topic Re: SSL Certification expiration checks out of the box - Details? in Extensions

Use Dynatrace Built‑In SSL Certificate Expiration Checks

larry_roberts — Fri, 23 Jan 2026 10:27:41 GMT

Summary: This post explains how Dynatrace automatically detects SSL certificate expiration for monitored endpoints. It outlines what is checked, how expiration data is shown, and how alerts can be configured.

During Perform 2020, I believe it was stated that certificate expiration checks were in the works in terms of out of the box for Dynatrace, if I heard it correctly. I believe it was just briefly mentioned without much detail.

We are actively moving more and more to GCP and would like to have such checks.

I know there is currently a plugin out there on GitHub by Julius Loman (thank you Julius!) to do such checks, however I have not yet tried it. Curious if because this is a plugin, if it consumes custom metrics? I am also not sure if this plugin will work in a GCP environment.

Before I do try the plugin approach, I was wondering if I am recalling that above information correctly?

If so, is there a timeline or more in depth details that will be coming soon around this functionality?

Thanks!

Re: SSL Certification expiration checks out of the box - Details?

Julius_Loman — Thu, 27 Feb 2020 18:49:39 GMT

Just my "two cents" about my plugin - it does not consume any metrics, so it's free also from Dynatrace license consumption. It only pushes events and metadata to processes.

At the moment it only verifies certificates on TCP ports on the host where OneAgent is running. I'll extend it to cover also client-side keystores for certificates (jks at this time, probably also pfx/p12 in the future).

I'm not aware of any plans of Dynatrace having the check functionality built-in.

Re: SSL Certification expiration checks out of the box - Details?

larry_roberts — Thu, 27 Feb 2020 22:03:27 GMT

Thanks Julius! Appreciate the work on a plugin around this as well. I am 99% sure I heard something at Perform on stage specific to certificates expiring. Maybe I was hearing things which is very possible! lol.

Re: SSL Certification expiration checks out of the box - Details?

Julius_Loman — Fri, 28 Feb 2020 07:16:24 GMT

Could be. Maybe @Jakub M. may bring some answers.

Re: SSL Certification expiration checks out of the box - Details?

leon_vanzyl — Thu, 23 Mar 2023 10:33:15 GMT

We have created an AG Plugin that checks Certs: https://github.com/mediro-ict/activegate_python_ssl_plugin

NOTE: the latest version uses metrics and therefore consumes DDUs.

Re: SSL Certification expiration checks out of the box - Details?

larry_roberts — Thu, 12 Mar 2020 15:14:47 GMT

Good stuff @Leon Van Z. ! I will check that out. It might be exactly what we are looking for and save me some work at the same time 😉

Thank you!

Re: SSL Certification expiration checks out of the box - Details?

leon_vanzyl — Thu, 12 Mar 2020 15:58:37 GMT

shot Larry!, let me know how We can improve it

Re: SSL Certification expiration checks out of the box - Details?

andrew_franklor — Mon, 23 Mar 2020 18:25:26 GMT

Julius - I love your approach of OneAgent plugin monitoring. I have webservers with 20+ IPs all apache instances listening to 443. GitHub readme lists the limitation: "Opened TCP port bindings are retrieved from OneAgent and only local TCP ports are checked. Listening IP address is provided by OneAgent. Currently OneAgent supplies 127.0.0.1 as the listening IP address regardless of the actual TCP port binding."

Does this mean that the plugin knows what process owns a port, and will show the right cert on the process group, but may show 127.0.0.1 as the IP? Or do you mean that for boxes with multiple IPs and processes binding to 1 IP, the plugin can not tell process has the port?

Re: SSL Certification expiration checks out of the box - Details?

Julius_Loman — Mon, 23 Mar 2020 20:12:09 GMT

Actually.. it only shows 127.0.0.1 if the listening address is 0.0.0.0 (all interfaces). But if your service is listening on a particular IP, it will show the IP and the port.

So basically it looks like this:

This listening port information is provided by OneAgent.

Re: SSL Certification expiration checks out of the box - Details?

andrew_franklor — Tue, 24 Mar 2020 13:14:26 GMT

Thanks for quick response, that looks great! We will give this a try, thanks for sharing!

Re: SSL Certification expiration checks out of the box - Details?

larry_roberts — Wed, 01 Apr 2020 14:47:18 GMT

Going to be at long last trying this out today. I will let you know the results.

Re: SSL Certification expiration checks out of the box - Details?

leon_vanzyl — Wed, 01 Apr 2020 14:49:49 GMT

cool, let me know

Re: SSL Certification expiration checks out of the box - Details?

larry_roberts — Wed, 01 Apr 2020 14:49:50 GMT

Going to be giving this one a try along with the one provided by @Leon Van Z. as well today and through tomorrow. Excited to see what both can do. Both of your contributions are VERY MUCH APPRECIATED!

Re: SSL Certification expiration checks out of the box - Details?

alexandre_marl2 — Sat, 04 Apr 2020 15:22:26 GMT

It would be nice to have it out of the box !

Others competitor have it.

Re: SSL Certification expiration checks out of the box - Details?

larry_roberts — Mon, 06 Apr 2020 11:25:08 GMT

I completely agree.

Re: SSL Certification expiration checks out of the box - Details?

irakli_natsvlis — Wed, 03 Jun 2020 06:50:40 GMT

Hello everyone,

Do I understand correctly that plugins developed by @Julius L. @Leon Van Z. require deployment on both AGs and the host where OneAgent is installed and they can't be deployed on ActiveGates only?

Thanks

Re: SSL Certification expiration checks out of the box - Details?

MaciejNeumann — Thu, 29 Jul 2021 11:50:19 GMT

SSL certification expiration date verification is now available with HTTP monitors:

Re: SSL Certification expiration checks out of the box - Details?

kedesai — Tue, 08 Mar 2022 20:53:30 GMT

Hi Julius,

Is there a way to check for the keystores expiry dates? Can we filter which certs we want to monitor?

Thanks,

Ketan

Re: SSL Certification expiration checks out of the box - Details?

Julius_Loman — Wed, 09 Mar 2022 07:44:20 GMT

Hi @kedesai ,
I've been thinking about adding the possibility to monitor keystores, but I gave up. Unfortunately, it's not that easy to do it using Dynatrace OneAgent extension, because

extensions run as unprivileged users, so there will be issues with accessing the keystore file which is typically owned by some application user
many keystore types (JKS/CMS), require a JVM or a specific JVM (IBM JVM) to open them.
you would need to configure the paths to the keystores anyway

I've decided not to implement this functionality.

Re: SSL Certification expiration checks out of the box - Details?

kedesai — Thu, 10 Mar 2022 21:43:29 GMT

Hi Julius,

Thanks for your quick reply. How are you able to monitor the cert on google.com. Per the process, we have to put the zip in two locations. one is in the:
2.) Upload the zip file to your Dynatrace tenant in Settings > Monitoring > Monitored technologies > Custom plugins and choose Upload plugin.

The other one goes to the location in the plugin_deployment directory on the host.

3.) Unzip the zip file on OneAgents into /opt/dynatrace/oneagent/plugin_deployment directory on hosts with OneAgents or to appropriate plug_deployment directory if you have installed the agent into the non-default directory.

I have a specific case where I need to get an SSL cert expiry from a website but I am not able to get it. For example adt.com. I don't have access to VM :).

Thanks again,

Ketan