The subject organization names (if any). Always has a value of 1. | issuer_cn, serial_no, subject_ou |
| ssl_client_protocol | The protocol used by the exporter to connect to the target. Boolean. | protocol |
| ssl_tls_connect_success | Was the TLS connection successful? Boolean. | |
Initial commit
2017-08-20 20:30:02 +02:00
## Prometheus
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Initial commit
2017-08-20 20:30:02 +02:00
### Configuration
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Initial commit
2017-08-20 20:30:02 +02:00
Just like with the blackbox_exporter, you should pass the targets to a single instance of the exporter in a scrape config with a clever bit of relabelling. This allows you to leverage service discovery and keeps configuration centralised to your Prometheus config.
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Initial commit
2017-08-20 20:30:02 +02:00
```yml
scrape_configs:
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
- job_name: "ssl"
Initial commit
2017-08-20 20:30:02 +02:00
metrics_path: /probe
static_configs:
- targets:
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
- example.com:443
- prometheus.io:443
Initial commit
2017-08-20 20:30:02 +02:00
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- target_label: __address__
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
replacement: 127.0.0.1:9219 # SSL exporter.
Initial commit
2017-08-20 20:30:02 +02:00
```
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
### Targets
The exporter uses the provided uri to decide which client (http or tcp) to use when connecting to the target. The uri must contain
either a protocol scheme (`https://`), a port (`:443`), or both (`https://example.com:443`).
If the `https://` scheme is provided then the exporter will use a http client to connect to the target. This allows you to take
advatange of some features not available when using tcp, like host-based proxying. The exporter doesn't understand any other L7
protocols, so it will produce an error for others, like `ldaps://` or `ftps://`.
If there's only a port, then a tcp client is used to make the TLS connection. This should allow you to connect to any TLS target, regardless
of L7 protocol.
If neither are given, the exporter assumes a https connection on port `443` (the most common case).
#### Valid targets
- `https://example.com`
- `https://example.com:443`
- `example.com:443`
- `example.com:636`
- `example.com`
#### Invalid targets
- `ldaps://example.com`
- `ldaps://example.com:636`
Initial commit
2017-08-20 20:30:02 +02:00
### Example Queries
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Initial commit
2017-08-20 20:30:02 +02:00
Certificates that expire within 7 days, with Subject Common Name and Subject Alternative Names joined on:
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
((ssl*cert_not_after - time() < 86400 * 7) \_ on (instance,issuer_cn,serial_no) group_left (dnsnames) ssl_cert_subject_alternative_dnsnames) \* on (instance,issuer_cn,serial_no) group_left (subject_cn) ssl_cert_subject_common_name
Initial commit
2017-08-20 20:30:02 +02:00
Only return wildcard certificates that are expiring:
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
((ssl_cert_not_after - time() < 86400 * 7) * on (instance,issuer_cn,serial_no) group_left (subject_cn) ssl_cert_subject_common_name{subject_cn=~"\\*.*"})
Initial commit
2017-08-20 20:30:02 +02:00
Number of certificates in the chain:
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Initial commit
2017-08-20 20:30:02 +02:00
count(ssl_cert_subject_common_name) by (instance)
Identify instances that have failed to create a valid SSL connection:
Update README and examples for tls changes
2019-03-20 20:07:18 +02:00
ssl_tls_connect_success == 0
Initial commit
2017-08-20 20:30:02 +02:00
Update documentation for client authentication
2019-03-11 20:43:21 +02:00
## Client authentication
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Update documentation for client authentication
2019-03-11 20:43:21 +02:00
The exporter optionally supports client authentication, which can be toggled on by providing the `--tls.client-auth` flag. By default, it will use the host system's root CA bundle and attempt to use `./cert.pem` and `./key.pem` as the client certificate and key, respectively. You can override these defaults with `--tls.cacert`, `--tls.cert` and `--tls.key`.
If you do enable client authentication, keep in mind that the certificate will be passed to all targets, even those that don't necessarily require client authentication. I'm not sure what the implications of that are but I think you'd probably want to avoid passing a certificate to an unrelated server.
Also, if you want to scrape targets with different client certificate requirements, you'll need to run different instances of the exporter for each. This seemed like a better approach than overloading the exporter with the ability to pass different certificates per-target.
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
## Proxying
The https client used by the exporter supports the use of proxy servers discovered by the environment variables `HTTP_PROXY`,
`HTTPS_PROXY` and `ALL_PROXY`.
For instance:
$ export HTTPS_PROXY=localhost:8888
$ ./ssl_exporter
In order to use the https client, targets must be provided to the exporter with the protocol in the uri (`https://<host>:<optional port>`).
Initial commit
2017-08-20 20:30:02 +02:00
## Limitations
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Initial commit
2017-08-20 20:30:02 +02:00
I've only exported a subset of the information you could extract from a certificate. It would be simple to add more, for instance organisational information, if there's a need.
## Acknowledgements
Use https or tcp client based on target address There are some advantages to using a http client over tcp. For instance, using http allows you to take advatange of a http proxy, which may be necessary in some environments. This commit puts the http client back, alongside tcp, and decides which one to use based on the target address.
2019-08-15 10:43:34 +02:00
Update docker instructions in the README
2017-12-03 14:51:40 +02:00
The overall structure and implementation of this exporter is based on the [consul_exporter](https://github.com/prometheus/consul_exporter). The probing functionality borrows from the blackbox_exporter.
Reference in New Issue Copy Permalink