amimof / node-cert-exporter

An SSL certificate Prometheus exporter
Apache License 2.0
172 stars 34 forks source link

[Feature Request] Please add Serial as a label #71

Closed costasd closed 1 year ago

costasd commented 1 year ago

Hello maintainers!

right now, exporter emits the following attributes as labels for every certificate:

        labels := prometheus.Labels{
            "path":            path,
            "issuer":          cert.Issuer.String(),
            "alg":             cert.SignatureAlgorithm.String(),
            "version":         strconv.Itoa(cert.Version),
            "subject":         cert.Subject.String(),
            "dns_names":       strings.Join(cert.DNSNames, ","),
            "email_addresses": strings.Join(cert.EmailAddresses, ","),
            "hostname":        hostname,
            "nodename":        nodename,
        }

during certificate renewals, any of these attributes might remain the same - a valid scenario could be for example that we're utilizing the same issuer company to renew an existing certificate with the same email and DNS names.

I propose serial to be added to the list of emitted labels, as serial is expected to be different for every certificate issued by the same CA. This could help with scenarios such as confirming that certificates changed on disk after a renewal and their deployment.

Description A PR that would add serial as a label and its value through the cert attributes parse by crypto/x509.

Additional information Out of RFC5280:

4.1.2.2.  Serial Number

   The serial number MUST be a positive integer assigned by the CA to
   each certificate.  It MUST be unique for each certificate issued by a
   given CA (i.e., the issuer name and serial number identify a unique
   certificate).  CAs MUST force the serialNumber to be a non-negative
   integer.