topic Re: How to check certificate expiration date from API or CLI? in Automation/API Discussions

How to check certificate expiration date from API or CLI?

juanochoa — Wed, 17 Mar 2021 16:53:54 GMT

Hello all,

Do you know if it is possible to check certificate expiration date from API or CLI for Firewall and Panorama.

Ideally also get all the certificate details. I haven't found a way.

Thanks

Re: How to check certificate expiration date from API or CLI?

SebRupik — Fri, 19 Mar 2021 10:34:33 GMT

Hi there,

On the firewall CLI try show sslmgr-store config-certificate-info will give you certificate details including expiry dates.

cheers,

Seb.

Re: How to check certificate expiration date from API or CLI?

juanochoa — Fri, 19 Mar 2021 14:47:15 GMT

Thank you.

Awesome, that's was exactly what I was looking for.

Re: How to check certificate expiration date from API or CLI?

JimmyHolland — Fri, 19 Mar 2021 16:14:27 GMT

And the equivalent XML API call:

https://{{host}}/api?key={{key}}&type=op&cmd=<show><sslmgr-store><config-certificate-info></config-certificate-info></sslmgr-store></show>

Re: How to check certificate expiration date from API or CLI?

efurlan — Tue, 07 Dec 2021 10:03:45 GMT

Hi,

I not found a sslmgr-store option on my panorama

Re: How to check certificate expiration date from API or CLI?

JimmyHolland — Tue, 07 Dec 2021 10:59:22 GMT

Hi @efurlan, another method is to look at the config, such as this example API call:

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate

The response includes the expiry (and begin) dates:

Re: How to check certificate expiration date from API or CLI?

JimmyHolland — Tue, 07 Dec 2021 11:08:20 GMT

You could also do the sslmgr command on a managed-firewall via Panorama:

https://{{host}}/api?key={{key}}&type=op&cmd=<show><sslmgr-store><config-certificate-info></config-certificate-info></sslmgr-store></show>&target={{ngfw-serial-number}}

Re: How to check certificate expiration date from API or CLI?

Dave_Messenger — Sun, 20 Mar 2022 09:44:56 GMT

Super helpful, thanks so much.

Led me on to the SDK:

https://pan-os-python.readthedocs.io/

Re: How to check certificate expiration date from API or CLI?

FabioSouza — Tue, 05 Apr 2022 14:33:12 GMT

Hi Jymmy,

Thank you for the post, I'm using exactly what you posted but looks like it does not send the certificate's name in the response. Do you have any suggestions about how to get a list of SSL Certificates installed?

Response:

<result>04D53E620DFF9346DA94C3F500D97B2:FF74AB87368B853C438879E050464F0CE84D5010

serial number:

issuer: /C=CA/ST=ON/L=Ottawa/O=MyOrg/CN=Issuing CA

issuer-subjecthash: FF74AB87368B85986969E050464F0CE84D5010

issuer-keyhash:

db-type: V

db-exp-date: 220409191416Z(Apr 9 19:14:16 2022 GMT)

db-rev-date: ()

db-serialno: 04D53E620097097A94C3F500D97B26unknown

db-file: unknown

db-name: /C=CA/ST=Ontario/O=myOrg/CN=xpto.com

db-status: V

Regards,

Fabio

Re: How to check certificate expiration date from API or CLI?

JimmyHolland — Thu, 07 Apr 2022 08:10:55 GMT

Hi @FabioSouza, which command are you using, how are you using it (Postman, curl, etc), and is it to Panorama or NGFW directly?

It looks like you are using the "sslmgr-store" command from earlier in the thread, but maybe try the config command later in the thread (here) which includes certificate names in the response.

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate

Re: How to check certificate expiration date from API or CLI?

Dave_Messenger — Thu, 07 Apr 2022 08:51:24 GMT

Sharing a script that utilises the Python API for anyone that may be interested.

https://github.com/ip-life-net/palo-check-cert-expiry

Re: How to check certificate expiration date from API or CLI?

TigeRRR — Thu, 07 Apr 2022 16:30:35 GMT

@JimmyHolland I have the same question actually but I'm wondering what values do I need to substitute for the values I underlined below:

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate

Re: How to check certificate expiration date from API or CLI?

JimmyHolland — Fri, 08 Apr 2022 12:06:02 GMT

Hi @TigeRRR,

Good question. In my notation, anything inside {{ braces like this }} means replace with your own value.

[@name='localhost.localdomain'] stays the same, this is a static value the same on every device.
{{template-name}} is the name of your Panorama template where you are modifying certs or gathering cert info. My response was to someone asking about Panorama specifically.

Hope that helps?

Re: How to check certificate expiration date from API or CLI?

TigeRRR — Fri, 08 Apr 2022 14:23:55 GMT

Thank you! I understood that it was to be your own values but I wasn't sure what it was referring to, what if this was to be pulled directly from a firewall and not Panorama?

Re: How to check certificate expiration date from API or CLI?

damom10 — Wed, 13 Apr 2022 00:50:08 GMT

Hi guys,

this is a really great thread and I thank you all for your inputs.

I'm currently trying to develop a certificate expiry monitoring solution for the 'default trusted certificate authorities'.

All the provided paths in this thread relate to the 'device certificates' only.

I believe I require a path that would access 'default trusted certificate authorities' on vsys1.

Could someone please point me in the right direction on how I could achieve this?

It's been a frustrating process thus far, so any direction will be much appreciated.

Thanks guys!

Re: How to check certificate expiration date from API or CLI?

JimmyHolland — Wed, 13 Apr 2022 10:33:24 GMT

@damom10 Thos certificates are managed/updated as part of PAN-OS, they are not part of the configuration unlike the other types of certificates mentioned previously in this thread.

Re: How to check certificate expiration date from API or CLI?

damom10 — Wed, 13 Apr 2022 22:02:08 GMT

Thanks Jummy.

Any idea how best to approach creating a solution to grab those certificates and check for expiry. I'm using PowerShell and API at the moment but it seems like API isn't going to help me?

Maybe I need to use python?

Re: How to check certificate expiration date from API or CLI?

JimmyHolland — Thu, 14 Apr 2022 08:58:24 GMT

@damom10 Is there a reason why you want to check expiry of the CAs? How are you using them, why do you need to check them? In most use cases they are there to act just like the trusted CA list in your web browser, and I presume you would not check these, you expect your browser to manage them, and you expect PAN-OS to manage them too?

Re: How to check certificate expiration date from API or CLI?

damom10 — Fri, 15 Apr 2022 08:57:26 GMT

Hi Jimmy,

thanks for your response.

I had a senior network engineer tell me we have several that are important for our VPN. But I am curious, if there is no need to monitor these, then I will mention it to him. If these generally manage themselves, then it sounds like there isn't a monitoring requirement.

Re: How to check certificate expiration date from API or CLI?

FabioSouza — Fri, 15 Apr 2022 19:09:47 GMT

Thanks, Jimmy.

That's how I got what I wanted.

1 - Get SSL/TLS service profiles
https://{{PaloaltoIP}}/api/?key={{key}}&type=config&action=get&xpath=/config/shared/ssl-tls-service-profile

2 - Get all certificates
https://{{PaloaltoIP}}/api/?key={{key}}&type=config&action=get&xpath=/config/shared/certificate

3 - Get a certificate by it's name
https://{{PaloaltoIP}}/api/?key={{key}}&type=config&action=get&xpath=/config/shared/certificate/entry[@name='cert-name']

4 - If certificate name is not important
https://{{PaloaltoIP}}/api?key={{key}}&type=op&cmd=<show><sslmgr-store><config-certificate-info></config-certificate-info></sslmgr-store></show>