Private SSL Certificate Monitoring

TrackSSL can monitor your internal, private certificates that are not accessible to the internet. To do so, you can run an instance of our agent on your local network. This lightweight agent will run on a schedule every 4 hours. It will make an API call to TrackSSL’s cloud-hosted dashboard, fetch the list of certificates it is responsible for monitoring, fetch each certificate from your local network, and push the certificate to TrackSSL in the cloud for notification and monitoring.

Here’s how to enable private SSL monitoring with TrackSSL:

Create an SSL Monitoring Agent

Click Agents on the left and then enter an Agent name. This could be the name of your internal network or a name you will use to remember the agent instance. If you only have one internal network, you only need one Agent. But if you have separate networks, subnets, or VPCs, you can create multiple agents, each responsible for their own set of certificates. Copy the token generated for your agent. This will be called your TRACKSSL_AGENT_TOKEN.

Assign Domain to Agents

In TrackSSL, a domain is a hostname or IP address that is the end point for an SSL/TLS certificate. To assign domains to be monitoring by your internal Agent, rather than the cloud-hosted TrackSSL agent, click Domains on the left, click the domain you want to assign, then choose the Agent you want to assign the domain to:

Creating TrackSSL API Token

Next, create an API token to be used by your agent. You only need one API token no matter how many agents you create, though you may wish to create separate API tokens which can be revoked individually if needed. Copy the API token generated. This will be called your TRACKSSL_AUTH_TOKEN:

Next, you’ll need to install and run the TrackSSL Agent. This agent is installed on your local network to facilitate monitoring of certificates that are not available on the public internet. To utilize, you’ll need a TrackSSL account on a plan with Private Certificate Monitoring. You’ll also need a TrackSSL API key and an Agent Token and you’ll need to assign domains to agents in the TrackSSL dashboard.

Installation

The agent is extremely lightweight, does not access anything on your network except the certificates, and the source is available for your inspection. For maximum security, you can download the source and compile it yourself, However, we recommend you download a precompiled binary from the releases page.

Execution

The agent runs as a daemon, sleeping by default for 4 hours between checks. Just run the executable, specifying your API Token and Agent Token and leave the process running to ensure your certificates continue to check regularly. Here’s how:

Windows

Simply run it with your agent token and API key:

$ .\trackssl-agent-windows.exe -agent-token your_agent_token -auth-token your_api_key

Linux

You will need to make the binary executable before running it:

$ chmod +x trackssl-agent-linux

Then run it with your agent token and API key:

$ ./trackssl-agent-linux -agent-token your_agent_token -auth-token your_api_key

Mac

You will need to make the binary executable before running it:

$ chmod +x trackssl-agent-mac

And then approve the unsigned binary via the Security & Privacy settings in System Preferences.

Then run it with your agent token and API key:

$ ./trackssl-agent-mac -agent-token your_agent_token -auth-token your_api_key