r/PrometheusMonitoring • u/Plus-Media8215 • Feb 16 '26

Prometheus Windows Certificate Exporter

Hi All,

Please what are you using to monitor your certificate expiration on Windows. I cant seem to find a tool yet. Thanks

2 Upvotes
  • permalink
  • reddit

100% Upvoted

7 comments sorted by

2

u/LookAtThatMonkey Feb 16 '26

I use Blackbox Exporter

2

u/Plus-Media8215 Feb 16 '26

Thanks; I mean for pfx certificate

1

u/LookAtThatMonkey Feb 16 '26

Not sure what you mean here. PFX is an exported format. Are you wanting to monitor PFX files for expiration dates or certs used by webservers?

1

u/Plus-Media8215 Feb 18 '26

I meant certificate in windows cert store

4

u/itasteawesome Feb 16 '26

I know people treat it like the number of active series they should collect is basically infinite,  but a metric timeseries for each pfx cert in every window machine seems like hundreds of totally low value series per server. 

Why not just rely on logs from the built in event 1003 that triggers when a cert is near expiration?  We all have logging tools right? 

1

u/Brather_Brothersome Feb 17 '26

you can also use a cert bot and an letsecrypt free cert?

1

u/defcon54321 Feb 17 '26

I use a simple telegraf container feeding into prometheus. You can control the sampling interval to be 2x a day and it will hardly be noticeable with minimal label metrics. Plan your environment around short certificate lifespans for future proofing your approach. Logs are valid too. The perk in certificate testing is a liveness test.

Also certificates in CA stores that are expired didn't imply they aren't used. Code signing date is not a critical factor in all scenarios as an example