Scroll to navigation

check_ssl_cert(1) USER COMMANDS check_ssl_cert(1)

NAME

check_ssl_cert - checks the validity of X.509 certificates

SYNOPSIS

check_ssl_cert -H host [OPTIONS]
check_ssl_cert -f file [OPTIONS]

DESCRIPTION

check_ssl_cert A shell script (that can be used as a Nagios/Icinga plugin) to check an SSL/TLS connection

ARGUMENTS

local file path (works with -H localhost only) with -f you can not only pass a x509 certificate file but also a certificate revocation list (CRL) to check the validity period
server

OPTIONS

ignore authority warnings (expiration only)
enables all the possible optional checks at the maximum level
enables all the possible optional checks at the maximum level (without SSL-Labs)
allow certificates without Subject Alternative Names (SANs)
use client certificate to authenticate
minimum number of days a certificate has to be valid to issue a critical status. Can be a floating point number, e.g., 0.5. Default: 15
checks the offered ciphers
critical if nmap reports a warning for an offered cipher
SSL Labs grade on which to warn
set passphrase for client certificate.
checks revocation via CRL (requires --rootcert-file)
path of the curl binary to be used
user agent that curl shall use to obtain the issuer cert
custom HTTP header sent when getting the cert example: 'X-Check-Ssl-Cert: Foobar=1'
produces debugging output (can be specified more than once)
verify that valid DANE records exist (since OpenSSL 1.1.0)
verify that a valid DANE-TA(2) SPKI(1) SHA2-256(1) TLSA record exists
verify that a valid DANE-EE(3) Cert(0) SHA2-256(1) TLSA record exists
verify that a valid DANE-EE(3) Cert(0) SHA2-512(2) TLSA record exists
verify that a valid DANE-EE(3) SPKI(1) SHA2-256(1) TLSA record exists
path of the date binary to be used
stores the retrieved certificates in the current directory
writes the debug messages to file
writes timing information in the debugging output
path of the dig binary to be used
pattern to match the email address contained in the certificate
signature algorithm selection: force ECDSA certificate
checks up to the N cert element from the beginning of the chain
path of the file binary to be used
pattern to match the SHA1-Fingerprint
verify just the first cert element, not the whole chain
force the usage of dconv for date computations
force the usage of Perl for date computations
format output template on success, for example: %SHORTNAME% OK %CN% from %CA_ISSUER_MATCHED%
this help message
use GET instead of HEAD (default) for the HTTP related checks
pattern to match the issuer of the certificate
ignores alternative names when matching pattern specified in -n (or the host name)
in case of connection problems returns OK or the optional state
ignore expiration date
do not complain if the CN does not match the host name
does not check chain integrity
do not check revocation with OCSP
continue if the OCSP status cannot be checked
ignore OCSP result when timeout occurs while checking
do not check for signed certificate timestamps (SCT)
do not check if the certificate was signed with SHA1 or MD5
Forces a new check by SSL Labs (see -L)
Ignores the TLS renegotiation check
Force IP version 4 or 6
Prints certificate information
directory where to store issuer certificates cache
use client certificate key to authenticate
SSL Labs assessment (please check https://www.ssllabs.com/about/terms.html). Critical if the grade is lower than specified.
append the specified comma separated (no spaces) list of attributes to the plugin output on additional lines. Valid attributes are: enddate, startdate, subject, issuer, modulus, serial, hash, email, ocsp_uri and fingerprint. 'all' will include all the available attributes.
pattern to match the CN of the certificate (can be specified multiple times)
path of the nmap binary to be used
do not show performance data
ignores the http_proxy and https_proxy environment variables
ignores the http_proxy and https_proxy environment variables for curl
ignores the http_proxy and https_proxy environment variables for openssl s_client
disable SSL version 2
disable SSL version 3
disable TLS version 1
disable TLS version 1.1
disable TLS version 1.3
disable TLS version 1.2
check that the issuer of the certificate does not match the given pattern
critical if the certificate validity is longer than the specified period
pattern to match the organization of the certificate
minimum number of hours an OCSP response has to be valid to issue a critical status
minimum number of hours an OCSP response has to be valid to issue a warning status
path of the openssl binary to be used
TCP port
use the specific protocol: ftp, ftps, http, https (default), h2 (HTTP/2), imap, imaps, irc, ircs, ldap, ldaps, mysql, pop3, pop3s, postgres, sieve, smtp, smtps, xmpp, xmpp-server, ftp, imap, irc, ldap, pop3, postgres, sieve, smtp: switch to TLS using StartTLS.
These protocols switch to TLS using StartTLS: ftp, imap, irc, ldap, mysql, pop3, smtp.
password source for a local certificate, see the PASS PHRASE ARGUMENTS section openssl(1)
generates Prometheus/OpenMetrics output
sets http_proxy and the s_client -proxy option
root certificate or directory to be used for certificate validation (passed to openssl's -CAfile or -CApath)
the server must accept a client certificate. 'list' is an optional comma separated list of expected client certificate CAs
critical if SSL version 2 is offered
critical if SSL version 3 is offered
critical if TLS 1 is offered
critical if TLS 1.1 is offered
require OCSP stapling
provides a custom IP address for the specified host
root directory to be used for certificate validation (passed to openssl's -CApath) overrides option -r,--rootcert
root certificate to be used for certificate validation (passed to openssl's -CAfile) overrides option -r,--rootcert
signature algorithm selection: force RSA certificate
allows self-signed certificates
pattern to match the serial number
skips checks on the Nth cert element (can be specified multiple times)
sets the TLS SNI (Server Name Indication) extension in the ClientHello message to 'name'
force SSL version 2
force SSL version 3
seconds timeout after the specified time (defaults to 120 seconds)
directory where to store the temporary files
terse output (also see --verbose)
force TLS version 1
force TLS version 1.1
force TLS version 1.2
force TLS version 1.3
HTTP request URL
verbose output (can be specified more than once)
version
minimum number of days a certificate has to be valid to issue a warning status. Might be a floating point number, e.g., 0.5. Default: 20
specifies the host for the 'to' attribute of the stream element
-4
force IPv4
-6
force IPv6

DEPRECATED OPTIONS

matches the pattern specified in -n with alternate names too (enabled by default)
minimum number of days a certificate has to be valid (see --critical and --warning)
match CN with the host name (enabled by default)
disable SSLv2 (deprecated use --no-ssl2)
disable SSLv3 (deprecated use --no-ssl3)
disable TLSv1 (deprecated use --no-tls1)
disable TLSv1.1 (deprecated use --no-tls1_1)
disable TLSv1.1 (deprecated use --no-tls1_2)
disable TLSv1.1 (deprecated use --no-tls1_3)
check revocation via OCSP (enabled by default)
require the presence of a Subject Alternative Name extension
force SSL version (2,3) (see: --ssl2 or --ssl3)

NOTES

If the host has multiple certificates and the installed openssl version supports the -servername option it is possible to specify the TLS SNI (Server Name Identificator) with the -N (or --host-cn) option.

EXIT STATUS

check_ssl_cert returns a zero exist status if it finds no errors, 1 for warnings, 2 for a critical errors and 3 for unknown problems

BUGS

Please report bugs to: https://github.com/matteocorti/check_ssl_cert/issues

EXAMPLE

check_ssl_cert --host github.com --all-local

SEE ALSO

openssl(1), openssl-x509(1)

December, 2021 2.15.0