Build a Zabbix Agent2 Plugin to Monitor HTTPS Certificate Expiration

Why monitor HTTPS certificate expiration?

Websites that rely on HTTPS need valid certificates; an expired certificate can cause severe service loss, as illustrated by the 2020 NetEase mail outage. Automating expiration monitoring and sending early notifications prevents such incidents.

Solution overview

Use Zabbix Agent2 with a custom Go plugin (https_expire) to fetch the remaining days before a certificate expires. The plugin implements the Exporter interface and can be registered like any built‑in Zabbix plugin.

Plugin development standards

The plugin must:

Import

zabbix.com/pkg/plugin

.

Define a struct embedding

plugin.Base

.

Implement one or more plugin interfaces (Export, Configure, Validate, etc.).

<code>import "zabbix.com/pkg/plugin"

type Plugin struct {
    plugin.Base
}

var impl Plugin
</code>

Export function example:

<code>func (p *Plugin) Export(key string, params []string, ctx plugin.ContextProvider) (interface{}, error) {
    if err := checkParamnums(params); err != nil {
        return nil, err
    }
    url, err := checkParams(params)
    if err != nil {
        return nil, err
    }
    body, err := p.client.Query(url)
    if err != nil {
        return nil, err
    }
    return body, nil
}
</code>

Downloading and compiling Zabbix Agent2 with the plugin

<code>yum install golang
git clone https://git.zabbix.com/scm/zbx/zabbix.git --depth 1 zabbix-agent2
cd zabbix-agent2
git submodule add https://github.com/cxf210/ssl_expire.git src/go/plugins/https_expire
</code>

Register the plugin in

src/go/plugins/plugins_linux.go

by adding the line:

<code>_ "zabbix.com/plugins/https_expire"
</code>

Compile and install:

<code>yum install automake autoconf pcre* -y
./bootstrap.sh
pushd .
cd src/go/
go mod vendor
popd
./configure --enable-agent2 --enable-static
make install
</code>

Configure the agent

<code># Example excerpt from zabbix_agent2.conf
LogType=console
LogFile=/tmp/zabbix_agent2.log
DebugLevel=4
Server=172.17.0.5
Plugins.Https_expire.Timeout=5
Hostname=node2
ControlSocket=/tmp/agent.sock
</code>

Run the agent

<code>cd /root/zabbix_agent/src/go/bin
zabbix_agent2 -c conf/zabbix_agent2.conf
</code>

Create a monitoring item in Zabbix

Use the key

https_expire["www.example.com"]

or

https_expire["https://www.example.com"]

to retrieve the number of days until expiration.

<code>https_expire["www.xyzabbix.cn"]
</code>

After adding the item, the UI will display the remaining days (e.g., 40 days on 2021‑03‑07). You can then create a trigger to send an alert when the remaining time falls below a threshold (e.g., 30 days).

Images