Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#1

Post by ryan_sb » Sun, Jan 17, 2016, 3:49 PM UTC

Get SSL Expiration Alerts with AWS Lambda and CloudWatch
serverlesscode.com

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#2

Post by abofh » Sun, Jan 17, 2016, 4:03 PM UTC

$ aws iam list-server-certificates

  [
  {
      "ServerCertificateMetadataList": [
          {
              "ServerCertificateId": "REDACTED", 
              "ServerCertificateName": "ALSO-REDACTED", 
              "Expiration": "2016-11-10T23:56:37Z", 
              "Path": "/", 
              "Arn": "MORE-REDACTION",
              "UploadDate": "2015-11-11T23:56:43Z"
          }, 
  ...

Why?

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#3

Post by dexterdog » Sun, Jan 17, 2016, 4:29 PM UTC

Why can't you just read any cert regardless of where it is hosted and send an alert when it is under a week? Why tie it to AWS?

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#4

Post by mcrmonkey » Sun, Jan 17, 2016, 5:25 PM UTC

"OK Google, set a reminder 1 year from now to...."

Nice write up. But a bit over kill for something that you can solve with a calendar item. ...Doesn't actually have to be on google though ;)

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#5

Post by ryan_sb » Sun, Jan 17, 2016, 5:27 PM UTC

dexterdog wrote: post #3

Why can't you just read any cert regardless of where it is hosted and send an alert when it is under a week? Why tie it to AWS?

No reason it can't check any hostname, but all my custom SSL certs are on CloudFront.

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#6

Post by pennersr » Sun, Jan 17, 2016, 5:27 PM UTC

Netwell supports SSL expiration checks as well:

https://github.com/pennersr/netwell

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#7

Post by jvehent » Sun, Jan 17, 2016, 5:29 PM UTC

That's fairly easy to do in a cron job:

    TARGET="mysite.example.net"; \
    RECIPIENT="hostmaster@mysite.example.net"; \
    DAYS=7; \
    echo "checking if $TARGET expires in less than $DAYS days"; \
    expirationdate=$(date -d "$(: | openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \
                                  | openssl x509 -text \
                                  | grep 'Not After' \
                                  |awk '{print $4,$5,$7}')" '+%s'); \
    in7days=$(($(date +%s) + (86400*$DAYS))); \
    if [ $in7days -gt $expirationdate ]; then \
        echo "KO - Certificate for $TARGET expires in less than $DAYS days, on $(date -d @$expirationdate '+%Y-%m-%d')" \
        | mail -s "Certificate expiration warning for $TARGET" $RECIPIENT ; \
    else \
        echo "OK - Certificate expires on $expirationdate"; \
    fi;

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#8

Post by tallanvor » Sun, Jan 17, 2016, 5:51 PM UTC

mcrmonkey wrote: post #4

"OK Google, set a reminder 1 year from now to...." Nice write up. But a bit over kill for something that you can solve with a calendar item. ...Doesn't actually have to be on google though ;)

Sure, that's fine for an individual, but what about for a business? If the person who has an entry in his or her calendar leaves and forgets to remind someone else, what happens then?

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#9

Post by krakensden » Sun, Jan 17, 2016, 5:52 PM UTC

dexterdog wrote: post #3

Why can't you just read any cert regardless of where it is hosted and send an alert when it is under a week? Why tie it to AWS?

You're only cool if you're paying Amazon.

Re: Get SSL Expiration Alerts with AWS Lambda and CloudWatch

#10

Post by colinbartlett » Sun, Jan 17, 2016, 6:21 PM UTC

mcrmonkey wrote: post #4

"OK Google, set a reminder 1 year from now to...." Nice write up. But a bit over kill for something that you can solve with a calendar item. ...Doesn't actually have to be on google though ;)

I have at least a dozen projects, clients, side projects, personal domains, etc., each with a TLS cert. Plus at least 5 certs for work. All of them have different expirations. Some are on Let's Encrypt without auto renew at the moment, meaning they have varying expirations less than 90 days from now.

I would love just a simple iPhone app where I can list my domains and get push notices at 30 or 7 days from expiration. Maybe I should make this myself because I've yet to find one.