Notification of expiring VPN certificate

[nooni]

Hi,

Just recently the expiration of VPN certificates was changed from 5-6 years down to 1 year to comply with a RFC.

This is good but can be a bit tricky since also Identity Awareness use this certificate, possibly also more services.

So for example if you use Identity Awareness but not VPN blade then you must temporarily enable VPN blade, check and/or renew certificate so it is valid for another year.

Is it possible to get an notification if before the certificate expires ?

I saw a previous discussion here on Check Mates, but that was when VPN blade is enabled.

Would be very useful if for example the cluster object got a warning sign a week or two before it happens.

[the_rock]

As far as I know, you would get warning when pushing the policy about it 1 month before cert is to expire.

[freeman91]

Is there a way for this notification to be e-mailed? Like when I got a notification when CPU >90% or disk space <15% with this sk25941

[Chris_Atkinson]

You can also monitor it via SNMP and have your monitoring system alert accordingly.

[freeman91]

Can you give me a bit more guide? I have only found these: where to find about ssl vpn certificate expiration?

[Chris_Atkinson]

Example SNMP OIDs for Gateway monitoring:

1.3.6.1.4.1.2620.1.1.101.0 (Certificate status)
1.3.6.1.4.1.2620.1.1.102.0 (Status description - short)
1.3.6.1.4.1.2620.1.1.103.0 (Status description - long)

[freeman91]

Where I can configure this OIDs? Please be more detailed because i am not a pro 😞

[Chris_Atkinson]

In your monitoring tool of choice e.g. Nagios or PRTG etc.

[freeman91]

Oh, I understand now. But there is not monitoring tools because this question is for several check point fws from diff clients and I need a way to monitoring ssl vpn cert for each of them.

I thing I can manage it via Smartevent when certain log appear.

[Chris_Atkinson]

Playblocks also has an option:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Playblocks-Admin-Guide/Topics...

[Danny]

That's perfectly possible. Just script a scheduled event on your SMS that checks the postgres monitoring database and generates an email alert whenever a warning is detected.

Example for R81.20: psql_client monitoring postgres -c "select * from statuses_view"

[matangi · Accepted solution]

Hi @nooni 

In R81.20, New alert was added for that matter.

The Management Server begins to show 'warning' status starting 60 days before the certificate expiration date.

For more details, see sk178304 - SmartConsole shows a warning or error icon near the Security Gateway / Cluster object abo....

Thanks,
Matan

[the_rock]

Thats EXCELLENT change @matangi 

Andy

[the_rock]

Also, wanted to say, its GREAT to see now in web UI when you try download jumbo hotfix, if cpuse agent is not the latest version, pop-up window comes up asking to upgrade it.

AWESOME 👍👍👌👌