NAME

Monitoring::Sneck::Checks::https_cert - checks the certificate a TLS server hands out

VERSION

Version 0.0.1

SYNOPSIS

www_cert|perl:https_cert -H www.example.org
ldaps_cert|perl:https_cert -H ldap.example.org -p 636 -w 45 -c 20
vhost_cert|perl:https_cert -H 192.0.2.10 -n shop.example.org
internal_cert|perl:https_cert -H intranet.example.org --ca-file /usr/local/etc/ssl/internal-ca.pem
mail_cert|perl:https_cert -H mail.example.org -s smtp
imap_cert|perl:https_cert -H mail.example.org -s imap -w 45

DESCRIPTION

Connects through IO::Socket::SSL and checks the certificate the server hands out. It must be signed by a trusted CA and cover the name, unless --insecure is given, else it is CRITICAL, as is expired or not good yet. Then it is WARNING or CRITICAL by the days left.

Any TLS port works, not only 443. With --starttls, it connects in the clear and asks for TLS the way that protocol does, which for SMTP needs STARTTLS in the EHLO reply. Not being able to is CRITICAL.

OPTIONS

- -H, --hostname :: The host to connect to. Required.

- -p, --port :: The port. Default :: 443, or for --starttls, the protocol's

- -s, --starttls :: Ask for TLS through smtp, imap, pop3, ftp, or ldap.

- --helo-name :: The name to give in EHLO, for --starttls smtp. Default :: the host name of this host

- -n, --sni :: The name to ask for and check the certificate covers. Default :: --hostname

- -w, --warning :: Days left at or under which it is WARNING. Default :: 30

- -c, --critical :: Days left at or under which it is CRITICAL. Default :: 14

- --insecure :: Only check when it expires, not who signed it or the name.

- --ca-file :: The CA file to check it against.

METHODS

check

Does the check.

starttls

Asks for TLS on a socket connected in the clear.

- socket :: The socket.

- protocol :: smtp, imap, pop3, ftp, or ldap.

Returns undef once the server said yes, else what went wrong.

my $problem = $check->starttls( $socket, 'smtp' );