29

3

Check for expiring SSL certificates

Have you ever thought about your SSL certificates expiring? Unfortunately most systems out there that use PKI won't inform you when a SSL certificate is about to expire. I ran into this issue at a customer site when they needed to know which web-sites had certificates that were about to expire. So to help overcome this issue I put together an application that can check a list of addresses and report the expiration of the certificates.

Here are some of the configuration settings included in this application:

Verify any use of certificates (LDAP/S, HTTPS, SMTP/tls)
Import/Export a list of addresses
View individual certificate properties
Save individual certificates
Set warning thresholds based on number of days until expire
Easy to read summary of certificate status summary

One thing I never got around to completing is the ability to save the certificate chain. If anyone really wants that feature then please let me know. I have the source code for this if anyone is interested in adding functionality.

Please let me know if you find any bugs or problems.

VerifySSL.zip (72.31 kb)

OpenSSL Vulnerability (USN-612-1) Exposed An interesting article was posted on Technology Review that outlined a vulnerability with OpenSSL.&...MetaWeblogHandler Issues using SSLPreviously I have posted entries about using SSL with Windows Live Writer. If you haven’t read...CRL Checking in IASToday my customer was configuring their first EAP-TLS authentication through their Internet Authenti...

Comments

Add comment

Name*
E-mail*
Website
b i u quote

Comment
Preview

Notify me when new comments are added

Posted by Radek Dolezel on Friday, April 11, 2008

Hello Chris,
your tool is very helpful. However, I found some areas to make it even better:
1) when you sort records by "Days Left" column, it uses string comparison, not number comparison, this is logical because this column can contain both number or states (Expired). The problem is that certificates which will expire in 7 days, are sorted after certificates which expire in 30 days. It looks strange.
2) it would be great to be able to scan only selected records, not all of them every time
3) last but not least, the option to exclude some certificate from "full scan" would be very nice. I have used your tool for a simple evidence of every certificate, unfortunately some of them are not accessible from my workstation (for example certificates used for B2B)

Regards

Radek

Posted by Radek Dolezel on Tuesday, August 19, 2008

Hello Chris,
is it possible to run your tool in a "silent" mode? I have more than 100 certificates to check, unfortunately some of them are in DMZ and not accessible from my computer. I would like to avoid all pop-up messages and warnings and see only final result.

Is it possible?

Regards

Radek