# Is there a way to monitor expired certificates from a keystore

**URL:** <https://discuss.prometheus.io/t/is-there-a-way-to-monitor-expired-certificates-from-a-keystore/899>\
**Category:** General Help/Support\
**Created:** [April 13, 2022, 9:39am UTC](https://discuss.prometheus.io/t/is-there-a-way-to-monitor-expired-certificates-from-a-keystore/899 "2022-04-13T09:39:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ralus67](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@ralus67](https://discuss.prometheus.io/u/ralus67)\
**Post date:** [April 13, 2022, 9:39am UTC](https://discuss.prometheus.io/t/is-there-a-way-to-monitor-expired-certificates-from-a-keystore/899/1 "2022-04-13T09:39:57Z")

</div>

Hello community

I would like to monitor keystores as example cacert or osp.jks  
With keytool i could export and write the certificate informations from an expiring certificate into a file.  
Now I would like to pass these information to prometheus.

Does exist a keystore exporter or has someone an idea how I could solve it?

Thanks in advance for your help.  
Ramon

---

<div class="post-metadata">

**Author:** ![SuperQ](https://dub1.discourse-cdn.com/flex017/user_avatar/discuss.prometheus.io/superq/32/4_2.png) [@SuperQ](https://discuss.prometheus.io/u/SuperQ)\
**Post date:** [April 18, 2022, 9:03am UTC](https://discuss.prometheus.io/t/is-there-a-way-to-monitor-expired-certificates-from-a-keystore/899/2 "2022-04-18T09:03:19Z")

</div>

Typially you would export certificate expiry as the unix timestamp gauge. This is similar to metrics like [`process_start_time_seconds`](https://prometheus.demo.do.prometheus.io/graph?g0.expr=process_start_time_seconds&g0.tab=1&g0.stacked=0&g0.range_input=1h)

```auto
process_start_time_seconds{instance="foo:9090",job="prometheus"} 1649251947.81

```

This is also how the [`blackbox_exporter`](https://github.com/prometheus/blackbox_exporter) exposes certificate expiry for https sites.

---

<div class="post-metadata">

**Author:** ![ralus67](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@ralus67](https://discuss.prometheus.io/u/ralus67)\
**Post date:** [April 18, 2022, 1:21pm UTC](https://discuss.prometheus.io/t/is-there-a-way-to-monitor-expired-certificates-from-a-keystore/899/3 "2022-04-18T13:21:48Z")

</div>

Hi SuperQ

How can I export from a keystore a specific certificate in unix timestamp?

I tried it with a script such this…

#!/bin/sh

keystore=`/opt/common/jre/bin/keytool -list -v -keystore /opt/osp/osp.jks -storepass changeit > /import/swdepot/tmp/tmp_$(hostname).txt`  
echo -n "probe\_ssl\_earliest\_cert\_expiry "\>/import/tmp/cert\_expiration\_$(hostname).prom;cat tmp\_$(hostname).txt | grep “Alias name: osp” --after=8 | grep -e “Alias name: osp” -e until | sed “s/until:\ /\n/g” | tail -n 1 \>\>/import/swdepot/tmp/cert\_expiration\_$(hostname).prom

The content of the osp.jks file looks like this:

Keystore type: PKCS12  
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: osp  
Creation date: Apr 14, 2020  
Entry type: PrivateKeyEntry  
Certificate chain length: 1  
Certificate[1]:  
Owner: CN=192.168.88.70  
Issuer: CN=192.168.88.70  
Serial number: 2ff28f2b  
Valid from: Tue Apr 14 14:16:43 CEST 2020 until: Thu Apr 14 14:16:43 CEST 2022

My Idea was to grabb this information, but prometheus shoud be able to handle it.  
Apr 14 14:16:43 CEST 2022

Another question is, how to convert this infors into an unix timestamp?