proxy bypass

[antonzhelyazkov]

Hi,

We use check_ssl_cert for monitoring SSL certificates installed on our servers. Some servers are behind CloudFlare.
If we try to get SSL information using DNS name, we receive information for CloudFlare certificate. To get correct information we do a entry in /etc/hosts.

How could we check correct certificate without entry in /etc/host?

[matteocorti]

Hi

Can you try with the --resolve option?

Matteo

[matteocorti]

I have a site on CloudFlare (praxiscorti.ch), with SSL termination on CloudFlare. On the actual host, I just have a self signed certificate:

$ host praxiscorti.ch
praxiscorti.ch has address 104.21.14.233
praxiscorti.ch has address 172.67.160.193
praxiscorti.ch has IPv6 address 2606:4700:3033::ac43:a0c1
praxiscorti.ch has IPv6 address 2606:4700:3034::6815:ee9
praxiscorti.ch mail is handled by 0 praxiscorti-ch.mail.protection.outlook.com.
$ ./check_ssl_cert -H praxiscorti.ch
SSL_CERT OK - x509 certificate 'sni.cloudflaressl.com' (praxiscorti.ch) from 'Cloudflare Inc ECC CA-3' valid until Nov  1 23:59:59 2021 GMT (expires in 136 days)|days_chain_elem1=136;20;15;; days_chain_elem2=1292;20;15;;
$ ./check_ssl_cert -H praxiscorti.ch --resolve REDACTED
SSL_CERT CRITICAL praxiscorti.ch: Cannot verify certificate, self signed certificate|days_chain_elem1=3414;20;15;;
Error(s):
    SSL_CERT CRITICAL praxiscorti.ch: Cannot find Signed Certificate Timestamps (SCT)
    SSL_CERT CRITICAL praxiscorti.ch: Cannot verify certificate, self signed certificate
$ ./check_ssl_cert -H praxiscorti.ch --resolve REDACTED --selfsigned
SSL_CERT OK - x509 self signed certificate 'praxiscorti.ch' from 'praxiscorti.ch' valid until Oct 24 09:35:45 2030 GMT (expires in 3414 days)|days_chain_elem1=3414;20;15;;