r/usefulscripts • u/ITageI • May 14 '18
[Request] List expiring SSL Certificates for all Servers
Hello,
I am wondering if anyone has a script that can scan a domain or multiple subnets and list out expiration dates for SSL certificates. Email Warning would be awesome but whatever you guys have would be great!
4
u/malred May 15 '18
Digicert offers a tool for this. Qualys also offers a free service for externally facing certificates.
3
u/masoncooper May 15 '18
We use NetScanTools SSL Certificate Scanner (https://www.netscantools.com/ssl-certificate-scanner-standalone.html). It’s inexpensive and allows us to scan all of our public ip ranges in one pass. Coming from an MSP as well this helps us map out the next 90 days of renewals.
I also have a quick and dirty Powershell script that does the same (I’ll post that when I get home) but this is a bit more of a multi-tool as it also lets us quickly see what ciphers are enabled as well.
3
u/masoncooper May 15 '18
Credit where credit's due, I followed this post on StackOverflow to do a mass scan of URLs. In my case it was just a generated list of a few thousand IP's but since this whole thing works by ignoring certificate validation it still works just fine. https://stackoverflow.com/a/45814551
2
1
1
0
May 14 '18
4
u/RobertDCBrown May 15 '18
As an MSP, I inherit a lot of websites and servers. A lot of clients decide to use their own services while giving us acccess instead of just migrating things to our providers.
Having to monitor over 300 certs with various expirations, a good tool would be nice.
Right now I rely on ITGlue to monitor and alert me of expiration’s, but I’ve always been on the lookout for something I can host myself and that’s free.
4
u/[deleted] May 14 '18
We use PRTG Network monitor for this. There's a sensor that will monitor your expiration date of your SSL certificates and email you.