Identify and cleanse expired and soon to expire certs from BIG-IP

Problem this snippet solves:

  • Identify Expired and Soon to Expire Certs (including their use on a virtual, client-ssl profile)
  • If desired, script can delete client-ssl profile, cert/key for expired certs
  • Script can be run with argument of --days to indicate how many days prior to expiration you consider soon to expire
  • --reportonly argument will never prompt to delete configuration objects

How to use this snippet:

usage: f5_old_cert_key_profile_cleanup.py [-h] --bigip BIGIP --user USER [--days DAYS] [--reportonly]

A tool to identify expiring and soon to expire certs and related config detritus and assist user with pruning it from configuration

optional arguments: -h, --help show this help message and exit --bigip BIGIP IP or hostname of BIG-IP Management or Self IP --user USER username to use for authentication --days DAYS number of days before expiration to consider cert as expiring soon --reportonly produce report only; do not prompt for configuration object deletion

Code :

https://github.com/cjenison/f5_old_cert_key_profile_cleanup

Tested this on version:

11.5
Published Jul 29, 2018
Version 1.0
application delivery
devops
iControlREST
LTM

Was this article helpful?

18 Comments

Sort By
Show More
  • Naumin_Dave_144's avatar
    Naumin_Dave_144
    Icon for Nimbostratus rankNimbostratus
    Feb 12, 2019

    Hi Chad,

     

    What a Perfect catch! yes this is the cause, my credentials were correct but it uses remote authentication via RADIUS, and as you suggested for workaround by using local admin account resolves this issue. Thanks for sharing BUGID. Just to update, there is one issue with using this script, we have to disassociate serverssl profile from VIPs manually. As for VIPs who are used for SSL bridging(contains clientssl and serverssl) will be impacted if we disassociate only clientssl profile.

     

    So I am working on addition in your code(may be you can help) to disassociate respective serverssl profile(if any) for the VIPs who are having clientssl profile with expired certs, but stuck on data formatting part, the way you did is just perfect.

     

    Thanks for your swift response!

     

  • Chad_Jenison's avatar
    Chad_Jenison
    Icon for Nimbostratus rankNimbostratus
    Feb 12, 2019

    The reason I didn’t tackle dissociating clientssl profile with an expired cert from a virtual is that in my opinion that’s something that needs fixing outside of the script and then once fixed you would then run the cleanup script.

     

  • Naumin_Dave_144's avatar
    Naumin_Dave_144
    Icon for Nimbostratus rankNimbostratus
    Feb 12, 2019

    understood, but atleast we can add function in reportonly "for loops" to pull serverssl profile for those VIPs who are using Expired/expiring soon clientssl profile?

     

  • Chad_Jenison's avatar
    Chad_Jenison
    Icon for Nimbostratus rankNimbostratus
    Feb 12, 2019

    so what you are proposing is that when the script encounters a profile that is associated with an expired cert AND the virtual server has a server SSL profile, it would remove both the clientssl and serverssl profile and the hope would be that clients who connect would accept whatever cert the back-end server is offering?

     

    I'm curious; how did your BIG-IP get to a state where there are numerous clientssl profiles that point to expired certs? Seems to me that not long after the cert expires, you'd get user reports complaining about expired cert and then you'd fix it, such that few BIG-IPs that are actively used will have expired certs attached to clientssl profiles attached to active virtual servers.

     

  • Naumin_Dave_144's avatar
    Naumin_Dave_144
    Icon for Nimbostratus rankNimbostratus
    Feb 12, 2019

    "so what you are proposing is that when the script encounters a profile that is associated with an expired cert AND the virtual server has a server SSL profile, it would remove both the clientssl and serverssl profile and the hope would be that clients who connect would accept whatever cert the back-end server is offering?"

     

    Yes, We want this, however it is ok to not remove them/untag them from VS config via script but atleast can get those names when use "--reportonly".

     

    "I'm curious; how did your BIG-IP get to a state where there are numerous clientssl profiles that point to expired certs?"

     

    I know it sound weird but sadly answer is Yes, we have many VSs who are UP and using expired cert profiles. Seems like those are not used by app teams. Ideally those VSs should be decommissioned but instead of following up with individuals for decommission those VIPs, we want to silently removing SSL offloading from LB side so that there applications will work as it was working before this activity.

     

  • ashish_solanki's avatar
    ashish_solanki
    Icon for Cirrus rankCirrus
    Feb 15, 2023

    Hi Chad, 

    Thanks  for sharing the script. However I am facing some issue while running the script.snippets are attached can you help me with this.

  • Vladimir_Shishk's avatar
    Vladimir_Shishk
    Icon for Altocumulus rankAltocumulus
    Mar 23, 2023

    This script marks certs with expiration date more than one month as soontoexpired also.

    I run it with arg days equal 1 (and 0) and received result in picture.
    Can you fix it? Thank you.

    VE/BIG-IP 15.1.7 Build 0.0.6 Final