Identify and cleanse expired and soon to expire certs from BIG-IP
Problem this snippet solves:
- Identify Expired and Soon to Expire Certs (including their use on a virtual, client-ssl profile)
- If desired, script can delete client-ssl profile, cert/key for expired certs
- Script can be run with argument of --days to indicate how many days prior to expiration you consider soon to expire
- --reportonly argument will never prompt to delete configuration objects
How to use this snippet:
usage: f5_old_cert_key_profile_cleanup.py [-h] --bigip BIGIP --user USER [--days DAYS] [--reportonly]
A tool to identify expiring and soon to expire certs and related config detritus and assist user with pruning it from configuration
optional arguments: -h, --help show this help message and exit --bigip BIGIP IP or hostname of BIG-IP Management or Self IP --user USER username to use for authentication --days DAYS number of days before expiration to consider cert as expiring soon --reportonly produce report only; do not prompt for configuration object deletion
Code :
https://github.com/cjenison/f5_old_cert_key_profile_cleanup
Tested this on version:
11.5Published Jul 29, 2018
Version 1.0
Chad_Jenison
Nimbostratus
NimbostratusChad_JenisonNimbostratus
Nimbostratus
Naumin_Dave_144Hi Chad,
What a Perfect catch! yes this is the cause, my credentials were correct but it uses remote authentication via RADIUS, and as you suggested for workaround by using local admin account resolves this issue. Thanks for sharing BUGID. Just to update, there is one issue with using this script, we have to disassociate serverssl profile from VIPs manually. As for VIPs who are used for SSL bridging(contains clientssl and serverssl) will be impacted if we disassociate only clientssl profile.
So I am working on addition in your code(may be you can help) to disassociate respective serverssl profile(if any) for the VIPs who are having clientssl profile with expired certs, but stuck on data formatting part, the way you did is just perfect.
Thanks for your swift response!
Chad_JenisonThe reason I didn’t tackle dissociating clientssl profile with an expired cert from a virtual is that in my opinion that’s something that needs fixing outside of the script and then once fixed you would then run the cleanup script.
- Naumin_Dave_144
understood, but atleast we can add function in reportonly "for loops" to pull serverssl profile for those VIPs who are using Expired/expiring soon clientssl profile?
- Chad_Jenison
so what you are proposing is that when the script encounters a profile that is associated with an expired cert AND the virtual server has a server SSL profile, it would remove both the clientssl and serverssl profile and the hope would be that clients who connect would accept whatever cert the back-end server is offering?
I'm curious; how did your BIG-IP get to a state where there are numerous clientssl profiles that point to expired certs? Seems to me that not long after the cert expires, you'd get user reports complaining about expired cert and then you'd fix it, such that few BIG-IPs that are actively used will have expired certs attached to clientssl profiles attached to active virtual servers.
- Naumin_Dave_144
"so what you are proposing is that when the script encounters a profile that is associated with an expired cert AND the virtual server has a server SSL profile, it would remove both the clientssl and serverssl profile and the hope would be that clients who connect would accept whatever cert the back-end server is offering?"
Yes, We want this, however it is ok to not remove them/untag them from VS config via script but atleast can get those names when use "--reportonly".
"I'm curious; how did your BIG-IP get to a state where there are numerous clientssl profiles that point to expired certs?"
I know it sound weird but sadly answer is Yes, we have many VSs who are UP and using expired cert profiles. Seems like those are not used by app teams. Ideally those VSs should be decommissioned but instead of following up with individuals for decommission those VIPs, we want to silently removing SSL offloading from LB side so that there applications will work as it was working before this activity.
Daniel_Edgar_11Nice job, Chad! Using this today!
- ashish_solanki
Cirrus
Hi Chad,
Thanks for sharing the script. However I am facing some issue while running the script.snippets are attached can you help me with this.
Vladimir_ShishkAltocumulus
This script marks certs with expiration date more than one month as soontoexpired also.
I run it with arg days equal 1 (and 0) and received result in picture.
Can you fix it? Thank you.VE/BIG-IP 15.1.7 Build 0.0.6 Final