How to monitor HTTPS certificate expiry with Nagios Core

A website can keep answering requests while its TLS certificate is close to the Not After date that will make clients reject the connection. Adding a dedicated Nagios Core service check gives certificate renewal its own warning and critical states instead of hiding it inside a general HTTPS availability check.

The check_http plugin can run in certificate mode with -C. In that mode it connects to the TLS listener, reads the served certificate, and returns OK, WARNING, or CRITICAL from the remaining day count. Test the installed plugin before changing command definitions because certificate-mode options can vary between packaged plugin builds.

The sample object uses the Ubuntu and Debian package layout with /usr/lib/nagios/plugins, /etc/nagios4/conf.d, and the nagios4 service. check_http -C is an expiry check, not a full certificate trust audit, so pair it with a separate chain or hostname-coverage review when the renewal handoff needs evidence beyond the number of days remaining.

1. Run the certificate check as the nagios user from the Nagios server.

   $ sudo -u nagios /usr/lib/nagios/plugins/check_http \
       -H www.example.net \
       -p 443 \
       --sni \
       -C 30,14
   OK - Certificate 'www.example.net' will expire on Sat Sep 19 00:51:00 2026 +0000.

   -H names the HTTPS host, and --sni sends that name during TLS negotiation. Add -I only when the TCP address differs from the certificate hostname.

   Related: How to run a Nagios plugin manually

2. Test the warning threshold with a temporary value higher than the remaining lifetime reported by the first check.

   $ sudo -u nagios /usr/lib/nagios/plugins/check_http \
       -H www.example.net \
       -p 443 \
       --sni \
       -C 120,60
   WARNING - Certificate 'www.example.net' expires in 88 day(s) (Sat Sep 19 00:51:00 2026 +0000).

   The first value after -C is the warning threshold in days.

3. Test the critical threshold with a temporary critical value higher than the remaining lifetime reported by the first check.

   $ sudo -u nagios /usr/lib/nagios/plugins/check_http \
       -H www.example.net \
       -p 443 \
       --sni \
       -C 120,100
   CRITICAL - Certificate 'www.example.net' expires in 88 day(s) (Sat Sep 19 00:51:00 2026 +0000).

   The second value after the comma is the critical threshold in days. Return to production thresholds before saving the service object.

4. Create a Nagios object file for the HTTPS certificate check.

   $ sudoedit /etc/nagios4/conf.d/https-certificate-monitor.cfg

   Use an existing host object when web01.example.net is already defined, or create the host first before adding the service.
   Related: How to add a host in Nagios Core

5. Add the host, command, and service objects.

   define host {
       use                     linux-server
       host_name               web01.example.net
       alias                   Public website
       address                 www.example.net
   }
    
   define command {
       command_name            check_https_certificate
       command_line            $USER1$/check_http -H $HOSTADDRESS$ -p $ARG1$ --sni -C $ARG2$,$ARG3$
   }
    
   define service {
       use                     generic-service
       host_name               web01.example.net
       service_description     HTTPS Certificate
       check_command           check_https_certificate!443!30!14
       check_interval          720
       retry_interval          60
       max_check_attempts      2
       notification_interval   720
   }

   With the default interval_length of 60 seconds, check_interval 720 checks every 12 hours. $USER1$ is the standard plugin-directory macro on Nagios Core installs. Adjust the interval and notification timing to match the renewal policy for the site.

6. Validate the Nagios configuration before reloading the service.

   $ sudo nagios4 -v /etc/nagios4/nagios.cfg
   Nagios Core 4.4.6
   ##### snipped #####
   Total Warnings: 0
   Total Errors:   0
   
   Things look okay - No serious problems were detected during the pre-flight check

   Related: How to validate the Nagios Core configuration

7. Reload the nagios4 service to apply the new object file.

   $ sudo systemctl reload nagios4

   Related: How to manage the Nagios Core system service

8. Confirm that the nagios4 service stayed active after the reload.

   $ sudo systemctl is-active nagios4
   active

   Related: How to manage the Nagios Core system service

9. Run the production threshold command again as a final smoke test.

   $ sudo -u nagios /usr/lib/nagios/plugins/check_http \
       -H www.example.net \
       -p 443 \
       --sni \
       -C 30,14
   OK - Certificate 'www.example.net' will expire on Sat Sep 19 00:51:00 2026 +0000.

   If the web UI still shows Pending for HTTPS Certificate, force a service check or wait for the next scheduled interval.
   Related: How to reschedule an active check in Nagios Core