tyler.durden
/
icinga2
mirror of https://github.com/Icinga/icinga2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[ITL] Added some ignore options for check_ssl_cert (#9512)

This commit is contained in:
Fabian Werner 2022-10-07 13:31:28 +02:00 committed by GitHub
parent 87a4925997
commit e615b297f9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
doc/10-icinga-template-library.md
View File

@ -5788,7 +5788,10 @@ ssl_cert_ssl_version | **Optional.** Force specific SSL version out of
ssl_cert_disable_ssl_versions | **Optional.** Disable specific SSL versions out of {ssl2,ssl3,tls1,tls1_1,tls1_2}. Multiple versions can be given as array.
ssl_cert_cipher | **Optional.** Cipher selection: force {ecdsa,rsa} authentication.
ssl_cert_ignore_expiration | **Optional.** Ignore expiration date.
ssl_cert_ignore_host_cn | **Optional.** Do not complain if the CN does not match.
ssl_cert_ignore_ocsp | **Optional.** Do not check revocation with OCSP.
ssl_cert_ignore_ocsp_errors | **Optional.** Continue if the OCSP status cannot be checked.
ssl_cert_ignore_ocsp_timeout | **Optional.** Ignore OCSP result when timeout occurs while checking.
ssl_cert_ignore_sct | **Optional.** Do not check for signed certificate timestamps.
ssl_cert_ignore_tls_renegotiation | **Optional.** Do not check for renegotiation.

12
itl/plugins-contrib.d/web.conf
View File

@ -554,10 +554,22 @@ object CheckCommand "ssl_cert" {
set_if = "$ssl_cert_ignore_expiration$"
description = "Ignore expiration date"
}
"--ignore-host-cn" = {
set_if = "$ssl_cert_ignore_host_cn$"
description = "Do not complain if the CN does not match"
}
"--ignore-ocsp" = {
set_if = "$ssl_cert_ignore_ocsp$"
description = "Do not check revocation with OCSP"
}
"--ignore-ocsp-errors" = {
set_if = "$ssl_cert_ignore_ocsp_errors$"
description = "Continue if the OCSP status cannot be checked"
}
"--ignore-ocsp-timeout" = {
set_if = "$ssl_cert_ignore_ocsp_timeout$"
description = "Ignore OCSP result when timeout occurs while checking"
}
"--ignore-sct" = {
set_if = "$ssl_cert_ignore_sct$"
description = "Do not check for signed certificate timestamps"