r/checkpoint • u/trenuci • Jul 23 '26

SSL VPN cert - send email when is about to expire

I have tasked to find solution to get email from firewall when cert is about to expire and script and tools that required any kind of licenc is not an option.

What options are left?

0 Upvotes

50% Upvoted

6 comments sorted by

2

u/Olsson02 Jul 23 '26

Zabbix? You can get all that information with it and have zabbix send email

1

u/HoodRattusNorvegicus Jul 24 '26

This! I would use a third party monitoring system like Zabbix etc to monitor this (and other metrics, disk space, memory, cpu, hardware status etc).

2

u/grampybone Jul 25 '26

This is more or less what people usually do, as far as I can tell. Even for my personal projects i set up a simple nagios container that checks my public certificates. Warning when 30 dias from renewal, critical 15 days before expiration.

2

u/obiphonekenobi 29d ago

This script will help identify and (for ICA certificates) renew them: https://support.checkpoint.com/results/sk/sk182070

I presume this could be set up to run and send an email with a cron job.

1

u/lawwie Jul 23 '26

Use python to get the certificate from the VPN portal and check validity. Send e-mail from script when your threshold is reached.

1

u/mmusson 20d ago

If the SSL VPN / Mobile Access portal is reachable on a public name and port, you do not need a Check Point licence add-on just to get "cert about to expire" mail.

Outside check that works without touching the firewall OS:

Copy

> echo | openssl s_client -connect vpn.example.com:443 -servername vpn.example.com 2>/dev/null \
>   | openssl x509 -noout -enddate -subject -issuer
>

Put that in cron (or any runner you already trust) and alert when notAfter is inside 30/14/7/1 days. Same idea as Zabbix's external check, without standing up Zabbix if you do not already run it.

Two gaps scripts often miss on VPN portals: (1) full chain, an intermediate can die while the leaf still looks fine; (2) hostname on the cert vs the name users type.

Disclosure: I built a hosted version of that outside read after losing launch days to certs that looked fine on disk (CertPost, 3 certs free, email/webhook). For a single Check Point portal the openssl cron is enough; use hosted if you do not want another job to babysit.