http check doesn't map the critical ssl certificate age option

[ghost]

The http check

https://www.icinga.com/docs/icinga2/latest/doc/10-icinga-template-library/#http

doesn't map the optional critical ssl certificate age option and sets it automatically to 0.

E.g. it is not possible to write

http_certificate = [ 40,10 ]

or

http_certificate_warning = 40
http_certificate_critical = 10

or ..?

The check_http command has the optional second option

-C <warn_age>[,<crit_age>]

https://www.monitoring-plugins.org/doc/man/check_http.html

I could provide a patch after I'll get more configuration language knowledge but maybe somebody else has an instant idea how to include it.

[mcktr]

You can set the warning and critical age option through http_certificate, following the syntax http_certificate = "<warn age>,<crit age>" e.g. http_certificate = "30,10".

[ghost]

Thanks.
You're right. That works but is not documented at the moment.

[mcktr]

The http_certificate attribute is documented or did you mean that the documentation should provide an example for this attribute?

[ghost]

The documentation says

_http_certificate Optional.

Minimum number of days a certificate has to be valid. This parameter explicitely sets the port to 443 and ignores the URL if passed._

At least the second optional (critical) option isn't mentioned so I had to check the source code to find out how it could work.

[mcktr]

Got it, thanks for the clarification. :)

Do you mean a simple example is enough like http_certificate = "30,10" or do you think this needs more explanation?

[ghost]

Maybe something like that

Optional. Minimum number of days a certificate has to be valid. First parameter defines warning threshold in days. Optional second parameter defines critical threshold in days. Example 40 or "40, 20".

Of course it could be polished a little bit. ;)