Hi,

A number of Nagios plugins include useful functionality when connecting over
SSL: they check if the certificate is still valid and report a warning or
error when it (soon) expires.

I end up enabling this functionality in my configurations each time because
it's not enabled by default. I haven't yet found a reason why it shouldn't
be enabled.

Attached is a patch that in the shipped configuration enables this useful
extra check.


cheers,
Thijs

HI Thijs,

as I can understand, that this would be a usefull addition, I think we have a
couple of disadvantages.

* users which uses a certificate and don't care if its valid/expired (just
want to encrypt the payload) maybe get nerved
* what ever we choose as days until the cert expires ... users may edit this
anyways, as they want to set different values

Adding more check seems also not an option, as we have so huge checks for
stuff, but we can't provide command definitions for everything.

With kind regards, Jan.

Hi Jan,

In both situations, current and proposed, a group of people will want to opt
to change it. My proposal is to change the default, not to force the checks
upon them. In my view default on is better than default off in this case,
because I presume that people using SSL in general *are* interested in having
valid certificates (why are they using SSL then), and people explicitly
wanting to turn it off are a relatively small group.

That's true, but I think that people would prefer to be warned at a moment
they'd rather finetune to a somewhat different moment, over not being warned
at all.

Enabling it by default generates less work for most administrators, and
proactively prevents service outage for those administrators that did not
know about that check previously or forgot to set it.

I agree with you on this one.


cheers,
Thijs

Hi Thijs,

which default? If you don't want to change the check commands, what else?
Looking into your patch indicates you want to change the check commands.

Maybe thats you POV, but I know a lot of people who just want to have the
transport layer encrypted and they don't care (much) about the certificate
itself when using SSL.

Forcing the people to edit the default check (files) leads them into the
problem to migrate all changes in the config files provided by the package.
This is really annoying, even more if it is caused by a change by package
maintainers, which is forcing them into this step.

As argued above, this may be the case in your environment and I understand
your problem, but actually I think the disadvantages for the most of the users
is much bigger.
If we can find a solution, which doesn't force (potential most of) the users
to change the default checks, it will be fine. Actual I don't have such a
solution in mind unfortunately.

I think I will tag this bug "wontfix", so it is visible to others ... if
anybody comes up with a good solution and/or there will be a reply flood from
others which also want to have validity checks enabled by default, we have to
look into it again.

With kind regards, Jan.

OK.