Monitor PKI certificates & CRLs for expiration with Telegram & SMS alerts

PKI Certificate & CRL Monitor - Auto Expiration Alert System Overview This n8n workflow provides automated monitoring of Public Key Infrastructure (PKI) components including CA certificates, Certificate Revocation Lists (CRLs), and associated web services. It extracts certificate information from the TSL (Trusted Service List) -- the Hungarian is the example list as default in the workflow -- , monitors expiration dates, and sends alerts via Telegram and SMS when critical thresholds are reached. Features - Automated extraction of certificate URLs from TSL XML - CA certificate expiration monitoring - CRL expiration tracking - Website availability monitoring with retry mechanism - Multi-channel alerting (Telegram and SMS) - Scheduled execution every 12 hours - 17-hour warning threshold for expirations Setup Instructions Prerequisites 1. n8n Instance: Running n8n installation with Linux environment 2. Telegram Bot: Created via @BotFather 3. Textbelt API Key: For SMS notifications (optional) 4. Network Access: To reach TSL source and certificate URLs 5. Linux Tools: OpenSSL, curl, libxml2-utils, jq (auto-installed) Configuration Steps 1. Telegram Setup Create Telegram Bot: - Open Telegram and search for @BotFather - Send /newbot and follow prompts - Save the bot token (format: 1234567890:ABCdefGHIjklMNOpqrsTUVwxyz) Create Alert Channel: - Create a new Telegram channel for alerts - Add your bot as administrator - Get channel ID: - Send a test message to the channel - Visit: https://api.telegram.org/bot<YOURBOTTOKEN>/getUpdates - Find "chat":{"id":-100XXXXXXXXXX} - this is your channel ID 2. SMS Setup (Optional) Textbelt Configuration: - Register at https://textbelt.com - Purchase credits and obtain API key - Note: Free tier allows 1 SMS/day for testing 3. Configure Alert Nodes Update these nodes with your credentials: CRL Alert Node: - Open CRL Alert --- Telegram & SMS node - Replace YOUR-TELEGRAM-BOT-TOKEN with your bot token - Replace YOUR-TELEGRAM-CHANNEL-ID with your channel ID - Replace +36301234567 with target phone number(s) - Replace YOUR-TEXTBELT-API-KEY with your Textbelt key CA Alert Node: - Open CA Alert --- Telegram & SMS node - Apply same replacements as above Website Down Alert Node: - Open Send Website Down - Telegram & SMS node - Apply same replacements as above 4. TSL Source Configuration The workflow defaults to Hungarian TSL: - URL: http://www.nmhh.hu/tl/pub/HUTL.xml - To change, edit the Collect Checking URL list node - Trust list references: https://ec.europa.eu/tools/lotl/eu-lotl.xml (to find more TSL list to change the default), and https://www.etsi.org/deliver/etsits/119600119699/119615/01.02.0160/ts119615v010201p.pdf (to Technical Specification of the Trust Lists) 5. Threshold Configuration Default warning threshold: 17 hours before expiration - To modify CRL threshold: Edit nextUpdate - TimeFilter node - To modify CA threshold: Edit nextUpdate - TimeFilter1 node - Change value in condition: if (diffHours < 17) Activation 1. Save all configuration changes 2. Test with Execute With Manual Start trigger 3. Verify alerts are received 4. Toggle workflow to Active status for scheduled operation How to Use Automatic Operation Once activated, the workflow runs automatically: - Frequency: Every 12 hours - Process: 1. Downloads TSL XML 2. Extracts all certificate URLs 3. Checks each URL type (CRL, CA, or other) 4. Validates expiration dates 5. Sends alerts for critical items Manual Execution For immediate checks: 1. Open the workflow 2. Click Execute With Manual Start node 3. Click "Execute Node" 4. Monitor execution progress Understanding Alerts CRL Expiration Alert Message Format: ALERT! with Issuer CN !!!CRL EXPIRATION!!! Will be under 17 hour (Next Update Time)! Last updated: Last Update Time Trigger Conditions: - CRL expires in less than 17 hours - CRL download successful but expiration imminent CA Certificate Alert Message Format: ALERT!/EXPIRED! with Subject CN !!!CA EXPIRATION PROBLEM!!! The expira