Zabbix-ssl-certificate-check-with-grade/README.md

Zabbix SSL Certificate template (grading included)

⚠️ Project retired – please migrate

This repository is no longer maintained.
Development continues in a dedicated, consolidated repo:

https://github.com/initMAX/Zabbix-Templates/tree/production/free/SSL_Labs_Certificate_Grade

Why move?

• Zero external scripts – everything now runs as a native Script item on Zabbix 7.0+.
• Automatic API registration – the template registers the e‑mail on first run; no curl or manual step required.
• Port flexibility – supports the only public API ports allowed by SSL Labs (443, 8443, 10443).
• Clean triggers & menu link – built‑in grade triggers (A+ → F) and a one‑click link to the full SSL Labs report.
• Single source of truth – all initMAX public templates live in one place, with version tags and release notes.

---

Please update your bookmarks and open issues/PRs in the new repository.
Thank you for using initMAX templates!

This a guide on howto deploy and configure this template for SSL expiration check and grading SSL certificate deployment.

Monitoring:

1. Running HTTPS service (port)
2. Certificate issuer
3. Certificate expiration
4. Certificate installation grade with SSL Labs API.

Latest data

Items

Triggers

Macros

Install instruction

The following steps need to be performed on all zabbix servers (or proxy servers respectively).

CentOS, RHEL

yum install zabbix-sender

Debian, Ubuntu

apt-get install zabbix-sender

Clone the repository

cd /tmp
git clone https://github.com/hermanekt/Zabbix-ssl-certificate-check-with-grade.git

Copy scripts to their respective locations

cp /tmp/Zabbix-ssl-certificate-check-with-grade/ssllabs_checker.sh /usr/lib/zabbix/externalscripts
cp /tmp/Zabbix-ssl-certificate-check-with-grade/ssllabs_checker_at.sh /usr/lib/zabbix/externalscripts
cp /tmp/Zabbix-ssl-certificate-check-with-grade/zext_ssl_expiry.sh /usr/lib/zabbix/externalscripts
cp /tmp/Zabbix-ssl-certificate-check-with-grade/zext_ssl_issuer.sh /usr/lib/zabbix/externalscripts

Set an execution bit

chmod +x zext_ssl_*
chmod +x ssllabs_checker*

Install GO or copy over the pre-compiled package 'ssllabs-scan' (version v1.35.1)

Here you have 2 options - either to use the precompiled package I've provided, or you can build your own package from scratch.

1) Copy the package

cp /tmp/Zabbix-ssl-certificate-check-with-grade/ssllabs-scan /usr/lib/zabbix/externalscripts
chmod +x /usr/lib/zabbix/externalscripts/ssllabs-scan

OR

1) Install GOlang

CentOS, RHEL

yum install golang

Debian, Ubuntu

apt-get install golang

2) Build sslabs-scan package

cd /tmp
git clone https://github.com/ssllabs/ssllabs-scan/
cd ssllabs-scan/
go build
mv /tmp/ssllabs-scan/ssllabs-scan /usr/lib/zabbix/externalscripts/
cd && rm -rf /tmp/ssllabs-scan/

Clean up the server

rm -rf /tmp/Zabbix-ssl-certificate-check-with-grade

Import the template to zabbix frontend

File: Template_SSL_Certificates.xml

Create dummy host and link the template to it

Dummy host with hostname is URL name for example https://www.google.com/ hostname is: www.google.com

Host connection:

Host template: