Can this OID notificate the expired certificates for SSL decryption and Global Protect?

MasaW — Fri, 20 Jun 2025 04:26:20 GMT

Hi,

I found the below OID in SNMP Trap.
Can this OID notificate the expired certificates for SSL decryption and Global Protect?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBfzCAG

====
panCryptoCertExpiryTrap .1.3.6.1.4.1.25461.2.1.3.2.0.100 Certificate expired
====

Best regards,
MasaW

Re: Can this OID notificate the expired certificates for SSL decryption and Global Protect?

BPry — Fri, 20 Jun 2025 14:12:57 GMT

@MasaW,

This will not generate alerts for anything other than the device management certificate. You can automate these checks easily through some API calls and have whatever alert interval you wish, I've found this to work better than anything you can do natively.

A brief example of how you would do this, note that I specifically don't give working examples of scripts as someone implementing them needs to be able to maintain them.

#Collect the current certificates# Get_Cert_List = requests.get('https://' + str(myFirewallUrl) + '/api/?type=config&action=get&xpath=/config/shared/certificate',headers=headers) #Take the return and parse it# Certificate_Dict = xmltodict.parse(Get_Cert_List.content) Certificates = Certificate_Dict['response']['result']['certificate']['entry'] for Certificate in Certificates: Certificate_Name = Certificate['@name'] Certificate_Expiration = Certificate['not-valid-after'] Certificate_ExpiryEpoch = Certificate['expiry-epoch'] Expiration_Date = datetime.datetime.fromtimestamp(int(Certificate_ExpiryEpoch)) Current_Date = datetime.datetime.now() Date_Delta = Expiration_Date - Current_Date Day_Count = Date_Delta.days if Day_Count <=30: Alert_Certificate_Expiration(Certificate_Name=str(Certificate_Name),Certificate_Expiration=str(Certificate_Expiration),Date_Delta=str(Day_Count),NoAlert=NoAlert)

This should give you enough of an example if you choose to do this through the API that is more adaptable to what you specifically want.

topic Can this OID notificate the expired certificates for SSL decryption and Global Protect? in General Topics

Can this OID notificate the expired certificates for SSL decryption and Global Protect?

Re: Can this OID notificate the expired certificates for SSL decryption and Global Protect?