Hi Everybody I have experience issue SSL Certificate is expired. and I don't know it expire today. Can we set BIG-IP to email Alert before SSL Certificate expire? How to do that? Thank you very much

You can use Enterprise Manager for that : http://support.f5.com/kb/en-us/products/em/manuals/product/em-health-activity-monitoring-3-1-1/3.html?sr=32575194 Otherwise : https://devcentral.f5.com/questions/sending-logs-about-certification-expiry

Our CA automatically e-mails us when certs are approaching expiration. You might want to check into that with yours. Chris

You might find this useful for manual checks: .

These are all good options, but if you don't have Enterprise Manager (the BEST option in my opinion) and your CA can't send you an email, I think there's nothing better that a script. Take a look at this one: ! /bin/bash set acceptable threshold in seconds (172800 seconds = 2 days) threshold=25920000 get today's date this_date=`date +%s` (IFS=' ' loop through the stored certificates output=`tmsh list / sys crypto one-line |grep "sys crypto cert"` for f in ${output} do cert=`echo $f |awk -F" " '{ print $4 }'` certdate=`expr match "$f" '.*$expiration.*organization$' |sed s/expiration// | sed s/organization//` expires=`date -d $certdate +%s` if [ $this_date -ge $(($expires - $threshold)) ] then expires_when=$(((expires - $this_date) / 60 / 60 / 24)) echo "$cert is about to expire in $expires_when days" additional processing for expiring certs goes here fi done) This should work for any v11 system. You'll need to make a few modifications/additions: Set a valid threshold value in seconds (172800 seconds = 2 days) Add whatever additional functions you need to happen on cert expiring (ie. mail notice, etc.) Create an external monitor, bind this script to the monitor, and then bind the monitor to a "dummy" pool of servers - a pool not defined in any virtual server configuration. Doing this allows the monitor to fire on a schedule (like a cron job), but is also saved in the archive (unlike a cron job).

Do I need to change " output=tmsh list / sys crypto one-line |grep "sys crypto cert" "? If I using firmware 10.2.4. The code is actually easier in 10.x because the certs are still stored in the directory. ! /bin/bash set acceptable threshold in seconds (172800 seconds = 2 days) threshold=185920000 get today's date this_date=`date +%s` set path to certificates cert_path=/config/ssl/ssl.crt/ for f in $cert_path*.crt do this_cert_date_literal=`openssl x509 -in $f -noout -enddate |sed s/notAfter=//` this_cert_date=`date -d "$this_cert_date_literal" +%s` if [ $this_date -ge $(($this_cert_date - $threshold)) ] then expires_when=$(((this_cert_date - $this_date) / 60 / 60 / 24)) echo "$f is about to expire in $expires_when days" additional processing for expiring certs goes here fi done

How to Alert before SSL Certificate expire?

13 Replies

JAIME_QUIROGA_1
Nimbostratus
Jul 30, 2015
Hello

I'm using the script by v11.x but It's fault, I think what it's not working for this line

output=tmsh list / sys crypto one-line |grep "sys crypto cert"

The load balancing used version 11.6 hotfix 4

Could you help me?
Hannes_Rapp
Nimbostratus
Jul 31, 2015
If you want a solution which also inspects each individual certificate inside a large bundle, and supports reporting to a remote syslog server, have a look at the discussion here: https://devcentral.f5.com/questions/how-to-implement-and-automate-f5-certificate-monitoring
- lkchen
  Nimbostratus
  Aug 27, 2015
  Which is dependent on using cron on the F5's host OS. Now that... instead of applying HFs for the first time ever (went from 9.3.1 to 9.3.1HF6, where HF7 came out a couple months later, but we did HF8 a couple years later....then did annual upgrades into 10.2.3+latest, 10.2.4+latest until HF5, when support got pulled out from under me and I had run into a problem in HF to apply, until we got support reinstated the same day our primary unit failed (I had gotten HF10 applied the month before after finding solution to problem I had run into here on devcentral ;) Now I'm told that its expected to be done within 30days of its release. (due to PCI.) Not sure if it still requires full change review board and sign off from every single user (and their relatives, pets, friends...), to find a slice of time where everybody is okay with it getting done (usually 2am, Sunday during holiday shutdown between Xmas and New Years....not okay with me, though F5 will have somebody working then even if we didn't...) But, had been getting annoyed with it happening so frequently...since our configuration backup was also cron driven. Plus there have been reasons other than HFs/upgrades that wipe out cron. And, the use of appliance mode or desire that only remote users have day-to-day access, also complicate things. Was a pain at 2am last Tuesday to retrieve root password from escrow to overcome some problems during upgrades....which seems strange since it wasn't that long ago when logging in was a regular thing (often only so I can have an terminal window to see the prompt line...) Though probably only used the passwords once or twice since they were last updated. (while its been a couple of years since I used the GPG key's password that I use for escrow access....which took me a few tries to remember ;) L

Forum Discussion

How to Alert before SSL Certificate expire?

13 Replies

Recent Discussions

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

Related Content

LTM Certificate expire

CheckMk F5 Certificate Expiration using SNMP

Re: Management Certificate

Automate Let's Encrypt Certificates on BIG-IP

Expired ssl warning