pip install google-cloud-monitoring google-auth

gcloud auth application-default login

from google.cloud import monitoring_v3
from google.oauth2 import service_account
import ssl
import socket
import datetime

# Replace with your project ID
project_id = "your-project-id"

# Replace with your monitored SSL certificate
ssl_cert = ("www.example.com", 443)

# Replace with your monitored SSL certificate name
ssl_cert_name = "example.com SSL Certificate"

# Replace with the number of days before expiration to trigger an alert
alert_days = 30

# Authenticate using ADC
credentials = service_account.Credentials.from_service_account_file(
    filename="path/to/your/adc.json"
)

# Get the current date
now = datetime.datetime.utcnow()

# Get the SSL certificate expiration date
context = ssl.create_default_context()
with socket.create_connection(ssl_cert) as sock:
    with context.wrap_socket(sock, server_hostname=ssl_cert[0]) as sslsock:
        cert = sslsock.getpeercert()
        expiration_date = datetime.datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y %Z')

# Calculate the number of days until expiration
days_until_expiration = (expiration_date - now).days

# Create a metric descriptor for the SSL certificate expiration date
client = monitoring_v3.MetricServiceClient(credentials=credentials)
project_name = f"projects/{project_id}"
descriptor = monitoring_v3.types.MetricDescriptor()
descriptor.type = f"custom.googleapis.com/{ssl_cert_name}/days_until_expiration"
descriptor.metric_kind = monitoring_v3.enums.MetricDescriptor.MetricKind.GAUGE
descriptor.value_type = monitoring_v3.enums.MetricDescriptor.ValueType.INT64
descriptor.description = f"Days until {ssl_cert_name} SSL certificate expires"
descriptor.labels.append(monitoring_v3.types.LabelDescriptor(key="certificate_name", value_type=monitoring_v3.enums.LabelDescriptor.ValueType.STRING, description="Name of the SSL certificate being monitored"))
descriptor.labels.append(monitoring_v3.types.LabelDescriptor(key="hostname", value_type=monitoring_v3.enums.LabelDescriptor.ValueType.STRING, description="Hostname of the SSL certificate being monitored"))
descriptor.labels.append(monitoring_v3.types.LabelDescriptor(key="port", value_type=monitoring_v3.enums.LabelDescriptor.ValueType.INT64, description="Port of the SSL certificate being monitored"))
descriptor.unit = "days"
descriptor = client.create_metric_descriptor(project_name, descriptor)

# Write the metric data to Cloud Monitoring
series = monitoring_v3.types.TimeSeries()
series.metric.type = f"custom.googleapis.com/{ssl_cert_name}/days_until_expiration"
series.metric.labels["certificate_name"] = ssl_cert_name
series.metric.labels["hostname"] = ssl_cert[0]
series.metric.labels["port"] = ssl_cert[1]
point = series.points.add()
point.value.int64_value = days_until_expiration
point.interval.end_time.seconds = int(now.timestamp())
client.create_time_series(request={"name": project_name, "time_series": [series]})

# Trigger an alert if the SSL certificate is expiring soon
if days_until_expiration <= alert_days:
    # Replace with your alerting policy name
    alert_policy_name = "your-alert-policy-name"
    alert_client = monitoring_v3.AlertPolicyServiceClient(credentials=credentials)
    alert_policy = alert_client.get_alert_policy(request={"name": f"{project_name}/alertPolicies/{alert_policy_name}"})
    for condition in alert_policy.conditions:
        if condition.condition_threshold.filter.label.key == "certificate_name" and condition.condition_threshold.filter.label.value == ssl_cert_name:
            condition.condition_threshold.threshold_value.value = alert_days
            alert_client.update_alert_policy(request={"alert_policy": alert_policy})

print(f"{ssl_cert_name} SSL certificate expires in {days_until_expiration} days")

python your_script_name.py

resource "google_monitoring_alert_policy" "ssl_certificate_expiry" {
  project      = "YOUR_PROJECT_ID"            # replace with your project ID
  display_name = "SSL certificate expiry"

  combiner = "OR"

  conditions {
    display_name = "SSL certificate expiration age below threshold"

    condition_threshold {
      # Metric for remaining lifetime of HTTPS load balancer SSL certificates
      filter = "metric.type=\"loadbalancing.googleapis.com/https/certificate_expiration_age\""

      comparison      = "COMPARISON_LT"
      threshold_value = THRESHOLD_SECONDS      # replace with seconds before expiry you want to alert on (e.g. 2592000 for 30 days)
      duration        = "0s"                   # alert as soon as the condition is met

      aggregations {
        alignment_period   = "60s"
        per_series_aligner = "ALIGN_MEAN"
      }

      trigger {
        count = 1
      }
    }
  }

  notification_channels = [
    "projects/YOUR_PROJECT_ID/notificationChannels/YOUR_CHANNEL_ID" # replace with your notification channel
  ]

  user_labels = {
    environment = "ENVIRONMENT_LABEL"          # optional label, replace or remove
  }
}