SSL Certificate Validity Test
This test reports how long (in days) the SSL certificates that have been configured for monitoring will remain valid and the current status of the SSL certificates.
This test is disabled by default. To enable the test, go to the enable / disable tests page using the menu sequence : Agents -> Tests -> Enable/Disable, pick the desired Component type, set Performance as the Test type, choose the test from the disabled tests list, and click on the < button to move the test to the ENABLED TESTS list. Finally, click the Update button.
Target of the test : An Apache web server
Agent deploying this test : An internal agent
Outputs of the test : One set of outputs for every Target and/or every Targetfile and/or the unique key assigned to each certificate in the specified Keystore File.
| Parameters | Description |
|---|---|
|
Test period |
This indicates how often should the test be executed. |
|
Host |
The host for which the test is to be configured. |
|
Targets |
If you want to monitor specific SSL-enabled web sites, then, provide a comma-separated list of {HostIP/Name}:{Port) pairs, which represent the web sites to be monitored. For example, 192.168.10.7:443,192.168.10.8:443. The test connects to each IP/port pair and checks for the validity of the certificate associated with that target. One set of metrics is reported for each target. The descriptor represents the common name (CN) value of the SSL certificate. By default, this parameter is set to the <IP_of_the_monitored_web/application_server>:<Port_on_which_the_server_listens>. If you do not want to monitor the validity of certificates based on configured targets, set this parameter to none. To enable administrators to easily configure the Targets parameter, eG Enterprise provides a special interface. To access this interface, click on the encircled ‘+’ button alongside the TARGETS text box in the test configuration page. To know how to use this special interface, refer to SSL Certificate Validity Test |
|
Targetfiles |
To monitor specific certificate files, provide a comma-separated list of file paths for the SSL certificates that are to be monitored in the Targetfiles text box. For example, C:\server.crt, D:\admin.crt. The test reads the SSL Certificates for the web sites that are to be monitored from this location and checks for the validity. If you do not want to check the validity of specific certificate files, set this parameter to none. |
|
Keystore Type |
Specify what type of keystore contains the certificates that you want to monitor. By default, this parameter is set to the value JKS, which implies that the Java Keystore is by default used for storing the certificates. If the certificates in your environment are contained within a different type of keystore, then specify the exact type here - eg., PKCS12. |
|
Keystore File |
A keystore is a database (usually a file) that can contain trusted certificates and combinations of private keys with their corresponding certificates. If you are looking to monitor the certificates contained within a keystore file, then provide the full path to this file in the Keystore File text box. For example, the location of this file may be: C:\egurkha\manager\tomcat\webapps\eGmanager.bin. In this case, the test automatically accesses each of the certificates that the specified keystore contains, and checks its validity. If you do not want to monitor the certificates in a keystore, set this parameter to none. |
|
Keystore Password |
If a Keystore File is provided, then, in this text box, provide the password that is used to obtain the associated certificate details from the Keystore File. If none is specified against Keystore File, then, enter none here as well. |
|
Confirm Password |
Confirm the Keystore Password by retyping it here. |
|
Timeout |
Provide the duration (in seconds) beyond which the test times out. By default, it is 60 seconds. |
|
DD Frequency |
Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency. |
|
Detailed Diagnosis |
To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:
|
| Measurement | Description | Measurement Unit | Interpretation | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
SSL certificate validity |
Indicates the number of days from the current day for which this SSL certificate will be valid. |
Days |
Ensuring that SSL certificates are valid is crucial for maintaining secure communication over the internet. When a certificate expires, it can lead to security warnings in web browsers and other client applications, potentially causing trust issues with users and disrupting access to the website or service. To maintain security, administrators need to regularly monitor the expiration dates of SSL certificates and renew them before they expire. Many certificate authorities and certificate management tools offer reminders and automation to help with this process. Use the detailed diagnosis of this measure to find out the details of the SSL certificate such as Order, Type, Version Serial No, Active Date, Expiry Date, Common Name, Organization, Organization Unit, Locality, State, Country, etc. |
||||||||||||
|
Certificate status |
Indicates the current status of this SSL certificate. |
|
Certificate status is crucial for ensuring the security of communication over the internet. Browsers and other client applications typically check the status of SSL certificates when establishing secure connections to websites. If a certificate's status is invalid, revoked, or expired, it can result in security warnings or errors, indicating potential risks to users. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate the current status of this SSL certificate. In the graph of this measure however, the state of the SSL certificate is represented using the corresponding numeric equivalents only. |
||||||||||||
|
Thumbprint valid |
Indicates whether/not the thumbprint of this SSL certificate is valid. |
|
Thumbprint validity is crucial to the authenticity of the certificate, it means that the thumbprint matches the expected value, indicating that the certificate has not been tampered with and that its contents are intact. This validation is crucial for ensuring the authenticity and integrity of the SSL certificate. If the thumbprint is invalid, then the value of this measure will be No. If thumbprint is valid, then the value of this measure will be Yes. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the thumbprint of this SSL certificate is valid. In the graph of this measure however, the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate valid? |
Indicates whether or not this certificate is valid. |
|
An SSL certificate is issued by a Certificate Authority (CA) for a specific duration, typically ranging from one to three years. During this period, the certificate is considered valid for securing communication between a client (such as a web browser) and a server (such as a website). Ensuring that SSL certificates are valid is essential for maintaining secure communication over the Internet. Expired certificates can lead to security warnings in web browsers and other client applications, potentially causing trust issues with users and disrupting access to the website or service. Therefore, administrators must monitor SSL certificate expiration dates and renew them before they expire to ensure uninterrupted security. If the certificate is invalid, then the value of this measure will be No. If certificate is valid, then the value of this measure will be Yes. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether or not this certificate is valid. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate trusted? |
Indicates whether or not this certificate is from a trusted source. |
|
If the client's trust store includes the root certificate of the CA that issued the SSL certificate (or an intermediate certificate leading up to the root CA), and if the SSL certificate presented by the server is properly signed and not expired, then the certificate is considered trusted. The client will proceed with establishing a secure connection without displaying any warning messages to the user. However, if the SSL certificate presented by the server is self-signed or issued by a CA that is not recognized or trusted by the client, the certificate is considered untrusted. In such cases, the client may display a warning message indicating that the certificate is not trusted, and the user may need to manually verify the certificate's authenticity or choose to proceed at their own risk. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate is from a trusted source. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate expired? |
Indicates whether or not this certificate is expired. |
|
SSL certificates have a defined validity period, typically ranging from one to three years, during which they are considered valid. Beyond this period, the certificate is no longer trusted by clients, and attempts to establish secure connections using the expired certificate will fail. To prevent these issues, administrators need to monitor the expiration dates of SSL certificates and renew them before they expire. This test monitors the certificate expiry date and allows administrators to take action before the certificate expires. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate is expired. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate revoked? |
Indicates whether or not this certificate is revoked. |
|
Revocation prevents the use of compromised or unauthorized certificates, helping to protect against potential security threats. When an SSL certificate is revoked, it means that the certificate has been invalidated by the issuing CA due to security concerns, and clients should not trust or use the certificate for secure communication. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate is revoked. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate self signed? |
Indicates whether or not this certificate is self signed. |
|
When an SSL (Secure Sockets Layer) certificate is described as "self-signed," it means that the entity who created the certificate has also signed it. This situation has implications for trust. While a self-signed certificate can provide encryption between a client and server, it lacks the external validation provided by a Certificate Authority. Therefore, web browsers and other applications typically display a warning when encountering a self-signed certificate, indicating that the certificate is not trusted. For production environments or public-facing websites, it's recommended to use certificates signed by a recognized CA to ensure trustworthiness and avoid warning messages for users. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate is self signed. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is private certificate configured? |
Indicates whether or not this certificate configured is a private certificate. |
|
It indicates that the private key required for decrypting data encrypted with the corresponding public key is properly set up or available. Without the private key, it would be impossible to decrypt the data encrypted with the public key, thus rendering the SSL certificate ineffective for secure communication. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether the certificate is private certificate. In the graph of this measure however, the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate used before active date? |
Indicates whether or not this certificate is used before active date. |
|
The validity period of the certificate typically includes a start date (also known as the activation date) and an end date (expiration date). Attempting to use a certificate before its active date can lead to various issues, including security risks as the certificate may not yet be authorized for use, Clients (such as web browsers) may reject connections using certificates that are not yet active, displaying warning messages to users and potentially disrupting access to the website or service, and violation of organization policies. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate is used before active date. In the graph of this measure however, the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate having untrusted root? |
Indicates whether or not this certificate have untrusted root. |
|
If an SSL certificate's chain of trust does not lead back to a trusted root Certificate Authority, it's considered to have an untrusted root. This can happen for several reasons including (a) the server may not be configured to provide the necessary intermediate certificates during the SSL handshake. Without the complete chain, the client cannot verify the certificate's authenticity, (b) If the SSL certificate is self-signed, (c) Incorrect or Expired Intermediate Certificates. In these cases, the client typically shows a warning to the user. Resolving the issue usually involves ensuring that the server presents the complete chain of trust during the SSL handshake. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate have untrusted root. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is Common Name(CN) available for the certificate? |
Indicates whether or not common name available for this certificate. |
|
The CN refers to the primary domain name for which the certificate is issued. It's essentially the name that the certificate is meant to secure. For example, if you have a website with the domain name "example.com," the Common Name field in the SSL certificate for that website would typically be "example.com." Having a valid Common Name is crucial for SSL certificates because it allows web browsers and other client applications to verify that they are communicating securely with the intended domain. When a client connects to a server, it checks the Common Name in the certificate presented by the server against the domain name it is trying to connect to. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not common name available for the certificate. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is Subject available for the certificate? |
Indicates whether or not subject available for this certificate. |
|
It typically includes information such as the organization's name (if applicable) and the domain name associated with the certificate. During the SSL handshake process, the client checks the subject information in the certificate presented by the server to ensure that it matches the domain name the client is trying to connect to. If there's a mismatch or if the subject information is missing, the client may display a warning indicating a potential security issue. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not subject available for this certificate. In the graph of this measure however, the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Is certificate having mismatched domain? |
Indicates whether or not this certificate is having mismatched domain. |
|
If a certificate's subject lists for example "domain.com" as the domain, but the client is attempting to connect to"subdomain.domain.com" or "anotherdomain.com," this would be considered a domain mismatch. When a domain mismatch occurs, web browsers and other client applications typically display a warning message to the user indicating that the connection may not be secure. Resolving domain mismatches usually involves obtaining a new SSL certificate with the correct domain information or adjusting server configurations to match the certificate's subject. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate is having mismatched domain. In the graph of this measure however, the the values are represented using the corresponding numeric equivalents only.
|
||||||||||||
|
Is having valid certificate chain? |
Indicates whether or not a valid certificate chain is available for this certificate. |
|
SSL certificates are often issued by intermediate Certificate Authorities (CAs), which themselves may be signed by a higher-level CA, forming a chain of trust that eventually leads back to a trusted root CA. In these cases, the client typically shows a warning to the user. Resolving the issue usually involves ensuring that the server presents the complete chain of trust during the SSL handshake. The numeric values that correspond to these measure values are discussed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate whether/not the certificate is having valid certificate chain. In the graph of this measure however, the values are represented using the corresponding numeric equivalents only. |
||||||||||||
|
Public key size |
Indicates the size of public key on this certificate. |
Bits |
The public key size in SSL certificates refers to the length of the cryptographic key used for secure communication. 2048-bit RSA keys are currently secure and widely accepted. For long-term security, consider 3072-bit keys. However, upgrading to 4096 bits should be done cautiously due to performance considerations. The maximum size of public key in an SSL certificate is 4096 bits. The default key size can be 2048 bits or 4096 bits. |
||||||||||||
|
Available Subject Alternative Names(SAN) |
Indicates the number of SANs available for this certificate. |
Number |
This refers to additional domain names or hostnames that can be included in an SSL certificate alongside the primary domain name (CN or Common Name). SANs are particularly useful in scenarios like multi-domain hosting, wildcard SSL certificates, or Unified Communications (UC) certificates where a single certificate can cover multiple domain names or subdomains. The Subject Alternative Name (SAN) is an extension to the X.509 specification that allows users to specify additional host names for a single SSL certificate. An SSL certificate with more than one name is associated using the SAN extension. |
