Forum Discussion

pr's avatar
pr
Icon for Nimbostratus rankNimbostratus
Aug 22, 2017

SSL cert expiration email notification not working properly

Hi Guys,

 

I am facing an interesting issue for SSL certs expiration , even though I have deployed the configuration based on SOLK15288 (Sending an advance email alert for impending SSL certificate expiration). I am only getting email notifications for some of the certs not all. So for example if I will run the command "run sys crypto check-cert" I am getting below o/p . In the shared o/p only notifications for some of the certs I am receiving not all. In bottom of the o/p i have pasted my configuration :

 

CN=.customertrades.com,OU=ERCOT Trading,O=Direct Energy LP,L=Houston,ST=Texas,C=US in file /Common/MarketPro_1.crt expired on May 7 23:59:59 2017 GMT CN=.customertrades.com,OU=ERCOT Trading,O=Direct Energy LP,L=Houston,ST=Texas,C=US in file /Common/Marketpro.crt expired on May 7 23:59:59 2017 GMT CN=PowerPortfolioPreProdService.Directenergy.com,OU=IT,O=Direct Energy Marketing Limited,L=Toronto,ST=Ontario,C=CA in file /Common/PowerPortfolioPreProdService.Directenergy.com.crt expired on Jul 1 23:59:59 2017 GMT CN=PowerPortfolioService.Directenergy.com,OU=IT,O=Direct Energy Marketing Limited,L=Toronto,ST=Ontario,C=CA in file /Common/PowerPortfolioService.Directenergy.com.crt expired on Jul 1 23:59:59 2017 GMT CN=corporateappservices.directenergy.com,OU=Digital IS,O=Direct Energy Marketing Limited,L=Toronto,ST=Ontario,C=CA in file /Common/corporateapp.crt expired on Jul 26 23:59:59 2017 GMT CN=mobileoam.directenergy.com,OU=Digital IS,O=Direct Energy Marketing Limited,L=Toronto,ST=Ontario,C=CA in file /Common/mobileoam_key.crt expired on Jul 23 23:59:59 2017 GMT CN=portal.cplretailenergy.com,OU=Centrica Plc,O=Centrica Plc,street=Millstream Maidenhead Road,L=Windsor,ST=Berkshire,postalCode=SL4 5GD,C=GB,serialNumber=03033654,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.3=13024742 in file /Common/portal.cplretailenergy.com.crt expired on Jul 30 23:59:59 2017 GMT CN=pp.directenergy.com,OU=Direct Energy Residential,O=Direct Energy, LP,L=Houston,ST=Texas,C=US,serialNumber=800007830,businessCategory=Private Organization,1.3.6.1.4.1.311.60.2.1.2=13055465786173,1.3.6.1.4.1.311.60.2.1.3=13025553 in file /Common/pp.directenergy.com.crt expired on Apr 29 23:59:59 2017 GMT

 

CN=pp.firstchoicepower.com,O=Direct Energy, LP,L=Houston,ST=Texas,C=US in file /Common/pp.firstchoicepower.com.crt expired on Aug 21 23:59:59 2017 GMT

[root@rtpf502:Standby:In Sync] config more /config/user_alert.conf alert CERTIFICATE_EXPIRED "Certificate (.*) expired" { email toaddress="XXXX@directenergy.com" body="Certificate Expired on " }

 

alert CERTIFICATE_WILL_EXPIRE "Certificate (.*) will expire" { email toaddress="XXXX@directenergy.com" body="Certificate will Expire on " }

 

  • pr's avatar
    pr
    Icon for Nimbostratus rankNimbostratus

    So to make it clear I am getting notifications only for below ;

     

    corporateappservices.directenergy.com PowerPortfolioPreProdService.Directenergy.com CN=.customertrades.com,OU=ERCOT Trading,O=Direct Energy LP,L=Houston,ST=Texas,C=US' in file /Common/Marketpro.crt expired on May 7 23:59:59 2017 GMT CN=.customertrades.com,OU=ERCOT Trading,O=Direct Energy LP,L=Houston,ST=Texas,C=US' in file /Common/MarketPro_1.crt expired on May 7 23:59:59 2017 GMT

     

    Why this is happening ?

     

  • pr's avatar
    pr
    Icon for Nimbostratus rankNimbostratus

    Hi Guys/Senior members,

     

    Can you please have a look on shared issue as I am getting hard time to solve it.

     

  • Your post alignment is hard to read. QQ,

     

    1. How many certs are installed on the box ?
    2. How many certs are expiring in next 30 days ?
    3. How many certs are already expired and are on the box ?
    4. How many notifications have you got so far ?
    5. How many log entries are present in /var/log/ltm.
    Based on this entry alone your alert.conf will trigger the mail. I hope the entries in your /var/log/ltm would match to the notifications that you received.

    On the alert.conf file, I see you have configured 2 custom alerts. One for expired certs and other for expiring certs.

     

    So it looks, it is working as expected.

     

  • P_K's avatar
    P_K
    Icon for Altostratus rankAltostratus

    when you run

    /etc/cron.weekly/5checkcert
    from CLI , How many emails you're seeing?