This is a simple test tool for Prometheus to check TCP SSL ports, such as websites and TLS services
1.0K
This tool provides both certificate checking and timing for multiple protocol layers up to layer 5. This tool provides Prometheus, an uptime awareness, certificate validity, and timing for the different components of a connection. It does not interact at all with the TLS session, hence why it is protocol-agnostic. Some examples of use are https and rdp. Here is an example run command:
$ docker run --rm -it --entrypoint /usr/local/bin/sslcheck -e CA=/CA.crt \
--read-only -v /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem:/CA.crt \
-p 8080:8080 --name sslcheck pschou/sslcheck
Check if it is running:
$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
f80840eaad5f pschou/sslcheck "/usr/local/bin/sslc…" 3 seconds ago Up 2 seconds 0.0.0.0:8080->8080/tcp sslcheck
Do a test query:
$ curl localhost:8080/query/google.com:443
sslcheck_hostlookup_seconds{hostport="google.com:443"} 0.003578 1604628772059
sslcheck_connect_seconds{hostport="google.com:443",ip="216.239.38.120"} 0.003922 1604628772077
sslcheck_handshake_seconds{hostport="google.com:443",ip="216.239.38.120"} 0.013033 1604628772076
sslcheck_connection_attempts{hostport="google.com:443",ip="216.239.38.120"} 1 1604668780145
...
sslcheck_connection_pass{hostport="google.com:443",ip="216.239.38.120"} 1 1604668780145
sslcheck_certificate_host_verify{hostport="google.com:443",ip="216.239.38.120"} 1 1604668780144
sslcheck_certificate_expires{hostport="google.com:443",ip="216.239.38.120"} 1609223757 1604668780144
sslcheck_certificate_issued{hostport="google.com:443",ip="216.239.38.120"} 1601966157 1604668780144
sslcheck_certificate_chain_verify{hostport="google.com:443",ip="216.239.38.120"} 1 1604668780145
To run this container, you'll need to set up some environment variables...
Load common CA certificates from your system, you'll want to make sure this is available and pointed to
CA=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
When listing using the /metrics endpoint, do multiple hosts at once, by default this is false
THREAD=true
MAX_THREAD=8
A pause between queries, by default this is 0
WAIT=100ms
File to use for populating metrics when using the /metrics endpoint
FILE=/hostport_simple.txt
self-signed.badssl.com
expired.badssl.com
mixed.badssl.com
rc4.badssl.com
hsts.badssl.com
wrong.host.badssl.com
untrusted-root.badssl.com
revoked.badssl.com
pinning-test.badssl.com
#
# This is a list of simple host port values and labels
#
google.com,type="search engine",location="ca"
microsoft.com,status="hiring"
yahoo.com,owner="Verizon"
facebook.com,type="social board"
A basic test for a website...
$ curl localhost:8080/query/google.com:443
sslcheck_hostlookup_seconds{hostport="google.com:443"} 0.003578 1604628772059
sslcheck_connect_seconds{hostport="google.com:443",ip="216.239.38.120"} 0.003922 1604628772077
sslcheck_handshake_seconds{hostport="google.com:443",ip="216.239.38.120"} 0.013033 1604628772076
...
A basic test for a predefined hostlist...
$ curl localhost:8080/metrics
sslcheck_hostlookup_seconds{hostport="google.com:443"} 0.003578 1604628772059
sslcheck_connect_seconds{hostport="google.com:443",ip="216.239.38.120"} 0.003922 1604628772077
sslcheck_handshake_seconds{hostport="google.com:443",ip="216.239.38.120"} 0.013033 1604628772076
...
The host lookup time is the time in seconds it takes to resolve a DNS name, connect is the TCP three-way handshake time (analogous to a ping time), and finally, the handshake time is the time taken to agree on an SSL protocol and connect.
Content type
Image
Digest
Size
7.8 MB
Last updated
almost 6 years ago
docker pull pschou/sslcheck