topic Re: Does _internal report the expiration date of the certificate? in Splunk Enterprise

Does _internal report the expiration date of the certificate?

danielbb — Wed, 13 Aug 2025 16:38:28 GMT

We are in the process of updating the certificates and we go manually to check each one via the browser whether the certificate truly expires next year, is this information in _internal, by any chance?

Re: Does _internal report the expiration date of the certificate?

sainag_splunk — Wed, 13 Aug 2025 20:28:41 GMT

@danielbb No, _internal does not proactively report certificate expiration dates. It only logs SSL errors after certificates have already expired, which is too late for proactive monitoring.

What _internal shows:

index=_internal sourcetype=splunkd component=TcpInputProc log_level=ERROR "SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired"

This only appears after the cert has expired.

For On-Prem: may be create a scripted input to check certificate expiration and monitor?

#!/bin/bash

# Script to check cert expiration

openssl x509 -enddate -noout -in /path/to/cert.pem

If this Helps, Please Upvote

Re: Does _internal report the expiration date of the certificate?

MuS — Wed, 13 Aug 2025 20:32:12 GMT

Hi there,

Short answer is no, but you could create a scripted input using this command https://community.splunk.com/t5/Security/Check-HTTPS-certifciates/m-p/145539/highlight/true#M4466 and get this indexed into _internal

Hope this helps ...

Cheers, MuS

Re: Does _internal report the expiration date of the certificate?

PickleRick — Wed, 13 Aug 2025 21:04:23 GMT

Yup. It is possible by means of scripted input. I did something like that once. Two versions - one in PS to handle windows machines, another to list certs on unices. If your certs are in static places, that should be relatively easy. The problem starts when you want to list all certs Splunk uses in its configs and get info from all of them - it requires more scripting.

Re: Does _internal report the expiration date of the certificate?

PrewinThomas — Thu, 14 Aug 2025 04:33:17 GMT

@danielbb

No, Splunk _internal does not proactively log certificate expiration details.

As others have mentioned, you can use a scripted input or third-party add-on, which is easy to configure and can help you proactively monitor and manage SSL certificate renewals.

Add-on - #https://splunkbase.splunk.com/app/6475

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Does _internal report the expiration date of the certificate?

PickleRick — Thu, 14 Aug 2025 06:19:14 GMT

This addon is a bit different. As I understand it from the description, it doesn't check Splunk's own certs, but connects to a given endpoint on the network and checks the cert presented there. It's kinda like check_ssl in Nagios.