TLS certificate expiry

Why

Certificate expiry is quiet until it is sudden: https://exchange.ftmon.org/ looks fine on availability probes until the leaf cert is past its notAfter. check_http -C reconnects only for TLS and reports how many days remain, so FTMON can confirm warning/critical windows without coupling to HTTP latency checks.

This is a **separate** recipe from http-tls. With Monitoring Plugins 2.3.5, combining -C and --continue-after-certificate prints the certificate result on the first line and HTTP perfdata on the next. FTMON keeps only first-line Nagios output, so a combined argv would silently drop timing metrics. Keep latency history on http-tls; keep expiry here.

Install

sudo apt update
sudo apt install monitoring-plugins

Executable: /usr/lib/nagios/plugins/check_http. Upstream: https://www.monitoring-plugins.org/doc/man/check_http.html.

Configure

ftmon recipe install http-cert

Defaults target **exchange.ftmon.org** with -C 30,14 (warn below 30 days, critical below 14) and SNI. Interval is **1h** — expiry does not need minute-by-minute sampling. Copy the recipe or edit checks.toml / monitor.toml entity and -H for another hostname.

Why there is no Trends profile

-C returns status text only (no | days=… perfdata in 2.3.5). There is nothing numeric to plot as a growth Trend; the alert is the remaining-day threshold inside the plugin.

Test

/usr/lib/nagios/plugins/check_http \
  -H exchange.ftmon.org -S --sni -C 30,14 -t 10
echo "$?"

Exit states are 0 OK, 1 warning, 2 critical, and 3 unknown. Fixtures capture observed message shapes against exchange.ftmon.org (OK) and forced tighter -C windows (warning/critical). Unknown uses the plugin's missing-host usage line.

ftmon check
ftmon doctor

Security and permissions

No elevation. The check opens an outbound TLS connection to the named host and therefore discloses the monitoring host's address. No credentials in argv.

Upstream and licence

Monitoring Plugins 0, GPL-3.0-or-later with OpenSSL exception. FTMON does not redistribute it.

Verified on 2026-07-14 with Monitoring Plugins **2.3.5** against exchange.ftmon.org (certificate notAfter 2026-10-10 UTC): OK at -C 30,14, WARNING under -C 100,50, CRITICAL under -C 400,350.

Registry example

[check.exchange_ftmon_cert]
# Certificate-only form of check_http (-C). Keep separate from the http-tls
# latency recipe: combining -C with --continue-after-certificate puts the
# certificate line first and HTTP perfdata on the next line, which FTMON
# would discard (first-line Nagios only).
argv = [
  "/usr/lib/nagios/plugins/check_http",
  "-H", "exchange.ftmon.org",
  "-S", "--sni",
  "-C", "30,14",
  "-t", "10",
]
protocol = "nagios"
timeout = "12s"

Monitor definition

schema = 1

[monitor]
name = "exchange_ftmon_cert"
description = "TLS certificate days remaining for exchange.ftmon.org"
version = 1
enabled = false
platforms = ["linux"]
interval = "1h"
source = "external"

[source_options]
check = "exchange_ftmon_cert"
entity = "https://exchange.ftmon.org/"

[[rule]]
id = "plugin-warning"
group = "certificate"
when = "plugin_state == 1"
severity = "warning"
confirm_cycles = 2
message = "{plugin_message}"

[[rule]]
id = "plugin-critical"
group = "certificate"
when = "plugin_state == 2"
severity = "critical"
confirm_cycles = 2
message = "{plugin_message}"

[[rule]]
id = "plugin-unknown"
group = "check-health"
when = "plugin_state == 3"
severity = "warning"
confirm_cycles = 2
message = "Certificate check is unknown: {plugin_message}"