https://github.com/anas-aso/ssllabs_exporter
Getting deep analysis of the configuration of any SSL web server on the public Internet à la blackbox_exporter style.
https://github.com/anas-aso/ssllabs_exporter
prometheus prometheus-exporter security ssl ssllabs tls
Last synced: 4 months ago
JSON representation
Getting deep analysis of the configuration of any SSL web server on the public Internet à la blackbox_exporter style.
- Host: GitHub
- URL: https://github.com/anas-aso/ssllabs_exporter
- Owner: anas-aso
- License: apache-2.0
- Created: 2020-01-30T21:28:46.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2025-04-23T16:32:11.000Z (about 1 year ago)
- Last Synced: 2025-04-23T16:52:43.699Z (about 1 year ago)
- Topics: prometheus, prometheus-exporter, security, ssl, ssllabs, tls
- Language: Go
- Homepage:
- Size: 115 KB
- Stars: 49
- Watchers: 3
- Forks: 5
- Open Issues: 5
-
Metadata Files:
- Readme: Readme.md
- License: LICENSE
Awesome Lists containing this project
README
# SSLLabs exporter
[](https://github.com/anas-aso/ssllabs_exporter/releases/latest)
[](https://github.com/anas-aso/ssllabs_exporter/actions)
[](https://goreportcard.com/report/github.com/anas-aso/ssllabs_exporter)
Getting deep analysis of the configuration of any SSL web server on the public Internet à la blackbox_exporter style.
This exporter relays the target server hostname to [SSLLabs API](https://www.ssllabs.com/ssltest), parses the result and export it as Prometheus metrics. It covers retries in case of failures and simplifies the assessment result.
## SSLLabs
> SSL Labs is a non-commercial research effort, run by [Qualys](https://www.qualys.com/), to better understand how SSL, TLS, and PKI technologies are used in practice.
source: https://www.ssllabs.com/about/assessment.html
This exporter implements SSLLabs API client that would get you the same results as if you use the [web interface](https://www.ssllabs.com/ssltest/).
## Configuration
ssllabs_exporter doesn't require any configuration file and the available flags can be found as below :
```bash
$ ssllabs_exporter --help
usage: ssllabs_exporter []
Flags:
--help Show context-sensitive help (also try --help-long and --help-man).
--listen-address=":19115" The address to listen on for HTTP requests.
--timeout="10m" Time duration before canceling an ongoing probe such as 30m or 1h5m. This value must be at least 1m. Valid duration units are ns, us (or µs), ms, s, m, h.
--log-level=debug Printed logs level.
--cache-retention="1h" Time duration to keep entries in cache such as 30m or 1h5m. Valid duration units are ns, us (or µs), ms, s, m, h.
--cache-ignore-failed Do not cache failed results due to intermittent SSLLabs issues.
--version Show application version.
```
## Docker
The Prometheus exporter is available as a [docker image](https://hub.docker.com/repository/docker/anasaso/ssllabs_exporter) :
```
docker run --rm -it anasaso/ssllabs_exporter:latest --help
```
## How To Use it
Deploy the exporter to your infrastructure. Kubernetes deployment and service Yaml file are provided [here](examples/kubernetes) as an example.
Then adjust Prometheus config to add a new scrape configuration. Examples of how this look like can be found [here](examples/prometheus) (it includes both static config and Kubernetes service discovery to auto check all the cluster ingresses).
Once deployed, Prometheus Targets view page should look like this :
The Grafana dashboard below is available [here](examples/grafana_dashboard.json).
## Available metrics
| Metric Name | Description |
|----|-----------|
| ssllabs_probe_duration_seconds | how long the assessment took in seconds |
| ssllabs_probe_success | whether we were able to fetch an assessment result from SSLLabs API (value of 1) or not (value of 0) regardless of the result content |
| ssllabs_grade | the grade of the target host |
| ssllabs_grade_time_seconds | when the result was generated in Unix time |
#### `ssllabs_grade` possible values:
- `1` : Assessment was successful and the grade is exposed in the `grade` label of the metric.
- `0` : Target host doesn't have any endpoint (list of returned [endpoints](https://github.com/ssllabs/ssllabs-scan/blob/master/ssllabs-api-docs-v3.md#host) is empty).
- `-1` : Error while processing the assessment (e.g rate limiting from SSLLabs API side).