Dear 4itsAdmin

Please contact [email protected]. Please state your question again, and include screenshots of one of the SSL Certificate sensors:

• The sensor overview tab
• The logs tab
• The settings tab (multiple screenshots if necessary to cover all settings.)

Hello, any solution for this question yet?

I'm also looking for a solution to monitor SMTP certificates. The SSL Certifcate Sensor is only able to monitor HTTP/S, not STARTTLS over SMTP.

Dear Cesare,

this is correct. We have this planned, but I cannot say when it gets to implementation. We notice the demand (and please consider your voice counted) but again, there is no ETA yet.

Dear Arne,

I would appreciate if you will offer such an sensor ASAP. Today is important to monitor the email-encryption of the MX Servers.

Dear NTTITS,

we have such sensor idea, but I cannot say when, or if a STARTTSL option for SSL monitoring will be available, because other sensors are in higher demand. In order to get a good overview of user demands, the knowledge base can be used to describe a feature request.

Dear Arne,

is there any news? I have the same request, need to monitor SMTP-TLS-Certifiactes.

Thanks Golo

Dear DerGolo,

for the foreseeable future, such sensor is not planned. If you like, you can create a feature request.

Hey,

Thanks for sharing your work with us.

We appreciate that.

Kind regards,
Birk Guttmann, Tech Support Team

I needed something for this too. I don't have the option of deploying Nagios, so wrote something that works for us (we only care about the days remaining and our mail relays). Treat the below as a functional barebones/alpha release as it only started and completed yesterday. Unless it breaks for us, there won't be any changes.

Code is .C# NET CORE 5 console app, but will probably work in older versions. .NET 4.8 is possible, just untested. Download Visual Studio Community Edition 2019+/VS Code to compile it

If you use this, please feel free, but leave the credit line at the top somewhere in your code.

TY

//Author: Wayne Evans
//Date: 2021-10-07
//URL: https://kb.paessler.com/en/topic/70942-how-can-we-monitor-smtp-ssl-certificates

using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography.X509Certificates;
using System.Text.Json;
using System.Text.Json.Serialization;

namespace MailrelayCertificates
{
    public class certInfo
    {
        public int DaysToExpiration { get; set; }
        public string Issuer { get; set; }
        public DateTime NotAfter { get; set; }
        public DateTime NotBefore { get; set; }
        public string SerialNumber { get; set; }
        public string Subject { get; set; }
        public string Thumbprint { get; set; }
        public int PublicKeyLength { get; set; }
        public int SelfSign { get; set; }
    }

    public class root
    {
        public prtg prtg { get; set; }
    }

    public class prtg
    {
        public List<result> result { get; set; }
        public string text { get; set; }
    }

    public class result
    {
        public string channel { get; set; }
        public string value { get; set; }
        [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
        public string valuelookup { get; set; }
        [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
        public int LimitMinWarning { get; set; }
        [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
        public int LimitMinError { get; set; }
    }



    class Program
    {
        private static certInfo extractedCertificate;

        static void Main(string[] args)
        {
            if ((args.Count() == 0) || (args.Count() > 2))
            {
                Console.WriteLine("Mandatory Argument 1 should be the server or load balancer name, e.g. myinternalmailserver.internal.com");
                Console.WriteLine("Optional Argument 2 port number to test against.  Defaults to port 25");
            }

            string server = args[0];
            int port = 25;

            if (args.Count() == 2)
            {
                try
                {
                    port = Convert.ToInt32(args[1]);
                }
                catch
                {
                    Console.WriteLine("Second arguement needs to be a number for the port number");
                }
            }

            System.Net.ServicePointManager.ServerCertificateValidationCallback = new System.Net.Security.RemoteCertificateValidationCallback(RemoteServerCertificateValidationCallback);

            using (System.Net.Mail.SmtpClient S = new System.Net.Mail.SmtpClient(server, port))
            {
                S.EnableSsl = true;
                using (System.Net.Mail.MailMessage M = new System.Net.Mail.MailMessage("[email protected]", "[email protected]", "Certification Validataion Test", "Certification Validataion Test"))
                {
                    try
                    {
                        S.Send(M);
                    }
                    catch (Exception ex)
                    {
                        //return;
                    }


                }
            }

            root output = new root();
            output.prtg = new prtg();
            output.prtg.result = new List<result>();
            output.prtg.result.Add(new result() { channel = "Days to Expiration", value = extractedCertificate.DaysToExpiration.ToString(), LimitMinError = 4, LimitMinWarning = 14 });
            output.prtg.result.Add(new result() { channel = "Public Key Length", value = extractedCertificate.PublicKeyLength.ToString(), valuelookup = "prtg.standardlookups.sslcertificatesensor.publickey" });
            output.prtg.result.Add(new result() { channel = "Self-Signed", value = extractedCertificate.SelfSign.ToString(), valuelookup = "prtg.standardlookups.sslcertificatesensor.selfsigned" });
            output.prtg.text = "Certificate Issuer: " + extractedCertificate.Issuer + " - Certificate Thumbprint: " + extractedCertificate.Thumbprint;

            Console.WriteLine(JsonSerializer.Serialize(output));

        }

        private static bool RemoteServerCertificateValidationCallback(object sender, System.Security.Cryptography.X509Certificates.X509Certificate certificate, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
        {
            //Console.WriteLine(certificate);
            extractedCertificate = new certInfo()
            {
                Issuer = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).Issuer,
                NotAfter = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).NotAfter,
                NotBefore = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).NotBefore,
                PublicKeyLength = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).PublicKey.Key.KeySize,
                SerialNumber = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).SerialNumber,
                SelfSign = IsSelfSigned(new X509Certificate2(certificate)),
                Subject = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).Subject,
                Thumbprint = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).Thumbprint
            };

            TimeSpan remainingUntilExpiry = ((System.Security.Cryptography.X509Certificates.X509Certificate2)certificate).NotAfter.Subtract(DateTime.UtcNow);
            extractedCertificate.DaysToExpiration = (int)remainingUntilExpiry.TotalDays;

            //I don't think we have a full cert path deployed.  Looks like an CA cert deploy, so can't test.  Leaving commented out

            //// You can alter how the chain is built/validated.
            //chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
            //chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreWrongUsage;

            //// Do the preliminary validation.
            //var primaryCert = new X509Certificate2(certificate);
            //if (!chain.Build(primaryCert))
            //    return false;

            //// Make sure we have the same number of elements.
            //if (chain.ChainElements.Count != chain.ChainPolicy.ExtraStore.Count + 1)
            //    return false;

            //// Make sure all the thumbprints of the CAs match up.
            //// The first one should be 'primaryCert', leading up to the root CA.
            //for (var i = 1; i < chain.ChainElements.Count; i++)
            //{
            //    if (chain.ChainElements[i].Certificate.Thumbprint != chain.ChainPolicy.ExtraStore[i - 1].Thumbprint)
            //        return false;
            //}

            return true;
        }

        //https://stackoverflow.com/questions/34174435/how-can-i-check-if-a-certificate-is-self-signed
        public static int IsSelfSigned(X509Certificate2 cert)
        {
            if (cert.SubjectName.RawData.SequenceEqual(cert.IssuerName.RawData))
            {
                return 1;
            }
            else
            {
                return 0;
            }
        }

    }
}

Hey,

Thanks for sharing your work as well. We really appreciate that.

Kind regards,
Birk Guttmann, Tech Support Team

I really want this feature.. been wanting it for 6 years or so and still not implemented.

@Wayne;

Just what I've been looking for! How do you create a PRTG sensor to pass the site's https: address to your C# code??

Really, in the 2023 the only way to monitor a super common piece of infrastructure, like the certificate issued with STARTTLS by a SMTP relay, is to use a custom script or nagios?

Hello Dear customer,

Thank you for your interest! Our dedicated development team is actively working on implementing various features, including the one you mentioned. While we're committed to delivering the best experience, we currently don't have a specific estimated timeframe for when this feature will be fully implemented. We appreciate your patience and will keep you updated on our progress.

Regards