2 files changed, 80 insertions, 0 deletions
diff --git a/health/guides/x509check/x509check_days_until_expiration.md b/health/guides/x509check/x509check_days_until_expiration.md
new file mode 100644
index 000000000..a37792ab0
--- /dev/null
+++ b/health/guides/x509check/x509check_days_until_expiration.md
@@ -0,0 +1,45 @@
+### Understand the alert
+
+This alert indicates that your X.509 certificate will expire soon. By default, it is triggered in a warning state when your certificate has less than 14 days to expire and in a critical state when it has less than 7 days to expire. However, these levels are configurable.
+
+An X.509 certificate is a digital certificate used to manage identity and security in internet communications and computer networking. If your certificate expires, your system may encounter security and authentication issues which can disrupt your services.
+
+### Troubleshoot the alert
+
+**Step 1: Check the certificate's expiration details**
+
+To check the details of your X.509 certificate, including its expiration date, run the following command:
+
+```
+openssl x509 -in path/to/your/certificate.crt -text -noout
+```
+
+Replace `path/to/your/certificate.crt` with the path to your X.509 certificate file.
+
+**Step 2: Renew or re-key the certificate**
+
+If your X.509 certificate is issued by a Certification Authority (CA), you need to renew or re-key the certificate before it expires. The process for renewing or re-keying your certificate depends on your CA. Refer to your CA's documentation or help resources for guidance.
+
+Examples of popular CAs include:
+
+1. [Let's Encrypt](https://letsencrypt.org/)
+2. [Symantec](https://securitycloud.symantec.com/cc/landing)
+3. [GeoTrust](https://www.geotrust.com/)
+4. [Sectigo](https://sectigo.com/)
+5. [DigiCert](https://www.digicert.com/)
+
+**Step 3: Update your system with the new certificate**
+
+After renewing or re-keying your certificate, you need to update your system with the new certificate file. The process for updating your system depends on the services and platforms you are using. Refer to their documentation for guidance on how to update your certificate.
+
+**Step 4: Verify the new certificate**
+
+Ensure that your system is running with the updated certificate by checking its details again, as described in Step 1.
+
+If there are still issues or the alert persists, double-check your certificate management process and consult your CA's documentation for any additional help or support.
+
+### Useful resources
+
+1. [Sectigo: What is an X.509 certificate?](https://sectigo.com/resource-library/what-is-x509-certificate)
+2. [Netdata: x509 certificate monitoring](https://learn.netdata.cloud/docs/agent/collectors/go.d.plugin/modules/x509check)
+3. [OpenSSL: X.509 Certificate Commands](https://www.openssl.org/docs/man1.1.1/man1/x509.html)
+\ No newline at end of file
diff --git a/health/guides/x509check/x509check_revocation_status.md b/health/guides/x509check/x509check_revocation_status.md
new file mode 100644
index 000000000..2d14f1062
--- /dev/null
+++ b/health/guides/x509check/x509check_revocation_status.md
@@ -0,0 +1,35 @@
+### Understand the alert
+
+This alert indicates that the X.509 certificate has been revoked, meaning that it is no longer valid or trusted. The certificate can be revoked for various reasons, such as key compromise, errors within the certificate, change of usage, or the certificate owner no longer being deemed trustworthy.
+
+### Troubleshoot the alert
+
+1. **Identify the affected certificate**: The alert should provide information about the affected X.509 certificate. Take note of the certificate's details, such as the domain name, subject, issuer, and serial number.
+
+2. **Verify the revocation status**: You can use the `openssl` command to verify the revocation status of the affected certificate. Use the following command to check the certificate against the Certificate Revocation List (CRL) provided by the CA:
+
+   ```
+   openssl verify -crl_check -CAfile CA_certificate.pem -CRLfile CRL.pem certificate.pem
+   ```
+
+   Replace `CA_certificate.pem`, `CRL.pem`, and `certificate.pem` with the appropriate file names of the CA certificate, CRL file, and the target X.509 certificate.
+
+   Alternatively, you can use online tools such as [SSL Shopper's SSL Checker](https://www.sslshopper.com/ssl-checker.html) to verify the revocation status. Be sure to input the domain and port associated with the revoked certificate.
+
+3. **Remove or replace the revoked certificate**: If you have confirmed that the certificate is indeed revoked, you should stop using it immediately. Remove the revoked certificate from your server or application, and replace it with a valid one.
+
+   - If the certificate was issued by a commercial CA, you can request a new certificate from the CA. The CA might provide you with a free replacement or require you to purchase a new one.
+   - If the certificate was issued by [Let's Encrypt](https://letsencrypt.org/), you can renew the certificate using [Certbot](https://certbot.eff.org/) or another ACME client.
+   - If the certificate was self-signed, you can create a new self-signed certificate using the `openssl` command or another certificate management tool.
+
+4. **Update server or application configuration**: After obtaining a new certificate, update your server or application configuration to use the new certificate. Make sure to restart the server or application for the changes to take effect.
+
+5. **Monitor the new certificate**: Keep an eye on the new certificate's status using the X.509 monitoring tools provided by Netdata. Regularly check for any new alerts or changes in the certificate's status.
+
+### Useful resources
+
+1. [X.509 Certificate Monitoring with Netdata](https://learn.netdata.cloud/docs/agent/collectors/go.d.plugin/modules/x509check)
+2. [How to use OpenSSL to verify a certificate against a CRL](https://raymii.org/s/tutorials/OpenSSL_command_line_Root_and_Intermediate_CA_including_OCSP_CRL_Signed_Certs.html)
+3. [SSL Shopper's SSL Checker](https://www.sslshopper.com/ssl-checker.html)
+4. [Renewing certificates with Certbot](https://certbot.eff.org/docs/using.html#renewing-certificates)
+5. [Creating a Self-Signed SSL Certificate](https://www.akadia.com/services/ssh_test_certificate.html)
+\ No newline at end of file