Forum Discussion

Blue_whale's avatar
Blue_whale
Icon for Cirrocumulus rankCirrocumulus
Jul 15, 2026

How to monitor device trust certificate expiry ?

Hello Experts , 

We would like to understand how we can monitor the expiry of the Device Trust Certificate located at /Common/dtca.crt.

The certificate has a validity period of 10 years; however, we would like to include it in our certificate monitoring process. Currently, only the device certificate is being monitored.

We would like to monitor the Device Trust Certificate as well and receive alerts prior to its expiry.

Could you please check and advise on the available options for monitoring this certificate?

Thank you.

application delivery
Certifiacte

6 Replies

  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Jul 17, 2026

    Hi Blue_whale​,

    try (filename might be different in your case, not _59522_2 but different numbers):

    [root@ltm:Active:Standalone] ~ # curl -sku admin:P@$$w0rd! https://localhost/mgmt/tm/util/bash \
  -H "Content-Type: application/json" -X POST \
  -d "{\"command\":\"run\", \"utilCmdArgs\": \"-c 'openssl x509 -text -in /config/filestore/files_d/Common_d/trust_certificate_d/\:Common\:dtdi.crt_59522_2'\"}" \
  | sed 's/\\n/\n/g' | grep "Not After"

    Output should look like this: 

    Not After : Oct 20 10:15:48 2034 GMT

    Credits go to this post: Rest API - Device certificate URL | DevCentral

     

    Cheers

    Daniel

    • Blue_whale's avatar
      Blue_whale
      Icon for Cirrocumulus rankCirrocumulus
      Jul 21, 2026

      Hi Daniel_Wolf​ ,

      Thank you for the command .. I would like to know if these commands just show the output once or it helps to generate any alert ?

      We would like to get the alert .

      Our monitoring tool is able to generate the alert for device certificate expiry but not for the Device trust certificate . 

      For device certificate expiry we use snmp OID - certsExpiration': '.1.3.6.1.4.1.3375.2.100.1.0 

      Do we have similar OID for Device trust certificate ?

      • Daniel_Wolf's avatar
        Daniel_Wolf
        Icon for MVP rankMVP
        Jul 22, 2026

        I'm not really an SNMP / OID expert... 

        You can run the command also from remote. Instead of localhost you can use the management IP of the BIG-IP.
        And then you could create some status in any Observbality Platform. And also an alert. That's all custom code. Ask Claude... the sky is the limit :)

  • Paulius's avatar
    Paulius
    Icon for MVP rankMVP
    Jul 18, 2026

    Because the device certificate isn't from a CA I would recommend putting in scheduled refresh because you know exactly when it expires and you can just create a new one. This can be recorded and then setup a reminder or something along those lines. If this is something you insist on checking every day you can automate the checks at the following URL.

    https://my.f5.com/manage/s/article/K000148955

  • Blue_whale's avatar
    Blue_whale
    Icon for Cirrocumulus rankCirrocumulus
    Jul 21, 2026

    [F5_LAB:Active:In Sync] config # openssl x509 -noout -enddate -in /config/filestore/files_d/Common_d/trust_certificate_d/\:Common\:dtdi.crt_37022_5

    notAfter=Jul 4 10:11:15 2036 GMT

    With the above command how can we set a crontab job to run every month and report when the expiry day is nearing ?