Monitor certificates from truststore in SslMeterBinder

[tommyk-gears]

SslMeterBinder allows us to monitor certificate expiry. But it is currently limited to certificates in ssl bundle keystores. I'd like to suggest expanding this functionality to also include truststores.

This is related to #48967 where truststore certs were added to the info endpoint.

[mhalbritter]

Hey,

What would be your use case for this? You have some kind of self-signed certificate in your trust store and want to be alerted when you need to update this certificate in the truststore?

[tommyk-gears]

You have some kind of self-signed certificate in your trust store and want to be alerted when you need to update this certificate in the truststore?

Yes, that would be the main use case I believe. I understand it is not bullet-proof as the full chain is probably not available in the trust-store (e.g. we have the root cert in a trust-store, then the server sends its cert + intermediate(s) in handshake). The root cert is probably the one least likely to expire 🤷. On the other hand, there may be cases where there are no intermediate/root, but just the server cert in the trust-store.
In practice we run into expired certificates now and then, and any kind of monitoring that can help us prevent it would be appreciated.

For foolproof monitoring I guess one would need to export metrics of the "time to expiry" of the full certificate chain on each SSL handshake (assuming SSL handshakes happen frequently enough to detect issues before actual expiry). Ideally the server side would have its own monitoring and detect that its certificate is about to expire, but in my experience that is often not really the case - so we try to detect it from client side.

[ThomasVitale]

I have similar use cases, where I use a combination of root and intermediate certificate in the truststore (but also cases with a single certificate). It would be incredibly useful to get metrics for their expiration (the intermediate one would be the most useful one).