[Heartbeat] Check certificates for browser based Synthetic monitors (all hosts)

paulb-elastic commented 3 years ago

Existing TLS certificate checks for Heartbeat monitors are useful to give an early warning that certificates are going to expire (and give users the time to renew them before they expire which may well impact the availability of the site).

These are not currently available for browser based Synthetics monitors, but the requirement and value that certificate checks provides, is just as valuable for these monitors (arguably more so as more hosts and content are included in Synthetic monitors, with a wider number of hosts needed to deliver it to make up the website).

Use case

As a browser based Synthetic monitoring customer
I want to be able to check the status of all TLS certificates for hosts accessed from a Synthetics user journey (browser) run
So I get visibility and early warning of any hosts that have an expiring certificate

This is an enhancement to the initial root URL host certificates check covered in this issue.

Feature:

Configuration option to declare that all certificates should be checked (in addition to the root URL host, which will always be checked)
When configured, all secure (HTTPS) hosts will have the TLS certificate checked
Details of the certificate will be shown on the Certificates status page, the same as other Heartbeat certificate checks
Stretch goal (consider splitting into a separate issue) The ability to configure one of more regex patterns that declare the hosts to perform the certificate check on (this gives the ability to limit which hosts to check, for example if there are unimportant 3rd party hosts for which an invalid certificate does not matter)
Consider if there is any impact, or a requirement to modify certificate alerting

Design: as well as the list of certificates and their status (on the main Certificates status page, we may want to consider an enhanced visualisation of this, such that expiring hosts could be identified more easily, for example on the waterfall chart). This should be addressed with a separate design ticket for Uptime.

elasticmachine commented 3 years ago

Pinging @elastic/uptime (Team:Uptime)

botelastic[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

paulb-elastic commented 2 years ago

This is still on our backlog to do and will still be a useful feature (cert checks is a well used feature in the lightweight checks)

botelastic[bot] commented 1 year ago

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

wolframhaussig commented 1 year ago

:+1:

elastic / beats

[Heartbeat] Check certificates for browser based Synthetic monitors (all hosts) #22327