Forum Discussion

Blue_whale's avatar
Blue_whale
Icon for Cirrocumulus rankCirrocumulus
Jul 22, 2026

OID to monitor Device trust certificate

Hello Team ,

For device certificate expiry we use snmp OID - certsExpiration': '.1.3.6.1.4.1.3375.2.100.1.0 

Do we have similar OID to monitor Device trust certificate ?

1 Reply

  • I couldn't find one, but you can create your own custom oid. Here's how:

    1. Use the script from K000151455 and place somewhere (I put it in /config/check_status.sh)
      1. chmod +x /config/check_status.sh (changing to executable file)
      2. chcon -t bin_t /config/check_trust.sh ( setting to a file type snmpd is allowed to execute)
    2. Create file /config/snmp/custom_mib.tcl (see below)
    3. Restart snmpd (bigstart restart snmpd)
    4. grep for the the mibs being registered in the log file (grep -i "custom mib" /var/log/snmpd.log)
    5. Test it out:
    [root@bigip02:Active:In Sync] snmp # bigstart restart snmpd                                                                    
    [root@bigip02:Active:In Sync] snmp # grep -i "custom mib" /var/log/snmpd.log
    custom mib initialization completed. total 2 custom mib entry registered
    [root@bigip02:Active:In Sync] snmp # snmpget -v2c -c public localhost .1.3.6.1.4.1.3375.2.100.5.0
    F5-BIGIP-COMMON-MIB::bigipTrafficMgmt.100.5.0 = STRING: "Certificate is valid until Sep 30 21:46:25 2031 GMT (1895 Days remaining)"
    [root@bigip02:Active:In Sync] snmp # snmpget -v2c -c public localhost .1.3.6.1.4.1.3375.2.100.6.0                              
    F5-BIGIP-COMMON-MIB::bigipTrafficMgmt.100.6.0 = STRING: "1895"
    


    Here's the custom_mib.tcl file (notice I set to .5 and .6 since it looks like you're already using a custom mib space perhaps?)

    # /config/snmp/custom_mib.tcl
    #   .1.3.6.1.4.1.3375.2.100.5.0  ->  trust cert, full status string
    #   .1.3.6.1.4.1.3375.2.100.6.0  ->  trust cert, days remaining (int)
    
    register_mib ".5" trust_cert_status string
    register_mib ".6" trust_cert_days   int
    
    proc trust_cert_status {} {
        set status [catch {exec /config/check_trust.sh} result]
        if {$status != 0 || $result eq ""} {
            return "ERROR: check_trust.sh failed"
        }
        return [string trim $result]
    }
    
    proc trust_cert_days {} {
        set status [catch {exec /config/check_trust.sh} result]
        if {$status != 0} {
            return -1
        }
        if {[regexp {\(([0-9]+) Days remaining\)} $result -> days]} {
            return $days
        }
        return -1
    }

    (Tested on 21.x, but this has been possible for a long time. Here are details from 13.1 user guide)

    Hope this helps!