PRTG Manual: SSL/TLS Security Check Sensor

Enabled Beta Sensors experimental feature

This sensor requires that the Beta Sensors experimental feature is enabled.

For more information, see the Knowledge Base: What are beta sensors and how can I use them?

Multi-platform probe

You can add this sensor to a multi-platform probe.

IPv6

This sensor supports IPv6.

Performance impact

This sensor has a very low performance impact.

Lookups

This sensor uses lookups to determine the status values of one or more channels.

Scanning interval

This sensor has a fixed minimum scanning interval for performance reasons. You cannot use a shorter scanning interval. Consequently, shorter scanning intervals in the Monitoring settings are not available for this sensor.

• The minimum scanning interval of this sensor is 30 seconds.
• The recommended scanning interval of this sensor is 5 minutes.

Connection Timeout (Sec.)

Define a timeout for the Transmission Control Protocol (TCP) connection. This is the time the sensor waits to establish a connection to the host. Enter an integer between 1-300. The default connection timeout is 30 seconds.

Handshake Timeout (Sec.)

Define a timeout for the SSL/TLS handshake. This is the time the sensor waits to complete the SSL/TLS handshake. Enter an integer between 1-300. The default handshake timeout is 10 seconds.

Port

Enter the port for the connection to the target endpoint. PRTG supports the port numbers 1-65535. Enter an integer. The default port is 443.

SNI Inheritance

Select if you want to use the Server Name Indication (SNI) from the parent device or a custom SNI.

• Inherit SNI from parent device (default): Determine the SNI from the host address of the parent device.
• Use custom SNI: Use this setting if the device that the sensor queries has multiple certificates with the same IP address and port combination.

SNI Hostname

This setting is only visible if you select Use custom SNI above.

Enter the custom SNI hostname.

Security Evaluation

Define how PRTG evaluates the connection check for each protocol. The sensor enters the Down status when PRTG detects that the actual result for one or more protocols does not match the expected result. In other words, when any of the channels display a Not Expected value.

• Use default settings: Use the default expectation for each protocol – both TLS 1.2 and TLS 1.3 must be accepted and any other protocol must be denied:
  • SSL 3.0: Deny
  • TLS 1.0: Deny
  • TLS 1.1: Deny
  • TLS 1.2: Accept
  • TLS 1.3: Accept
• Use custom settings: Select the expected response individually for each protocol.

SSL 3.0

This setting is only visible if you select Use custom settings above.

Define the expected result of SSL 3.0 connection requests:

• Accept: Select this option if your expectation is that the device accepts SSL 3.0 connections.
• Deny (default): Select this option if your expectation is that the device denies SSL 3.0 connections.
• Ignore: Select this option if you want the sensor to ignore the result of the security evaluation for this protocol.

TLS 1.0

This setting is only visible if you select Use custom settings above.

Define the expected result of TLS 1.0 connection requests:

• Accept: Select this option if your expectation is that the device accepts TLS 1.0 connections.
• Deny (default): Select this option if your expectation is that the device denies TLS 1.0 connections.
• Ignore: Select this option if you want the sensor to ignore the result of the security evaluation for this protocol.

TLS 1.1

This setting is only visible if you select Use custom settings above.

Define the expected result of TLS 1.1 connection requests:

• Accept: Select this option if your expectation is that the device accepts TLS 1.1 connections.
• Deny (default): Select this option if your expectation is that the device denies TLS 1.1 connections.
• Ignore: Select this option if you want the sensor to ignore the result of the security evaluation for this protocol.

TLS 1.2

This setting is only visible if you select Use custom settings above.

Define the expected result of TLS 1.2 connection requests:

• Accept (default): Select this option if your expectation is that the device accepts TLS 1.2 connections.
• Deny: Select this option if your expectation is that the device denies TLS 1.2 connections.
• Ignore: Select this option if you want the sensor to ignore the result of the security evaluation for this protocol.

TLS 1.3

This setting is only visible if you select Use custom settings above.

Define the expected result of TLS 1.3 connection requests:

• Accept (default): Select this option if your expectation is that the device accepts TLS 1.3 connections.
• Deny: Select this option if your expectation is that the device denies TLS 1.3 connections.
• Ignore: Select this option if you want the sensor to ignore the result of the security evaluation for this protocol.

Primary Channel

Select a channel from the list to define it as the primary channel. In the device tree, PRTG displays the last value of the primary channel below the sensor's name. The available options depend on what channels are available for this sensor.

You can set a different primary channel later by clicking below a channel gauge on the sensor's Overview tab.

Graph Type

Define how this sensor shows different channels:

• Show channels independently (default): Show a graph for each channel.
• Stack channels on top of each other: Stack channels on top of each other to create a multi-channel graph. This generates a graph that visualizes the different components of your total traffic.
  You cannot use this option in combination with manual Vertical Axis Scaling (available in the channel settings).

Stack Unit

This setting is only visible if you select Stack channels on top of each other above.

Select a unit from the list. PRTG stacks all channels with this unit on top of each other. By default, you cannot exclude single channels from stacking if they use the selected unit. However, there is an advanced procedure to do so.

Result Handling

Define what PRTG does with the sensor result:

• Discard result (default): Do not store the sensor result.
• Store result: Store the sensor result and the last response in the \Logs\sensors subfolder of the PRTG data directory on the probe system. The file name is Result of Sensor [ID].log. This setting is for debugging purposes. PRTG overwrites this file with each scanning interval.

This option is not available when the sensor runs on the hosted probe of a PRTG Hosted Monitor instance.

In a cluster, PRTG stores the result in the PRTG data directory of the master node.

Downtime

In the channel table on the Overview tab, this channel never shows any values. PRTG uses this channel in graphs and reports to show the amount of time in which the sensor was in the Down status.

Evaluation Result

The overall percentage of protocols that meet the defined expectations

This channel is the primary channel by default.

SSL 3

The status of connections using SSL 3.0

The channel status and the displayed lookup value depend on the expected results that you define for this protocol in the Specific Sensor Settings.

• Up status: Accepted (Expected) or Denied (Expected)
• Down status: Accepted (Expected) or Denied (Not Expected)
• Unknown status: Ignored

TLS 1.0

The status of connections using TLS 1.0

The channel status and the displayed lookup value depend on the expected results that you define for this protocol in the Specific Sensor Settings.

• Up status: Accepted (Expected) or Denied (Expected)
• Down status:  Accepted (Not Expected) or Denied (Not Expected)
• Unknown status: Ignored

TLS 1.1

The status of connections using TLS 1.1

The channel status and the displayed lookup value depend on the expected results that you define for this protocol in the Specific Sensor Settings.

• Up status: Accepted (Expected) or Denied (Expected)
• Down status:  Accepted (Not Expected) or Denied (Not Expected)
• Unknown status: Ignored

TLS 1.2

The status of connections using TLS 1.2

The channel status and the displayed lookup value depend on the expected results that you define for this protocol in the Specific Sensor Settings.

• Up status: Accepted (Expected) or Denied (Expected)
• Down status: Accepted (Not Expected) or Denied (Not Expected)
• Unknown status: Ignored

TLS 1.3

The status of connections using TLS 1.3

The channel status and the displayed lookup value depend on the expected results that you define for this protocol in the Specific Sensor Settings.

• Up status: Accepted (Expected) or Denied (Expected)
• Down status: Accepted (Not Expected) or Denied (Not Expected)
• Unknown status: Ignored