Messages

Very basic adding alerts on certificate fail, to know before your users and before its an issue.

There were about two topics on this which are closed and no actual answer.

Prequisites:
Have working ACME setup
Get monit service to work and send mail (there are many howtos on this)

What to do:
In monit settings Create a new test in "Service Test Settings":

Name: Acme_failed
condition:  content = "failed"
Action:  Alert


Create new in monit "Service Settings"

Name: Acme_failed
type: File
Path: /var/log/system/latest.log
Tests: select the test you created: "Acme_failed", you can probably add here all tests that look in the general log to this setting.

In the monit "Alert Settings" edit your working alert or create a new working one.

Events:  Add "Content failed"

Thats it, don't forget to save and apply to everything (i alwas fail on this LOL)

Just an example of my Mail format in the alert:
reply-to: opnsense@xxxxx.co
From: FireWall <xxxx@xxxxx.co>
Subject: OPNSense $HOST Alerts $SERVICE
Message:
$HOST
$EVENT
$SERVICE
$DATE
$DESCRIPTION

$ACTION

Yes i know looking for "failed" in the general logs could be an issue, but i'm only getting alerts on ACME "failed" so worse case i will get something else which have failed which i don't know even exist, thats good as long as i'm not spammed with "failed" email alerts.
You can probably have some regexp that will look for ACME and failed.

I followed this great tutorial and everything in it worked on the first hit!!
Great work, great explanation and details, thanks.

The thing that don't work for me is what is ommited from the latest version of this (as far as i understand)
I want to use the no ssl offloading option, and i can't make it work, i did a map file and rule to map my already SSLed services, i put the rule in the 0_SNI_frontend but no rule i make that is not just selecting my pool catches the host name, its like it doesn't have the url yet to select, if i put a rule to just force my pool it works but then all the none ssl services do not work.

What am i missing, If i put my SSLed services as SSL in the real server and map them as regular servers everything works but then i have double SSL which im trying to avoid.