monitoring of TLS cert expiration

[hunleyd]

Describe the enhancement you are proposing:

As originally discussed in CPA-4006, it would be nice to monitor the various TLS certs that might be deployed and alert if they are expired or are about to expire.

[hunleyd]

Possible candidates for this:
https://github.com/amimof/node-cert-exporter
https://github.com/joe-elliott/cert-exporter

[hunleyd]

@hitech73

[keithf4]

After some discussion, the issue with these exporters is that they may need elevated privileges depending on the permissions set on the cert files themselves (the cert-exporter specifically calls this out). It would probably not be desired that the exporters run as the user that would need those privileges. Or try and manage a different group that these certs would need to be a member of in order to access them.

Some other thoughts:

• Run a cron/script with the necessary privileges to access the expiry info for the target certs (command example below). Output that to a CSV file that would could either have node_exporter use a custom filter to read or pull it into the database and have pgmonitor-extension/sql_exporter monitor the imported data

openssl s_client -servername <SERVER_NAME> -connect <SERVER_NAME>:<PORT> 2>/dev/null | openssl x509 -noout -dates