TLS certificate expiry and HSTS
104-certificate-expiry-and-hsts.yaml
HTTP(S)
What this example does
This example demonstrates tls certificate expiry and hsts.
Checks and behavior
- Sends an GET request to https://www.example.com/.
- Checks allowed/denied HTTP status codes.
- Validates required, forbidden or matching HTTP headers.
- Validates redirect behavior and destination constraints.
- TLS settings cover certificate trust, certificate expiry.
- Formats results for nagios output.
Adapt example domains, addresses, credentials and thresholds to your environment before use.
YAML configuration
# Copyright (c) 2026 mati peterson. Maintainer: mati peterson <ipsonic@mailbox.org>. Project: https://ipsonic.com/probe/. Disclaimer: Provided AS IS, without warranty of any kind. Use at your own risk; validate checks and configurations before production use.
# SecOps TLS hygiene: trust, remaining validity, HTTPS redirect, HSTS.
name: "TLS certificate expiry and HSTS"
url: "https://www.example.com/"
request: {method: GET, follow_redirects: true}
timeouts: {connect: 3, response: 10}
tls: {verify: true, min_valid_days: 30}
tests:
status: {allow: [200]}
redirects:
require_https: true
max_count: 3
allowed_hosts: [www.example.com, example.com]
security: {hsts_min_age: 31536000}
headers:
exists: [Strict-Transport-Security]
monitoring:
service_name: "TLS Expiry and HSTS"
output: nagios
on_failure: critical