3:08 p.m.
Does anyone know of a script or way to get a list of certificates issued by
the IPA CA that are about to expire?
Thanks.
--
Orion Poplawski
IT Systems Manager 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301 https://www.nwra.com/
4:01 p.m.
Orion Poplawski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Does anyone know of a script or way to get a list of certificates
issued by
the IPA CA that are about to expire?
I do have a small script for byobu that warns when certificates are
about to expire and I verify refresh really works - that's only useful
for small installations with a small number of certificates.
In short: get a time interval with date and feed the dates into "ipa
cert-find". Have fun!
#! /bin/bash
#
# Display the expiring certificates for the next few weeks
# This is called from byobu every 20 minutes
#
now=$(date +"%Y-%m-%d")
end=$(date -d "+27 days" +"%Y-%m-%d")
count=0
revoked=0
# If we call the script manually with "--verbose", give a list
# of the expiring certificates - display subject, expiry date and
# serial number. Stop the script execution.
if [ "x$1" = "x--verbose" ]; then
env LC_ALL=C.UTF-8 KRB5_CLIENT_KTNAME=~/work/freeipa/jochen.keytab \
ipa cert-find --validnotafter-from="$now" --validnotafter-to="$end" |
\
grep -E "(Subject|Not After|Serial number):"
exit
fi
# Count the expiring and possibly revoked certificates
eval "$(env LC_ALL=C.UTF-8 ipa cert-find --validnotafter-from="$now"
--validnotafter-to="$end" | \
awk '/certificates matched/ { count=$1 } /REVOKED/ { revoked++ } END {
printf("count=%d\nrevoked=%d\n", count, revoked) }')"
# If no cert is near expiry - display nothing
if [ "$count" -ne 0 ]; then
if [ "$count" -eq "$revoked" ]; then
# all expiring certificates are also revoked - display green
echo "#[fg=green]$count certs, $revoked revoked#[default]"
else
# there are expiring certificates which are possibly still active
# Looking for a already renewed certificate seems to be
# expensive performance-wise.
echo "#[bg=red]$count certs, $revoked revoked#[default]"
fi
fi
--
This space is intentionally left blank.
4:39 p.m.
Jochen Kellner via FreeIPA-users wrote:
Orion Poplawski via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org>
writes:
> Does anyone know of a script or way to get a list of certificates issued by
> the IPA CA that are about to expire?
I do have a small script for byobu that warns when certificates are
about to expire and I verify refresh really works - that's only useful
for small installations with a small number of certificates.
In short: get a time interval with date and feed the dates into "ipa
cert-find". Have fun!
There is a --status option you can set to valid which should return only
currently valid certs (e.g. no revoked, expired, etc).
rob
#! /bin/bash
#
# Display the expiring certificates for the next few weeks
# This is called from byobu every 20 minutes
#
now=$(date +"%Y-%m-%d")
end=$(date -d "+27 days" +"%Y-%m-%d")
count=0
revoked=0
# If we call the script manually with "--verbose", give a list
# of the expiring certificates - display subject, expiry date and
# serial number. Stop the script execution.
if [ "x$1" = "x--verbose" ]; then
env LC_ALL=C.UTF-8 KRB5_CLIENT_KTNAME=~/work/freeipa/jochen.keytab \
ipa cert-find --validnotafter-from="$now" --validnotafter-to="$end"
| \
grep -E "(Subject|Not After|Serial number):"
exit
fi
# Count the expiring and possibly revoked certificates
eval "$(env LC_ALL=C.UTF-8 ipa cert-find --validnotafter-from="$now"
--validnotafter-to="$end" | \
awk '/certificates matched/ { count=$1 } /REVOKED/ { revoked++ } END {
printf("count=%d\nrevoked=%d\n", count, revoked) }')"
# If no cert is near expiry - display nothing
if [ "$count" -ne 0 ]; then
if [ "$count" -eq "$revoked" ]; then
# all expiring certificates are also revoked - display green
echo "#[fg=green]$count certs, $revoked revoked#[default]"
else
# there are expiring certificates which are possibly still active
# Looking for a already renewed certificate seems to be
# expensive performance-wise.
echo "#[bg=red]$count certs, $revoked revoked#[default]"
fi
fi
6:25 p.m.
Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Jochen Kellner via FreeIPA-users wrote:
> Orion Poplawski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
> writes:
>
>> Does anyone know of a script or way to get a list of certificates issued by
>> the IPA CA that are about to expire?
>
> I do have a small script for byobu that warns when certificates are
> about to expire and I verify refresh really works - that's only useful
> for small installations with a small number of certificates.
>
> In short: get a time interval with date and feed the dates into "ipa
> cert-find". Have fun!
There is a --status option you can set to valid which should return only
currently valid certs (e.g. no revoked, expired, etc).
Thanks for the tip - that will make the script simpler...
Jochen
--
This space is intentionally left blank.
4:59 p.m.
On 1/20/23 15:39, Rob Crittenden wrote:
Jochen Kellner via FreeIPA-users wrote:
> Orion Poplawski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
> writes:
>
>> Does anyone know of a script or way to get a list of certificates issued by
>> the IPA CA that are about to expire?
>
> I do have a small script for byobu that warns when certificates are
> about to expire and I verify refresh really works - that's only useful
> for small installations with a small number of certificates.
>
> In short: get a time interval with date and feed the dates into "ipa
> cert-find". Have fun!
There is a --status option you can set to valid which should return only
currently valid certs (e.g. no revoked, expired, etc).
rob
Thanks for the suggestions. I ended up going with the following because we
have superseded certs that are not revoked. We're going to assume that the
new certs are put into the proper locations. It's pretty pathological bash,
but I still get a perverse thrill from that. ;)
On the revocation topic - is it possible to get the previous certs that are
renewed by certmonger automatically revoked?
#!/bin/bash
now=$(date +%s)
declare -A expires
KRB5_CLIENT_KTNAME=/etc/krb5.keytab \
ipa cert-find --status=VALID --sizelimit=0 | grep -E "(Subject|Not After):"
|
sed 's/^ *//' | ( while IFS=":" read key value
do
if [ "$key" = "Subject" ]
then
subj=${value# }
else
expires["$subj"]=${value# }
fi
done
for subj in "${!expires[@]}"
do
daysleft=$(( ($(date --date="${expires[$subj]}" +%s) - $now ) / 86400
))
[ $daysleft -le 100 ] && echo $subj expires at ${expires[$subj]}
done )
--
Orion Poplawski
IT Systems Manager 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301 https://www.nwra.com/
7:30 p.m.
Orion Poplawski wrote:
On 1/20/23 15:39, Rob Crittenden wrote:
> Jochen Kellner via FreeIPA-users wrote:
>> Orion Poplawski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
>> writes:
>>
>>> Does anyone know of a script or way to get a list of certificates issued by
>>> the IPA CA that are about to expire?
>>
>> I do have a small script for byobu that warns when certificates are
>> about to expire and I verify refresh really works - that's only useful
>> for small installations with a small number of certificates.
>>
>> In short: get a time interval with date and feed the dates into "ipa
>> cert-find". Have fun!
>
> There is a --status option you can set to valid which should return only
> currently valid certs (e.g. no revoked, expired, etc).
>
> rob
Thanks for the suggestions. I ended up going with the following because we
have superseded certs that are not revoked. We're going to assume that the
new certs are put into the proper locations. It's pretty pathological bash,
but I still get a perverse thrill from that. ;)
On the revocation topic - is it possible to get the previous certs that are
renewed by certmonger automatically revoked?
No automatic way. The assumption is they will expire soon so there is no
reason for revocation. You'd have to revoke them manually.
rob
#!/bin/bash
now=$(date +%s)
declare -A expires
KRB5_CLIENT_KTNAME=/etc/krb5.keytab \
ipa cert-find --status=VALID --sizelimit=0 | grep -E "(Subject|Not After):"
|
sed 's/^ *//' | ( while IFS=":" read key value
do
if [ "$key" = "Subject" ]
then
subj=${value# }
else
expires["$subj"]=${value# }
fi
done
for subj in "${!expires[@]}"
do
daysleft=$(( ($(date --date="${expires[$subj]}" +%s) - $now ) / 86400
))
[ $daysleft -le 100 ] && echo $subj expires at ${expires[$subj]}
done )
481
days inactive
487
days old
freeipa-users@lists.fedorahosted.org
5 comments
3 participants
participants (3)
-
Jochen Kellner -
Orion Poplawski -
Rob Crittenden