{"id":35550628,"url":"https://github.com/corelan/certmon","last_synced_at":"2026-01-04T07:03:00.032Z","repository":{"id":28730234,"uuid":"32251478","full_name":"corelan/certmon","owner":"corelan","description":"Certificate Expiration Monitor script","archived":false,"fork":false,"pushed_at":"2018-10-10T19:35:17.000Z","size":69,"stargazers_count":27,"open_issues_count":0,"forks_count":13,"subscribers_count":12,"default_branch":"master","last_synced_at":"2023-08-07T10:13:10.527Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/corelan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-03-15T08:38:19.000Z","updated_at":"2023-08-04T18:29:36.000Z","dependencies_parsed_at":"2022-09-05T00:11:11.536Z","dependency_job_id":null,"html_url":"https://github.com/corelan/certmon","commit_stats":null,"previous_names":[],"tags_count":0,"template":null,"template_full_name":null,"purl":"pkg:github/corelan/certmon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corelan%2Fcertmon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corelan%2Fcertmon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corelan%2Fcertmon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corelan%2Fcertmon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corelan","download_url":"https://codeload.github.com/corelan/certmon/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corelan%2Fcertmon/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28199379,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2026-01-04T02:00:06.065Z","response_time":58,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-04T07:01:48.931Z","updated_at":"2026-01-04T07:03:00.024Z","avatar_url":"https://github.com/corelan.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"certmon\n=======\n\ncertmon.py is a simple certificate expiration monitor script.  It will connect to a given server on a given port, dump the certificate, and check if the certificate has expired or not. \n\nAdditionally, it will also report if a certificate is about to expire in x nr of days.  (Default: 30 days).\n\nOn top of that, you can check the contents of certain fields in the certificate \u0026 see if it contains a keyword that should be there (to see if the certificate has been changed).\n\nReports will be sent via email, allowing you to schedule the script to run on regular intervals.\n\nThis script requires Python v3 and has been written/tested on Windows 7.\n(Unless you know how to fix OpenSSL on Mac/Linux, please run this script on Windows only, with administrator privileges)\n\n\nInstallation instructions (Windows 7)\n-------------------------------------\n\nThis script requires Python v3 and some libraries. It has been developed and tested using Python v3.4.3, on Windows 7 SP1, 64bit.\nMost of the required libraries are installed by default,  but others require manual installation.\n(pyOpenSSL, docopt, PySocks) \n\nDownload Python3 from https://www.python.org/downloads and launch the installation package with Administrator privileges.\nPerform a default install 'for all users', install in the default installation folder.\n\nNext, open an Administrator command prompt and run the following commands to install the missing libraries:\n\n**PyOpenSSL:**\n\n```\nc:\ncd\\python34\ncd scripts\npip install pyOpenSSL\n```\n(Make sure the machine has direct access to the internet before running the 'pip' command)\n\nIf all goes well, you should see something like this:\n```\nCollecting pyOpenSSL\n  Downloading pyOpenSSL-0.14.tar.gz (128kB)\n    100% |################################| 131kB 1.4MB/s\nCollecting cryptography\u003e=0.2.1 (from pyOpenSSL)\n  Downloading cryptography-0.8-cp34-none-win32.whl (960kB)\n    100% |################################| 962kB 391kB/s\nCollecting six\u003e=1.5.2 (from pyOpenSSL)\n  Downloading six-1.9.0-py2.py3-none-any.whl\nCollecting pyasn1 (from cryptography\u003e=0.2.1-\u003epyOpenSSL)\n  Downloading pyasn1-0.1.7.tar.gz (68kB)\n    100% |################################| 69kB 723kB/s\nRequirement already satisfied (use --upgrade to upgrade): setuptools in c:\\python34\\lib\\site-packages (from cryptography\n\u003e=0.2.1-\u003epyOpenSSL)\nCollecting cffi\u003e=0.8 (from cryptography\u003e=0.2.1-\u003epyOpenSSL)\n  Downloading cffi-0.9.2-cp34-none-win32.whl (82kB)\n    100% |################################| 86kB 1.6MB/s\nCollecting pycparser (from cffi\u003e=0.8-\u003ecryptography\u003e=0.2.1-\u003epyOpenSSL)\n  Downloading pycparser-2.10.tar.gz (206kB)\n    100% |################################| 208kB 975kB/s\nInstalling collected packages: pycparser, cffi, pyasn1, six, cryptography, pyOpenSSL\n  Running setup.py install for pycparser\n\n  Running setup.py install for pyasn1\n\n\n  Running setup.py install for pyOpenSSL\nSuccessfully installed cffi-0.9.2 cryptography-0.8 pyOpenSSL-0.14 pyasn1-0.1.7 pycparser-2.10 six-1.9.0\n```\n\n**PySocks:**\n\n```\npip install PySocks\n```\nOutput:\n```\nCollecting PySocks\n  Downloading PySocks-1.5.3.tar.gz\nInstalling collected packages: PySocks\n  Running setup.py install for PySocks\nSuccessfully installed PySocks-1.5.3\n```\n\n**docopt:**\n\n```\npip install docopt\n```\nOutput\n```\nCollecting docopt\n  Downloading docopt-0.6.2.tar.gz\nInstalling collected packages: docopt\n  Running setup.py install for docopt\nSuccessfully installed docopt-0.6.2\n```\n\n\nFinally, download the certmon script zip file: https://github.com/corelan/certmon/archive/master.zip and extract it to a folder (e.g. c:\\certmon)\n(or simply clone the repository via git to a local folder)\n\n\nSyntax\n------\n\n```\nC:\\certmon\u003ec:\\python34\\python.exe certmon.py -h\n\n                     __\n  ____  ____________/  |_  _____   ____   ____\n_/ ___\\/ __ \\_  __ \\   __\\/     \\ /  _ \\ /    \\\n\\  \\__\\  ___/|  | \\/|  | |  Y Y  (  \u003c_\u003e )   |  \\\n \\___  \u003e___  \u003e__|   |__| |__|_|  /\\____/|___|  /\n     \\/    \\/                  \\/            \\/\n\n              corelanc0d3r - www.corelan.be\n              https://github.com/corelan/certmon\n\ncertmon - Monitor TLS Certificates\n\nUsage:\n    certmon.py [-v] [--tor] [-c=\u003ccertconfigfile\u003e] [-s=\u003csmtpconfigfile\u003e] [-w=\u003cnr\u003e]\n    certmon.py (-h | --help)\n    certmon.py --test-mail\n\nOptions:\n    -h --help               Show this help screen.\n    -c=\u003ccertconfigfile\u003e     Full path to cert config file [default: certmon.conf].\n    -s=\u003csmtpconfigfile\u003e     Full path to smtp config file [default: certmon_smtp.conf].\n    -w=\u003cnr\u003e                 Warn of upcoming expiration nr of days in advance [default: 30].\n    --test-mail             Test e-mail configuration.\n    -v                      Show verbose information about the certificates.\n    --tor                   Make certificate requests via default tor socks proxy localhost 9050.\n```\n\n\nUsage\n-----\n\nThe script takes 2 input files, which are expected to be placed in the current folder.\n(You can specify an alternate location using parameters -c and -s)\n\n`certmon.conf`\n\nThis is where you can specify the hostnames \u0026 ports to connect to.\n\n`certmon_smtp.conf` \n\nThis file contains information about your SMTP server, and the email addresses to use.\n\nYou can tweak the warning threshold with parameter -w.\n\n\ncertmon.conf syntax\n-------------------\n\nThis file contains the hostnames and portnumbers (default 443) to connect to.\nSyntax:\n```\nhostname:port\n```\n(only specify one hostname:port combination per line)\n\nIf you want certmon to also monitor the certificate itself, you can specify which keywords it should contain in certain fields. Supported fields are:\n\n```\nsubject\nissuer\nversion\nserial\n```\n\nExample:  Let's say I want to monitor the certificate on www.corelan.be, and I want to be sure that the subject field contains 'www.corelan.be', the issuer field contains the keyword 'StartCom', and the serial number field contains '1056083', then the line inside the certmon.conf file should look like this:\n\n```\nwww.corelan.be:443;issuer=StartCom;serial=1056083;subject=www.corelan.be\n```\n\n(The fields must be ; separated, and the first field must contain the hostname and port).\n\nThis configuration will trigger the following behaviour:\n\nIf the certificate on www.corelan.be (port 443) will expire in 30 days or less, you will get an email warning.\n\nIf the certificate on www.corelan.be (port 443) has expired, you will get an email alert.\n\nIf one of the 3 fields doesn't contain the corresponding keywords, you will get an email alert.\n\n\n(Hint: If you want to know what exactly is inside the various fields, simply use option -v)\n\nNote: The field compliance check will be performed against a lowercase conversion of the field \u0026 the keyword.\n\n\ncertmon_smtp.conf syntax\n------------------------\n\nThis is easy.  If the script is unable to find the smtp configuration file, it will ask you a couple of questions \u0026 create the file for you.\nIf you want to check if the mail configuration works correctly simply run the script with option -mail.\nYou should get a test email in your mailbox.\n\n\nlimitations / known issues\n--------------------------\nThe script is not able to handle host headers or URI's.  It will simply connect to a server on a port, and dump the certificate.  \n\n\nLicense\n-------\nGPL\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorelan%2Fcertmon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcorelan%2Fcertmon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorelan%2Fcertmon/lists"}