Skip to content

Commit e74d27a

Browse files
bseenubseenu
committed
Adding the metric for certificate start
1 parent f2078be commit e74d27a

File tree

5 files changed

+64
-10
lines changed

5 files changed

+64
-10
lines changed

‎prober/grpc.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,8 @@ func ProbeGRPC(ctx context.Context, target string, module config.Module, registr
9797
Help: "Response HealthCheck response",
9898
}, []string{"serving_status"})
9999

100+
probeSSLEarliestCertStartGauge = prometheus.NewGauge(sslEarliestCertStartGaugeOpts)
101+
100102
probeSSLEarliestCertExpiryGauge = prometheus.NewGauge(sslEarliestCertExpiryGaugeOpts)
101103

102104
probeTLSVersion = prometheus.NewGaugeVec(
@@ -200,8 +202,9 @@ func ProbeGRPC(ctx context.Context, target string, module config.Module, registr
200202
if serverPeer != nil {
201203
tlsInfo, tlsOk := serverPeer.AuthInfo.(credentials.TLSInfo)
202204
if tlsOk {
203-
registry.MustRegister(probeSSLEarliestCertExpiryGauge, probeTLSVersion, probeSSLLastInformation)
205+
registry.MustRegister(probeSSLEarliestCertStartGauge, probeSSLEarliestCertExpiryGauge, probeTLSVersion, probeSSLLastInformation)
204206
isSSLGauge.Set(float64(1))
207+
probeSSLEarliestCertStartGauge.Set(float64(getEarliestCertStart(&tlsInfo.State).Unix()))
205208
probeSSLEarliestCertExpiryGauge.Set(float64(getEarliestCertExpiry(&tlsInfo.State).Unix()))
206209
probeTLSVersion.WithLabelValues(getTLSVersion(&tlsInfo.State)).Set(1)
207210
probeSSLLastInformation.WithLabelValues(getFingerprint(&tlsInfo.State), getSubject(&tlsInfo.State), getIssuer(&tlsInfo.State), getDNSNames(&tlsInfo.State), getSerialNumber(&tlsInfo.State)).Set(1)

‎prober/http.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -318,8 +318,12 @@ func ProbeHTTP(ctx context.Context, target string, module config.Module, registr
318318
Help: "Response HTTP status code",
319319
})
320320

321+
probeSSLEarliestCertStartGauge = prometheus.NewGauge(sslEarliestCertStartGaugeOpts)
322+
321323
probeSSLEarliestCertExpiryGauge = prometheus.NewGauge(sslEarliestCertExpiryGaugeOpts)
322324

325+
probeSSLLastChainStartTimestampSeconds = prometheus.NewGauge(sslChainStartInTimeStampGaugeOpts)
326+
323327
probeSSLLastChainExpiryTimestampSeconds = prometheus.NewGauge(sslChainExpiryInTimeStampGaugeOpts)
324328

325329
probeSSLLastInformation = prometheus.NewGaugeVec(
@@ -714,10 +718,12 @@ func ProbeHTTP(ctx context.Context, target string, module config.Module, registr
714718

715719
if resp.TLS != nil {
716720
isSSLGauge.Set(float64(1))
717-
registry.MustRegister(probeSSLEarliestCertExpiryGauge, probeTLSVersion, probeTLSCipher, probeSSLLastChainExpiryTimestampSeconds, probeSSLLastInformation)
721+
registry.MustRegister(probeSSLEarliestCertStartGauge, probeSSLEarliestCertExpiryGauge, probeTLSVersion, probeTLSCipher, probeSSLLastChainStartTimestampSeconds, probeSSLLastChainExpiryTimestampSeconds, probeSSLLastInformation)
722+
probeSSLEarliestCertStartGauge.Set(float64(getEarliestCertStart(resp.TLS).Unix()))
718723
probeSSLEarliestCertExpiryGauge.Set(float64(getEarliestCertExpiry(resp.TLS).Unix()))
719724
probeTLSVersion.WithLabelValues(getTLSVersion(resp.TLS)).Set(1)
720725
probeTLSCipher.WithLabelValues(getTLSCipher(resp.TLS)).Set(1)
726+
probeSSLLastChainStartTimestampSeconds.Set(float64(getLastChainStart(resp.TLS).Unix()))
721727
probeSSLLastChainExpiryTimestampSeconds.Set(float64(getLastChainExpiry(resp.TLS).Unix()))
722728
probeSSLLastInformation.WithLabelValues(getFingerprint(resp.TLS), getSubject(resp.TLS), getIssuer(resp.TLS), getDNSNames(resp.TLS), getSerialNumber(resp.TLS)).Set(1)
723729
if httpConfig.FailIfSSL {

‎prober/prober.go

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,30 @@ import (
2525
type ProbeFn func(ctx context.Context, target string, config config.Module, registry *prometheus.Registry, logger *slog.Logger) bool
2626

2727
const (
28-
helpSSLEarliestCertExpiry = "Returns last SSL chain expiry in unixtime"
28+
helpSSLEarliestCertStart = "Returns earliest SSL cert start in unixtime"
29+
helpSSLEarliestCertExpiry = "Returns earliest SSL cert expiry in unixtime"
30+
helpSSLChainStartInTimeStamp = "Returns last SSL chain start in timestamp"
2931
helpSSLChainExpiryInTimeStamp = "Returns last SSL chain expiry in timestamp"
3032
helpProbeTLSInfo = "Returns the TLS version used or NaN when unknown"
3133
helpProbeTLSCipher = "Returns the TLS cipher negotiated during handshake"
3234
)
3335

3436
var (
37+
sslEarliestCertStartGaugeOpts = prometheus.GaugeOpts{
38+
Name: "probe_ssl_earliest_cert_start",
39+
Help: helpSSLEarliestCertStart,
40+
}
41+
3542
sslEarliestCertExpiryGaugeOpts = prometheus.GaugeOpts{
3643
Name: "probe_ssl_earliest_cert_expiry",
3744
Help: helpSSLEarliestCertExpiry,
3845
}
3946

47+
sslChainStartInTimeStampGaugeOpts = prometheus.GaugeOpts{
48+
Name: "probe_ssl_last_chain_start_timestamp_seconds",
49+
Help: helpSSLChainStartInTimeStamp,
50+
}
51+
4052
sslChainExpiryInTimeStampGaugeOpts = prometheus.GaugeOpts{
4153
Name: "probe_ssl_last_chain_expiry_timestamp_seconds",
4254
Help: helpSSLChainExpiryInTimeStamp,

‎prober/tcp.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,9 @@ func probeExpectInfo(registry *prometheus.Registry, qr *config.QueryResponse, by
106106
}
107107

108108
func ProbeTCP(ctx context.Context, target string, module config.Module, registry *prometheus.Registry, logger *slog.Logger) bool {
109+
probeSSLEarliestCertStart := prometheus.NewGauge(sslEarliestCertStartGaugeOpts)
109110
probeSSLEarliestCertExpiry := prometheus.NewGauge(sslEarliestCertExpiryGaugeOpts)
111+
probeSSLLastChainStartTimestampSeconds := prometheus.NewGauge(sslChainStartInTimeStampGaugeOpts)
110112
probeSSLLastChainExpiryTimestampSeconds := prometheus.NewGauge(sslChainExpiryInTimeStampGaugeOpts)
111113
probeSSLLastInformation := prometheus.NewGaugeVec(
112114
prometheus.GaugeOpts{
@@ -143,9 +145,11 @@ func ProbeTCP(ctx context.Context, target string, module config.Module, registry
143145
}
144146
if module.TCP.TLS {
145147
state := conn.(*tls.Conn).ConnectionState()
146-
registry.MustRegister(probeSSLEarliestCertExpiry, probeTLSVersion, probeSSLLastChainExpiryTimestampSeconds, probeSSLLastInformation)
148+
registry.MustRegister(probeSSLEarliestCertStart, probeSSLEarliestCertExpiry, probeTLSVersion, probeSSLLastChainStartTimestampSeconds, probeSSLLastChainExpiryTimestampSeconds, probeSSLLastInformation)
149+
probeSSLEarliestCertStart.Set(float64(getEarliestCertStart(&state).Unix()))
147150
probeSSLEarliestCertExpiry.Set(float64(getEarliestCertExpiry(&state).Unix()))
148151
probeTLSVersion.WithLabelValues(getTLSVersion(&state)).Set(1)
152+
probeSSLLastChainStartTimestampSeconds.Set(float64(getLastChainStart(&state).Unix()))
149153
probeSSLLastChainExpiryTimestampSeconds.Set(float64(getLastChainExpiry(&state).Unix()))
150154
probeSSLLastInformation.WithLabelValues(getFingerprint(&state), getSubject(&state), getIssuer(&state), getDNSNames(&state), getSerialNumber(&state)).Set(1)
151155
}
@@ -210,11 +214,13 @@ func ProbeTCP(ctx context.Context, target string, module config.Module, registry
210214
conn = net.Conn(tlsConn)
211215
scanner = bufio.NewScanner(conn)
212216

213-
// Get certificate expiry.
217+
// Get certificate start and expiry.
214218
state := tlsConn.ConnectionState()
215-
registry.MustRegister(probeSSLEarliestCertExpiry, probeTLSVersion, probeSSLLastChainExpiryTimestampSeconds, probeSSLLastInformation)
219+
registry.MustRegister(probeSSLEarliestCertStart, probeSSLEarliestCertExpiry, probeTLSVersion, probeSSLLastChainStartTimestampSeconds, probeSSLLastChainExpiryTimestampSeconds, probeSSLLastInformation)
220+
probeSSLEarliestCertStart.Set(float64(getEarliestCertStart(&state).Unix()))
216221
probeSSLEarliestCertExpiry.Set(float64(getEarliestCertExpiry(&state).Unix()))
217222
probeTLSVersion.WithLabelValues(getTLSVersion(&state)).Set(1)
223+
probeSSLLastChainStartTimestampSeconds.Set(float64(getLastChainStart(&state).Unix()))
218224
probeSSLLastChainExpiryTimestampSeconds.Set(float64(getLastChainExpiry(&state).Unix()))
219225
probeSSLLastInformation.WithLabelValues(getFingerprint(&state), getSubject(&state), getIssuer(&state), getDNSNames(&state), getSerialNumber(&state)).Set(1)
220226
}

‎prober/tls.go

Lines changed: 31 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,24 @@ import (
2222
"time"
2323
)
2424

25+
func getEarliestCertStart(state *tls.ConnectionState) time.Time {
26+
earliestStart := time.Time{}
27+
for _, cert := range state.PeerCertificates {
28+
if (earliestStart.IsZero() || cert.NotBefore.Before(earliestStart)) && !cert.NotBefore.IsZero() {
29+
earliestStart = cert.NotBefore
30+
}
31+
}
32+
return earliestStart
33+
}
34+
2535
func getEarliestCertExpiry(state *tls.ConnectionState) time.Time {
26-
earliest := time.Time{}
36+
earliestExpiry := time.Time{}
2737
for _, cert := range state.PeerCertificates {
28-
if (earliest.IsZero() || cert.NotAfter.Before(earliest)) && !cert.NotAfter.IsZero() {
29-
earliest = cert.NotAfter
38+
if (earliestExpiry.IsZero() || cert.NotAfter.Before(earliestExpiry)) && !cert.NotAfter.IsZero() {
39+
earliestExpiry = cert.NotAfter
3040
}
3141
}
32-
return earliest
42+
return earliestExpiry
3343
}
3444

3545
func getFingerprint(state *tls.ConnectionState) string {
@@ -53,6 +63,23 @@ func getDNSNames(state *tls.ConnectionState) string {
5363
return strings.Join(cert.DNSNames, ",")
5464
}
5565

66+
func getLastChainStart(state *tls.ConnectionState) time.Time {
67+
lastChainStart := time.Time{}
68+
for _, chain := range state.VerifiedChains {
69+
earliestCertStart := time.Time{}
70+
for _, cert := range chain {
71+
if (earliestCertStart.IsZero() || cert.NotBefore.After(earliestCertStart)) && !cert.NotAfter.IsZero() {
72+
earliestCertStart = cert.NotBefore
73+
}
74+
}
75+
if lastChainStart.IsZero() || lastChainStart.After(earliestCertStart) {
76+
lastChainStart = earliestCertStart
77+
}
78+
79+
}
80+
return lastChainStart
81+
}
82+
5683
func getLastChainExpiry(state *tls.ConnectionState) time.Time {
5784
lastChainExpiry := time.Time{}
5885
for _, chain := range state.VerifiedChains {

0 commit comments

Comments
 (0)