Show HN: TLS cert expiration dashboard

#1

Post by craine » Wed, May 25, 2016, 4:13 PM UTC

Show HN: TLS cert expiration dashboard
github.com

Re: Show HN: TLS cert expiration dashboard

#2

Post by craine » Wed, May 25, 2016, 4:13 PM UTC

I created a dashboard to view some basic info about the TLS certificates that I manage for various websites, including days to expiration, Issuer, Issuer Common Name, and certificate common name. It's also useful for enterprise infrastructure if you have to manage lots of web server certificates as part of a security or ops team.

I use a node module to scrape the peer certificate info, and then dump it into a file that a web page picks up. It's not real-time, out of concern for too many people hitting or reloading the page and kicking off too many connection attempts at once.

An example is here: https://craine.gitlab.io/tls-dashboard/

Re: Show HN: TLS cert expiration dashboard

#3

Post by blakesterz » Wed, May 25, 2016, 5:26 PM UTC

This is great. I've been meaning to find a way to keep track of TLS like this. Anything other ways to do this?

Re: Show HN: TLS cert expiration dashboard

#4

Post by Pirate-of-SV » Wed, May 25, 2016, 5:33 PM UTC

I would really appreciate if browsers could implement some kind of Javascript API for retrieving Cert information of the current page. (In my opinion it would make more sense than the Battery Status API [1])

[1] https://w3c.github.io/battery/

Re: Show HN: TLS cert expiration dashboard

#5

Post by dthakur » Wed, May 25, 2016, 5:34 PM UTC

blakesterz wrote: post #3

This is great. I've been meaning to find a way to keep track of TLS like this. Anything other ways to do this?

I've been working on a hosted version of such a service. This is just the kick I needed to finish it up.

Keep an eye out for 'Show HN: Expiry alerts' this weekend.

Re: Show HN: TLS cert expiration dashboard

#6

Post by jhallenworld » Wed, May 25, 2016, 6:10 PM UTC

Well, start a company: https://www.venafi.com/

I know of an enterprise that paid for this feature: "warn me when my certs are about to expire."

Re: Show HN: TLS cert expiration dashboard

#7

Post by blakesterz » Wed, May 25, 2016, 6:15 PM UTC

blakesterz wrote: post #3

This is great. I've been meaning to find a way to keep track of TLS like this. Anything other ways to do this?

Ah, cool, just found a handy bash script too:

http://prefetch.net/articles/checkcertificate.html

Not as pretty, but gets the job done.

Re: Show HN: TLS cert expiration dashboard

#8

Post by voidz » Wed, May 25, 2016, 6:16 PM UTC

I use the tool 'xca' for this. Really useful tool that supports various operations with certificates and CSRs. It uses Qt.

http://xca.sourceforge.net

Re: Show HN: TLS cert expiration dashboard

#9

Post by unethical_ban » Wed, May 25, 2016, 6:41 PM UTC

jhallenworld wrote: post #6

Well, start a company: https://www.venafi.com/ I know of an enterprise that paid for this feature: "warn me when my certs are about to expire."

You may laugh. But in an enterprise, it is the CA's job internally to help manage and communicate expirations to users. If there are 10,000+ certs in an org, you want a tool to manage them.

Re: Show HN: TLS cert expiration dashboard

#10

Post by JoshTriplett » Wed, May 25, 2016, 6:45 PM UTC

Pirate-of-SV wrote: post #4

I would really appreciate if browsers could implement some kind of Javascript API for retrieving Cert information of the current page. (In my opinion it would make more sense than the Battery Status API [1]) [1] https://w3c.github.io/battery/

For the current page? What could you usefully do with that information? You should know what certificate you're serving, and if it isn't that certificate, the page is hopefully not being displayed at all. The browser should be protecting the user from MITM.