|
| 1 | + |
| 2 | +# Invoke-IcingaCheckCertificate |
| 3 | + |
| 4 | +## Description |
| 5 | + |
| 6 | +Check whether a certificate is still trusted and when it runs out or starts. |
| 7 | + |
| 8 | +Invoke-IcingaCheckCertificate returns either 'OK', 'WARNING' or 'CRITICAL', based on the thresholds set. |
| 9 | +e.g a certificate will run out in 30 days, WARNING is set to '20d:', CRITICAL is set to '50d:'. In this case the check will return 'WARNING'. |
| 10 | + |
| 11 | +More Information on https://github.com/Icinga/icinga-powershell-plugins |
| 12 | + |
| 13 | +## Arguments |
| 14 | + |
| 15 | +| Argument | Type | Required | Default | Description | |
| 16 | +| --- | --- | --- | --- | --- | |
| 17 | +| Trusted | SwitchParameter | false | False | Used to switch on trusted behavior. Whether to check, If the certificate is trusted by the system root. Will return Critical in case of untrust. Note: it is currently required that the root and intermediate CA is known and trusted by the local system. | |
| 18 | +| CriticalStart | Object | false | | Used to specify a date. The start date of the certificate has to be past the date specified, otherwise the check results in critical. Use carefully. Use format like: 'yyyy-MM-dd' | |
| 19 | +| WarningEnd | Object | false | 30d: | Used to specify a Warning range for the end date of an certificate. In this case a string. Allowed units include: ms, s, m, h, d, w, M, y | |
| 20 | +| CriticalEnd | Object | false | 10d: | Used to specify a Critical range for the end date of an certificate. In this case a string. Allowed units include: ms, s, m, h, d, w, M, y | |
| 21 | +| CertStore | String | false | | Used to specify which CertStore to check. Valid choices are '*', 'LocalMachine', 'CurrentUser', '' | |
| 22 | +| CertThumbprint | Array | false | | Used to specify an array of Thumbprints, which are used to determine what certificate to check, within the CertStore. | |
| 23 | +| CertSubject | Array | false | | Used to specify an array of Subjects, which are used to determine what certificate to check, within the CertStore. | |
| 24 | +| CertStorePath | Object | false | * | Used to specify which path within the CertStore should be checked. | |
| 25 | +| CertPaths | Array | false | | Used to specify an array of paths on your system, where certificate files are. Use with CertName. | |
| 26 | +| CertName | Array | false | | Used to specify an array of certificate names of certificate files to check. Use with CertPaths. | |
| 27 | +| Recurse | SwitchParameter | false | False | | |
| 28 | +| Verbosity | Int32 | false | 3 | Other | |
| 29 | + |
| 30 | +## Examples |
| 31 | + |
| 32 | +### Example Command 1 |
| 33 | + |
| 34 | +```powershell |
| 35 | +You can check certificates in the local certificate store of Windows: |
| 36 | +``` |
| 37 | + |
| 38 | +### Example Output 1 |
| 39 | + |
| 40 | +```powershell |
| 41 | +PS> Invoke-IcingaCheckCertificate -CertStore 'LocalMachine' -CertStorePath 'My' -CertSubject '*' -WarningEnd '30d:' -CriticalEnd '10d:'[OK] Check package "Certificates" (Match All)\_ [OK] Certificate 'test.example.com' (valid until 2033-11-19 : 4993d) valid for: 431464965.59 |
| 42 | +``` |
| 43 | + |
| 44 | +### Example Command 2 |
| 45 | + |
| 46 | +```powershell |
| 47 | +Also a directory with a file name pattern is possible: |
| 48 | +``` |
| 49 | + |
| 50 | +### Example Output 2 |
| 51 | + |
| 52 | +```powershell |
| 53 | +PS> Invoke-IcingaCheckCertificate -CertPaths "C:\ProgramData\icinga2\var\lib\icinga2\certs" -CertName '*.crt' -WarningEnd '10000d:'[WARNING] Check package "Certificates" (Match All) - [WARNING] Certificate 'test.example.com' (valid until 2033-11-19 : 4993d) valid for, Certificate 'Icinga CA' (valid until 2032-09-18 : 4566d) valid for\_ [WARNING] Certificate 'test.example.com' (valid until 2033-11-19 : 4993d) valid for: Value "431464907.76" is lower than threshold "864000000"\_ [WARNING] Certificate 'Icinga CA' (valid until 2032-09-18 : 4566d) valid for: Value "394583054.72" is lower than threshold "864000000" |
| 54 | +``` |
| 55 | + |
| 56 | +### Example Command 3 |
| 57 | + |
| 58 | +```powershell |
| 59 | +The checks can be combined into a single check: |
| 60 | +``` |
| 61 | + |
| 62 | +### Example Output 3 |
| 63 | + |
| 64 | +```powershell |
| 65 | +PS> Invoke-IcingaCheckCertificate -CertStore 'LocalMachine' -CertStorePath 'My' -CertThumbprint '*'-CertPaths "C:\ProgramData\icinga2\var\lib\icinga2\certs" -CertName '*.crt' -Trusted[CRITICAL] Check package "Certificates" (Match All) - [CRITICAL] Certificate 'test.example.com' trusted, Certificate 'Icinga CA' trusted \_ [CRITICAL] Check package "Certificate 'test.example.com'" (Match All) \_ [OK] Certificate 'test.example.com' (valid until 2033-11-19 : 4993d) valid for: 431464853.88 \_ [CRITICAL] Certificate 'test.example.com' trusted: Value "False" is not matching threshold "True"\_ [CRITICAL] Check package "Certificate 'Icinga CA'" (Match All) \_ [OK] Certificate 'Icinga CA' (valid until 2032-09-18 : 4566d) valid for: 394583000.86 \_ [CRITICAL] Certificate 'Icinga CA' trusted: Value "False" is not matching threshold "True" |
| 66 | +``` |
0 commit comments