Labels contains illegal characters. See similar issue here:
sensu/sensu-processes-check#5 (comment)

It can contain * and .

Bootstrap a Golang replacement for the community developed sensu-plugins/sensu-plugins-ssl project, with support for reading certificate data from an endpoint (e.g. HTTP) or directly from a file.

Initial goals for this integration are to validate x.509 certificates only, and not SSL/TLS protocol server implementations (e.g. which protocols and ciphers does a server support) which is out of scope at this time. For reference as to how broad that scope can become, please see: https://github.com/drwetter/testssl.sh (download and run ./testssl.sh --quiet sensu.io).

References

• sensu-plugins/sensu-plugins-ssl (MIT License)
• Telegraf x509cert input plugin (MIT License)
• Prometheus blackbox_exporter tls module (Apache License 2.0) (MIT License)
• Datadog SSL tests (user documentation)
• Datadog TLS integration

Configuration

• --host host to check (e.g. sensu.io)
• --port port to check (e.g. 443)
• --pem-file path to local .pem file (e.g. /opt/app/cert/certificate.pem)

Configuration Validation

• Check --host and --port are configured -OR- --pem-file is configured

Metrics

All metrics should be output in Prometheus format.

• cert_days_left gauge-style metric measuring the number of days until certificate expiry as a float. Expired certificates should produce a negative number.
• cert_seconds_left gauge-style metric measuring the number of seconds until certificate expiry, as a int. Expired certificates should produce a negative number.
• cert_issued_days counter-style metric measuring the total number of days the certificate is issued for, as a float.
• cert_issued_seconds counter-style metric measuring the total number of seconds the certificate is issued for, as a int.

Metric Tags

• None

Health Checks

• n/a (pending support for built-in output_metric_thresholds support in the Sensu Go agent.

Catalog Templates

• TBD

TODO

TBD:

• TBD what protocols are supported? Should this work with any TCP endpoint, or HTTP only? Note that Datadog TLS integration only supports TCP, whereas the Telegraf integration supports TCP, UDP, HTTP, and PEM files.
• Should this plugin support checking of local certificate files (since the agent is already running on the host)? Yes
• Are other certificates other than x509 supported? No

Out of scope:

• Create an issue to add support for checking SANs (Subject Alternate Names)
• Create an issue to report TLS protocol version information as a metric, for use w/ output_metric_thresholds
• Create an issue to add support for reading PKCS#12 certificate files (including password)
• Create an issue to add support for mTLS