Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add a MeterBinder for SSL chain expiry

Browse Source 
It registers a 'ssl.chains' gauge to count the number of chains with
different statuses (valid, expired, not yet valid, will expire soon).

Additionally, it registers a 'ssl.chain.expiry' gauge for every
certificate in a chain, tracking the seconds until expiry.

This binder reacts on bundle updates and new bundle registrations.

Closes gh-42030
This commit is contained in:
Moritz Halbritter
2024-10-21 15:01:27 +02:00
parent 4685fdebf0
commit 02a49b6038
10 changed files with 592 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
spring-boot-project/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/metrics.adoc
View File

@@ -865,6 +865,33 @@ To customize the tags, provide a javadoc:org.springframework.context.annotation.
[[actuator.metrics.supported.ssl]]
=== SSL bundle metrics
Spring Boot Actuator publishes two metrics about SSL bundles:
The metric `ssl.chains` gauges how many certificate chains have been registered.
The `status` tag can be used to differentiate between valid, not-yet-valid, expired and soon-to-be-expired certificates.
The metric `ssl.chain.expiry` gauges the expiry date of each certificate chain in seconds.
This number will be negative if the chain has already expired.
This metric is tagged with the following information:
|===
| Tag | Description
| `bundle`
| The name of the bundle which contains the certificate chain
| `certificate`
| The serial number (in hex format) of the certificate which is the soonest to expire in the chain
| `chain`
| The name of the certificate chain.
|===
[[actuator.metrics.supported.http-clients]]
=== HTTP Client Metrics