What centralized tools do you use for updating and monitoring the status of certificates on end devices?

For centralized management and monitoring of certificates, I use the following tools:

1. HashiCorp Vault:
   • Secrets Engine pki. Allows issuing and revoking certificates via API. Integrates with Ansible, Terraform, Kubernetes.
   • Used for automatic creation and renewal of certificates for services (TLS, mTLS).
2. Cert-Manager (for Kubernetes):
   • Native integration with Kubernetes for automatic issuance of certificates from various Issuers (Let's Encrypt, Vault, internal CAs).
   • Certificate status monitoring is done through metrics certmanager_certificate_expiration_timestamp_seconds, exposed for Prometheus.
3. OpenSSL + custom scripts:
   • For inventory of existing certificates on servers.
   • Scripts gather data on expiration date (openssl x509 -noout -enddate -in certificate.pem), issuer information, and Subject.
   • Results are aggregated into a centralized system (e.g., Prometheus, Grafana).

   #!/bin/bash
   
   CERT_FILE=$1
   
   if [ -f "$CERT_FILE" ]; then
       # Get expiration date in YYYY-MM-DD HH:MM:SS format
       END_DATE=$(openssl x509 -noout -enddate -in $CERT_FILE 2>/dev/null | cut -d= -f2)
       # Convert to Unix timestamp
       END_TIMESTAMP=$(date -d "$END_DATE" +%s 2>/dev/null)
   
       if [ -n "$END_TIMESTAMP" ]; then
           echo "$END_TIMESTAMP"
       else
           echo "Error parsing end date." 2>&1
           exit 1
       fi
   else
       echo "Certificate file not found: $CERT_FILE" 2>&1
       exit 1
   fi
   

4. Prometheus + Grafana:
   • Prometheus collects metrics about certificate expiration (e.g., via Node Exporter, external checkers, cert-manager metrics).
   • I set up alerts in Alertmanager for impending certificate expiration.
   • Grafana is used for visualizing certificate status and creating dashboards with their expiration dates.
5. Monitoring external services:
   • I use Blackbox Exporter to monitor service availability over HTTPS and validate certificates externally.

   modules:
     http_2xx:
       prober: http
       timeout: 5s
       http:
         preferred_ip_protocol: "ipv4"
         tls_config:
           insecure_skip_verify: false # Check certificate validity
   

The process looks like this:

• Issuance: Automated via Vault or Cert-Manager.
• Inventory/Data collection: Scripts or built-in exporter mechanisms gather metrics.
• Aggregation/Monitoring: Prometheus collects metrics, Alertmanager notifies about upcoming expiration.
• Visualization: Grafana displays the status of all certificates.
• Renewal: Automatic (Cert-Manager) or semi-automatic (via Ansible/Terraform with Vault).

This is a centralized approach that provides full visibility into the status of certificates on all controlled endpoints and services, minimizing downtime due to expired certificates.