checkcert_* do not verify SANs???

[mgedmin]

I had

checkcert_imaps mail.pov.lt
checkcert_ssmtp mail.pov.lt

pass when the SSL certs for mail.pov.lt listed only fridge.pov.lt (and a bunch of other SANs) but no mail.pov.lt.

I can reproduce:

checkcert mail.pov.lt

says OK, even though fridge.pov.lt does not serve a SAN for mail.pov.lt!

[mgedmin]

Note that the underlying tools from underlying monitoring-plugins do not support this, e.g. /usr/lib/nagios/plugins/check_http --help says:

Please note that this plugin does not check if the presented server
certificate matches the hostname of the server, or if the certificate
has a valid chain of trust to one of the locally installed CAs.

[mgedmin]

Consider ssl-cert-check as an alternative. It's packaged in Ubuntu.