How to view expired server certificates in the Splunk App for Enterprise Security 3.3?

[eljaybee]

I'm trying to view my server certificates via the Splunk Enterprise Security App 3.3. I asked to set it up in the app to monitor the expiration of certs. I have several servers forwarding data via the universal forwarder. How can I accomplish this?

[mdessus_splunk]

You might either index your certificates and add a command to check the expiration date or run a command on the fwd (may be with openssl) that will check once a day (for ex.) what is your certificate expiration date.

You might also have a look to the dashboard SSL Activity (in Protocol intelligence), to look what is done there, but the source is the SSL flows collected by Stream.

Does it makes sense ?