OID to monitor Device trust certificate

Forums Technical Forums
, ,
1

Hello Team ,

For device certificate expiry we use snmp OID - certsExpiration’: '.1.3.6.1.4.1.3375.2.100.1.0

Do we have similar OID to monitor Device trust certificate ?

2

I couldn’t find one, but you can create your own custom oid. Here’s how:

  1. Use the script from K000151455 and place somewhere (I put it in /config/check_status.sh)
    1. chmod +x /config/check_status.sh (changing to executable file)
    2. chcon -t bin_t /config/check_trust.sh ( setting to a file type snmpd is allowed to execute)
  2. Create file /config/snmp/custom_mib.tcl (see below)
  3. Restart snmpd (bigstart restart snmpd)
  4. grep for the the mibs being registered in the log file (grep -i “custom mib” /var/log/snmpd.log)
  5. Test it out:
[root@bigip02:Active:In Sync] snmp # bigstart restart snmpd                                                                    
[root@bigip02:Active:In Sync] snmp # grep -i "custom mib" /var/log/snmpd.log
custom mib initialization completed. total 2 custom mib entry registered
[root@bigip02:Active:In Sync] snmp # snmpget -v2c -c public localhost .1.3.6.1.4.1.3375.2.100.5.0
F5-BIGIP-COMMON-MIB::bigipTrafficMgmt.100.5.0 = STRING: "Certificate is valid until Sep 30 21:46:25 2031 GMT (1895 Days remaining)"
[root@bigip02:Active:In Sync] snmp # snmpget -v2c -c public localhost .1.3.6.1.4.1.3375.2.100.6.0                              
F5-BIGIP-COMMON-MIB::bigipTrafficMgmt.100.6.0 = STRING: "1895"

Here’s the custom_mib.tcl file (notice I set to .5 and .6 since it looks like you’re already using a custom mib space perhaps?)

# /config/snmp/custom_mib.tcl
#   .1.3.6.1.4.1.3375.2.100.5.0  ->  trust cert, full status string
#   .1.3.6.1.4.1.3375.2.100.6.0  ->  trust cert, days remaining (int)

register_mib ".5" trust_cert_status string
register_mib ".6" trust_cert_days   int

proc trust_cert_status {} {
    set status [catch {exec /config/check_trust.sh} result]
    if {$status != 0 || $result eq ""} {
        return "ERROR: check_trust.sh failed"
    }
    return [string trim $result]
}

proc trust_cert_days {} {
    set status [catch {exec /config/check_trust.sh} result]
    if {$status != 0} {
        return -1
    }
    if {[regexp {\(([0-9]+) Days remaining\)} $result -> days]} {
        return $days
    }
    return -1
}

(Tested on 21.x, but this has been possible for a long time. Here are details from 13.1 user guide)

Hope this helps!