topic SSL certificate checker issue: How to see all SSL Certificates in the current search? in Security

SSL certificate checker issue: How to see all SSL Certificates in the current search?

pchintha — Mon, 14 Feb 2022 18:24:23 GMT

Hi please help here

we are using below base search and we need to see all ssl certificates with days left in EST.

index=ssl_certs |rex field=_raw "[^'\n]*'expires=\"(?<expires>[^\\\'\"]+)"| stats c by host expires cert | eval time = strftime( strptime( expires , "%b %d %H:%M:%S %Y %Z" ), "%Y/%m/%d %H:%M:%S %Z")

need exact query for this we tried a lot actually. we are using ssl_checker app for this.

Re: SSL certificate checker issue

isoutamo — Mon, 14 Feb 2022 08:29:47 GMT

Can you post some raw events in code box to helps you?

Re: SSL certificate checker issue

pchintha — Mon, 14 Feb 2022 09:32:21 GMT

Here is the sample events

Re: SSL certificate checker issue

isoutamo — Mon, 14 Feb 2022 11:11:04 GMT

Based on your search response (which is not a raw data) this could helps you.

index=ssl_certs | rex "expires=\"(?<exp>[^\\\]+)\\\n" | eval expTime = strptime(exp, "%b %d %H:%M:%S %Y %Z"), curTime = now() | eval leftTime = tostring(expTime - curTime, "duration") | eval daysLeft = mvindex(split(leftTime, "+"), 0) | table exp expTime curTime left daysLeft

There are other ways to do it.

r. Ismo

Re: SSL certificate checker issue

pchintha — Mon, 14 Feb 2022 11:39:55 GMT

showing no results

Re: SSL certificate checker issue

isoutamo — Mon, 14 Feb 2022 11:43:54 GMT

Works with me with that app. Can you add that _raw data from your query so we can test it with your data?

e.g.

index=ssl_certs sourcetype=ssl_certs | head 10 | table _time _raw

Then add that output inside editors </> (code block) so that it will not changed when you are posting it.

Re: SSL certificate checker issue

pchintha — Mon, 14 Feb 2022 12:22:04 GMT

This helps for me, from in this and expires is in GMT and the expTime is in EST guess so and we need all to know in EST only