Build a Zabbix Agent2 Plugin to Monitor HTTPS Certificate Expiration

Why monitor HTTPS certificate expiration?

Websites that rely on HTTPS need valid certificates; an expired certificate can cause severe service loss, as illustrated by the 2020 NetEase mail outage. Automating expiration monitoring and sending early notifications prevents such incidents.

Solution overview

Use Zabbix Agent2 with a custom Go plugin (https_expire) to fetch the remaining days before a certificate expires. The plugin implements the Exporter interface and can be registered like any built‑in Zabbix plugin.

Plugin development standards

The plugin must:

Import zabbix.com/pkg/plugin.

Define a struct embedding plugin.Base.

Implement one or more plugin interfaces (Export, Configure, Validate, etc.).

import "zabbix.com/pkg/plugin"

type Plugin struct {
    plugin.Base
}

var impl Plugin

Export function example:

func (p *Plugin) Export(key string, params []string, ctx plugin.ContextProvider) (interface{}, error) {
    if err := checkParamnums(params); err != nil {
        return nil, err
    }
    url, err := checkParams(params)
    if err != nil {
        return nil, err
    }
    body, err := p.client.Query(url)
    if err != nil {
        return nil, err
    }
    return body, nil
}

Downloading and compiling Zabbix Agent2 with the plugin

yum install golang
git clone https://git.zabbix.com/scm/zbx/zabbix.git --depth 1 zabbix-agent2
cd zabbix-agent2
git submodule add https://github.com/cxf210/ssl_expire.git src/go/plugins/https_expire

Register the plugin in src/go/plugins/plugins_linux.go by adding the line:

_ "zabbix.com/plugins/https_expire"

Compile and install:

yum install automake autoconf pcre* -y
./bootstrap.sh
pushd .
cd src/go/
go mod vendor
popd
./configure --enable-agent2 --enable-static
make install

Configure the agent

# Example excerpt from zabbix_agent2.conf
LogType=console
LogFile=/tmp/zabbix_agent2.log
DebugLevel=4
Server=172.17.0.5
Plugins.Https_expire.Timeout=5
Hostname=node2
ControlSocket=/tmp/agent.sock

Run the agent

cd /root/zabbix_agent/src/go/bin
zabbix_agent2 -c conf/zabbix_agent2.conf

Create a monitoring item in Zabbix

Use the key https_expire["www.example.com"] or https_expire["https://www.example.com"] to retrieve the number of days until expiration.

https_expire["www.xyzabbix.cn"]

After adding the item, the UI will display the remaining days (e.g., 40 days on 2021‑03‑07). You can then create a trigger to send an alert when the remaining time falls below a threshold (e.g., 30 days).

Images