SSL Certificate Monitor extension

Monitor remotely—the purpose of remote monitoring deployment is to activate certificate monitoring by URL. This type of monitoring requires that the ActiveGate running the extension has access to the URLs that are provided. Adjustments to networking and firewall rules may be required. When this deployment model is chosen, certificate discovery is deactivated, and a list of URLs must be provided to activate certificate monitoring.

Select Monitor Remotely without OneAgent to choose this installation type, and choose the ActiveGate group on which you want to run the extension.

Monitor Locally—local monitoring is required for the certificate auto-discovery that uses the OneAgent. The extension will be installed on selected hosts. Currently, hosts can be selected by name, host group, management zone or tag (using the Environment configuration).

Once the deployment option is selected, continue configuring the extension.

General configuration settings available to you:

AVAILABILITY: Expired certificates generate an alert on this level.

ERROR: Certificates in Stage 2 (expiration imminent) will alert on this level.

RESOURCE: Certificates in Stage 1 (expiration soon) will alert on this level.

Interval between certificate discovery and metadata checks (hours). The frequency with which the extension will update discovered certificates and process the available data. During initial setup and testing, a smaller value may be appropriate. Once the extension is fully configured, an interval of eight hours is recommended. In addition to determining how often certificate discovery and metadata updates take place, the check interval determines how problems are resolved. All certificate problems will remain open until a certificate check can confirm that the problem has been resolved. An interval of 24 hours will cause a certificate problem to remain open for minimum 24 hours. The problem will not resolve until the next check can determine if the problem is resolved.

Unified Analysis Screens and Certificate Status Metric. Unified Analysis Screens contain metadata on all discovered certificates. This features requires the collection of data using the Certificate Status metric (certificate.monitor.status). For the best experience, it is recommended to activate metric collection. When deactivated, extension functionality is limited to alert creation and log events. This option consumes DDUs.

Deactivate alerts for certificates greater than x days old. By default, alerts will be raised for all expired certificates. Many environments contain long-expired certificates that have not been removed. Activate this feature to suppress problems for certificates that expired more than x days ago.

Raise alerts for certificate discovery errors. These settings are useful for troubleshooting and setting port and technology exclusion filters to deactivate unwanted checks. Full details will always be available in the logs. Where available, the alert details troubleshooting property will provide suggestions for solving the issue.

Raise alerts for OneAgent certificate discovery errors. By default, the extension attempts to extract certificates from all listening ports detected by the OneAgent. However, many of these application servers do not use SSL/TLS and therefore do not present a certificate. Enabling this setting will trigger alerts whenever the extension fails to extract a certificate from a port—regardless of whether a certificate is present. This includes ports that are not secured with SSL/TLS.

Raise alerts for domain based certificate discovery errors. Activate this feature to raise alerts for domain-based certificate discovery errors. This includes situations where a domain cannot be reached and if a certificate cannot be extracted. The extension will only check domains for certificates when the user has explicitly configured the extension to do so. It is recommended to activate this setting to ensure that any issues encountered during the discovery process are reported.

Activate blocklist. By default, the extension will exclude ports from certificate checks that have previously returned no certificates. Disabling the blocklist will cause all listening ports detected by the OneAgent to be checked for certificates at each monitoring interval.

Activate allowlist configuration. Use this setting to ensure ports are checked even if they have previously returned no certificates.

Clear blocklist cache. Use this setting to clear the blocklist cache. This will remove all previously blocklisted ports and allow the extension to check them again. Clearing the cache is a two step process. First, activate this setting, then deactivate after ten minutes and the monitoring configuration has been updated. The blocklist will be effectively deactivated as long as "clear blocklist cache" is activated.

Port range to include. A range of ports can be expressed with a hyphen. Individual or groups of ports can be separated with a semicolon. i.e. 443;1024-2000;50000-51000.

Port range to exclude. An optional range of ports to exclude. This setting is applied after the include rule. For example, if ports 400-410 are included and port 405 is excluded, the resulting set of ports will be 400-404 and 406-410.

Add technology to the filter defined above. The technology types available are the "Main Technology" types that are present in process views. Some processes will show multiple entries under "Main technology". Technology type filter uses OR logic. A process that lists "IIS, IIS App Pool and .NET" as main technologies will be monitored if any combination of the technologies is added to this filter.

Add domain. Optionally provide a list of domains that they extension will check directly.

Certificate Auto-discovery. When the extension is deployed locally (on a host with the OneAgent), the extension uses data collected by the OneAgent to collect a list of processes that have listening ports bound to them. Using this information, the extension then attempts to establish a connection on that port and load any certificates that are present.

Windows Active Port Discovery. On Windows hosts, in cases where the OneAgent does not have port information for a particular technology, Active Port Discovery can be used. This feature requires the use of the Get-NetTCPConnection PowerShell tool on Windows systems. Activating this feature will have no effect on Linux systems.

Scan Windows Certificate Stores. This feature will directly scan the Windows Certificate Store for certificates. This feature uses PowerShell on Windows systems. Activating this feature will have no effect on Linux systems. This method allows the extension to know which Certificate Store the certificate is stored in.

Remote Domain Discovery. When the extension is deployed on an ActiveGate, certificate monitoring by domain name is possible. This type of monitoring requires that the ActiveGate running the extension has access to the domains that are provided. Adjustments to networking and firewall rules may be required. Based on the list of domains supplied, the extension attempts to establish a connection and load any certificates that are present. When using this method, the extension has no knowledge of the host the certificate is stored on and is unable to form a relationship between the certificate and a host.