Keep an eye on your certificates
Copy link to the page “Keep an eye on your certificates”sslbrain sends a message only when there is a channel and an alert rule. Create both before you rely on anyone hearing when something goes wrong.
Create a channel
Copy link to the section “Create a channel”A channel is an e-mail address or a webhook that messages are sent to.
-
Open Monitoring › Channels.
-
Under Create a new channel, choose a Channel type. Which types you can choose depends on the licence, see Channels by licence.
-
Enter a Channel name and fill in the fields under Settings for the channel type. The appliance shows these field names in Danish:
Channel type Fields E-mail (Cloud) Modtager E-mail (SMTP) Modtager, SMTP-server, Port (default 587), Brugernavn, Adgangskode, Kryptering (tls, ssl or none), Afsenderadresse, Afsendernavn Webhook Webhook URL -
Click Create channel.
The channel now appears under Existing channels and can be chosen in an alert rule.
- E-mail (Cloud) sends to the Email recipients list under Notifications in sslbrain Cloud, up to 10 addresses. If the list is empty, messages go to the account owner. The Modtager field must be filled in, but it is not used.
- E-mail (SMTP) and Webhook are sent directly from the appliance, also when it cannot reach sslbrain Cloud. Choose one of them if alerts must get through during an outage between the appliance and sslbrain Cloud.
A channel cannot be edited. To change an address, create a new channel and select it in the alert rules. History next to the channel shows who created and changed it.
Create an alert rule
Copy link to the section “Create an alert rule”An alert rule sends a message to one channel when a given event happens.
-
Open Monitoring › Alert rules and click New alert rule.
-
Enter a Name, and choose an Event and a Channel.
-
If you chose Certificate expiring, enter in Threshold (days) how many days before expiry the message is sent. The number must be from 1 to 365.
-
Click Save.
A rule is on once it is saved. Rules are evaluated every hour, and everything one rule finds goes out as a single message. Operator and the roles above it can create and edit rules. Only an Administrator can delete them.
| Event | Sent when |
|---|---|
| Certificate expiring | A certificate has fewer days left than the threshold. |
| Certificate expired | A certificate has expired. |
| Deployment failed | A deployment to a server failed within the last 24 hours. |
| Renewal failed | An automatic renewal failed within the last 24 hours, or a Windows CA source stopped after 3 failures in a row. |
| Connection lost | sslbrain has not been able to reach a server for more than 2 hours. |
| Agent stale | A service agent has not checked in for more than 48 hours. |
| Certificate mismatch | A deployed certificate does not cover the hostname the binding uses. |
| Unknown certificate discovered | A TLS port seen within the last 24 hours presents a certificate sslbrain does not know. |
| Policy violation | There are open policy findings, a 1024-bit RSA key, or a self-signed certificate in use. |
Overview is the first item under Daily in the menu. The cards at the top count only certificates sslbrain manages. Expiring soon counts those that expire within 30 days, and turns critical when one of them expires within 7 days. Expired counts expired certificates that are still in use.
Below the cards is the number of certificates found on your servers that sslbrain does not manage, see Find the certificates you already have.
Actions is the list of things to do. The number next to the menu item is the count of critical items and warnings on the list.
- An expired certificate, or one with 7 days or fewer left, is critical.
- A certificate with 30 days or fewer left is a warning.
- The list also has items about the appliance’s own TLS certificate, disk space, the licence, servers, deployments, Auto-DNS and the agent catalogue.
- Some items can be dismissed with ×. Certificate items cannot.
The page can also show a banner:
- Emergency access active: someone is signed in with the 12 backup words, see Security.
- ”… of your … servers are deactivated because the licence covers …”: the licence does not cover every server, see When something does not work.
Monitoring › Alerts shows what needs action now. Alerts are not acknowledged here. The Active problems list is in this order:
- Expired certificates.
- Certificates in a critical state.
- Deployments that failed in the last 7 days, up to 10.
- Agents that have not checked in for 15 minutes, and servers sslbrain cannot reach.
- Certificates with a warning.
Alerts counts every certificate, including those only found on your servers. It grades a certificate by its total validity, so the figures can differ from Overview, which uses 30 and 7 days:
| Certificate validity | Warning | Critical |
|---|---|---|
| Over 90 days | 28 days left | 7 days left |
| 11 to 90 days | Under 26.67 % of the validity left | Under 10 % left |
| 10 days or less | Under 47.5 % left | Under 16.67 % left |
Expired and replaced certificates
Copy link to the section “Expired and replaced certificates”- Certificates › Expired lists expired certificates that no profile manages and that no newer certificate has replaced. These are usually certificates sslbrain found on your servers. By default it shows the last 90 days. They never become items under Actions.
- Certificates › Replaced lists certificates that a newer certificate has superseded. The newer one is either marked as the renewal or has the same CN and issuer. They never count towards Expiring soon.
Certificates on discovered TLS ports are checked again every night at 04:00, see Find the certificates you already have.
Infrastructure map
Copy link to the section “Infrastructure map”Servers › Infrastructure map shows the chain from certificate source to service: Sources, Certificate Profiles, Certificates, Deploy rules, Servers & services and Deployed / status. A missing link is drawn as missing.
Broken chains and warnings lists the faults with a code, for example profile_without_source, certificate_without_rule, deployment_failed and server_unreachable. Show chain shows the chain for one certificate only.
If it fails
Copy link to the section “If it fails”- Alert rules shows “Create a notification channel first so alert rules have somewhere to send.”: create a channel first.
- A channel type is listed under Unavailable channel types with “Requires … tier”: the licence does not include that channel type. The licence is changed in sslbrain Cloud, see sslbrain Cloud.
- E-mail (Cloud) does not arrive: the appliance must be connected to sslbrain Cloud.
- The webhook call does not arrive: the address must be reachable from the appliance. The appliance waits at most 15 seconds for a response.
Channels by licence
Copy link to the section “Channels by licence”| Channel type | Licence | Sent |
|---|---|---|
| E-mail (Cloud) | Free and up | Through sslbrain Cloud |
| E-mail (SMTP) | Basic and up | Directly from the appliance |
| Webhook | Basic and up | Directly from the appliance |
Webhook sends an HTTP POST with JSON to the address:
{"text": "<subject>\n<message>", "username": "sslbrain"}