amimof/node-cert-exporter

[Feature Request] Please add Serial as a label

costasd opened this issue · 0 comments

Hello maintainers!

right now, exporter emits the following attributes as labels for every certificate:

		labels := prometheus.Labels{
			"path":            path,
			"issuer":          cert.Issuer.String(),
			"alg":             cert.SignatureAlgorithm.String(),
			"version":         strconv.Itoa(cert.Version),
			"subject":         cert.Subject.String(),
			"dns_names":       strings.Join(cert.DNSNames, ","),
			"email_addresses": strings.Join(cert.EmailAddresses, ","),
			"hostname":        hostname,
			"nodename":        nodename,
		}

during certificate renewals, any of these attributes might remain the same - a valid scenario could be for example that we're utilizing
the same issuer company to renew an existing certificate with the same email and DNS names.

I propose serial to be added to the list of emitted labels, as serial is expected to be different for every certificate issued by the same CA.
This could help with scenarios such as confirming that certificates changed on disk after a renewal and their deployment.

  • This feature/enhancement benefits everyone

Description
A PR that would add serial as a label and its value through the cert attributes parse by crypto/x509.

Additional information
Out of RFC5280:

4.1.2.2.  Serial Number

   The serial number MUST be a positive integer assigned by the CA to
   each certificate.  It MUST be unique for each certificate issued by a
   given CA (i.e., the issuer name and serial number identify a unique
   certificate).  CAs MUST force the serialNumber to be a non-negative
   integer.