Commands
Learn how to install Zabbix with PostgreSQL on RHEL 9 | CentOS 9 with our comprehensive step-by-step guide. Follow clear instructions with CLI examples and
Learn how to monitor SSL certificate expiry using Zabbix with automated scripts and triggers. Avoid service disruptions by setting up alerts for expiring certificates.
In today’s secure-by-default internet, SSL/TLS certificates are essential for encrypting web traffic and building user trust. However, managing and renewing these certificates across multiple servers or domains can be a challengeâespecially when one expires unnoticed, leading to broken services or alarming browser warnings.
Zabbix, a powerful open-source monitoring solution, provides a reliable way to monitor the expiry of SSL certificates. In this guide, we’ll walk you through how to set up and automate SSL certificate expiry checks using Zabbix, with examples for both Linux-based proxies and native item prototypes.
Failing to renew SSL certificates can:
|
|
|
|
|
By automating SSL expiry monitoring, you can get notified before a certificate expires, reducing manual tracking and increasing service uptime.
| Tool | Purpose | Compatible Systems |
|---|---|---|
| Zabbix Server | Central Monitoring Engine | Debian, RHEL, Ubuntu, CentOS |
| Zabbix Agent | Monitoring endpoints | Debian, RHEL, Windows |
openssl | SSL certificate inspection | All Linux/Unix |
| Optional: Bash/Python | Script automation | All Linux/Unix |
In a typical monitoring setup:
|
|
|
|
You can monitor certificates from a remote domain (e.g. google.com) or locally stored .crt/.pem files.
Zabbix can monitor SSL expiry in three main ways:
|
|
|
For better control and insight, Method 2 or 3 is recommended.
Photo by admingeek from Infotechys
đMonitoring SSL Certificate Expiry in Zabbix: Step-by-Step Guide |
Letâs monitor example.com SSL certificate and get alerts 30 days before it expires.
Create SSL Expiry Check Script |
Save the following Bash script on the Zabbix Agent host:
#!/bin/bash
HOST=$1
PORT=${2:-443}
end_date=$(echo | openssl s_client -servername "$HOST" -connect "$HOST:$PORT" 2>/dev/null \
| openssl x509 -noout -enddate | cut -d= -f2)
if [ -z "$end_date" ]; then
echo "0"
exit 1
fi
end_ts=$(date -d "$end_date" +%s)
now_ts=$(date +%s)
diff_days=$(( (end_ts - now_ts) / 86400 ))
echo $diff_days
Make it executable:
chmod +x /usr/lib/zabbix/externalscripts/ssl_check.sh
Zabbix Item Configuration |
In the Zabbix frontend:
|
|
|
|
|
|
|
Create Trigger for Expiry Warning |
Go to Configuration > Hosts > Triggers:
{your-host:ssl_check.sh["example.com"].last()}<30
SSL Certificate for example.com expires in less than 30 days
Add a recovery expression (optional):
{your-host:ssl_check.sh["example.com"].last()}>30
Using External Script on Zabbix Agent |
Zabbix supports calling scripts from:
|
|
To use it as a UserParameter, modify /etc/zabbix/zabbix_agentd.d/userparameter_ssl.conf:
UserParameter=ssl.expiry[*],/usr/local/bin/ssl_check.sh $1 $2
Restart the Zabbix agent:
systemctl restart zabbix-agent
Now you can call the item key: ssl.expiry[example.com,443]
To manually check expiry with OpenSSL:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -dates
Expected output:
notBefore=Apr 1 00:00:00 2025 GMT
notAfter=Jul 1 23:59:59 2025 GMT
Convert to days left:
end_date=$(openssl x509 -noout -enddate -in cert.pem | cut -d= -f2)
echo $(( ($(date -d "$end_date" +%s) - $(date +%s)) / 86400 ))
| Component | Value / Command | Description |
|---|---|---|
| Item Type | External Check | Calls external script |
| Key | ssl_check.sh["example.com"] | Checks SSL expiry in days |
| Trigger Expression | <30 | Triggers when cert is <30 days left |
| Data Type | Numeric (unsigned) | Used for calculating thresholds |
| Script Location | /usr/lib/zabbix/externalscripts/ | Where Zabbix server fetches scripts |
Learn how to install Zabbix with PostgreSQL on RHEL 9 | CentOS 9 with our comprehensive step-by-step guide. Follow clear instructions with CLI examples and
Learn how to automate SSL/TLS certificate renewal and deployment using OpenSSL and Bash scripts. Includes CLI examples, best practices, cron automation, and deployment tips. Table
In this article, we’ll explore the simple steps to enable HTTPS on your website. We’ll guide you through the process of installing SSL on RHEL9,