How to check certificate expiration date from API or CLI?

[juanochoa]

Hello all,

Do you know if it is possible to check certificate expiration date from API or CLI for Firewall and Panorama.

Ideally also get all the certificate details. I haven't found a way.

Thanks

[SebRupik]

Hi there,

On the firewall CLI try show sslmgr-store config-certificate-info will give you certificate details including expiry dates.

cheers,

Seb.

[juanochoa]

Thank you.

Awesome, that's was exactly what I was looking for.

[JimmyHolland · Accepted solution]

And the equivalent XML API call:

https://{{host}}/api?key={{key}}&type=op&cmd=<show><sslmgr-store><config-certificate-info></config-certificate-info></sslmgr-store></show>

[efurlan]

Hi,

I not found a sslmgr-store option on my panorama

[JimmyHolland]

Hi @efurlan, another method is to look at the config, such as this example API call:

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate

The response includes the expiry (and begin) dates:

[JimmyHolland]

You could also do the sslmgr command on a managed-firewall via Panorama:

https://{{host}}/api?key={{key}}&type=op&cmd=<show><sslmgr-store><config-certificate-info></config-certificate-info></sslmgr-store></show>&target={{ngfw-serial-number}}

[Dave_Messenger]

Super helpful, thanks so much.

Led me on to the SDK:

https://pan-os-python.readthedocs.io/

[FabioSouza]

Hi Jymmy, 

Thank you for the post, I'm using exactly what you posted but looks like it does not send the certificate's name in the response. Do you have any suggestions about how to get a list of SSL Certificates installed? 

Response:

<response status="success">

    <result>04D53E620DFF9346DA94C3F500D97B2:FF74AB87368B853C438879E050464F0CE84D5010

    serial number: 

        issuer: /C=CA/ST=ON/L=Ottawa/O=MyOrg/CN=Issuing CA

        issuer-subjecthash: FF74AB87368B85986969E050464F0CE84D5010

        issuer-keyhash: 

        db-type: V

        db-exp-date: 220409191416Z(Apr  9 19:14:16 2022 GMT)

        db-rev-date: ()

        db-serialno: 04D53E620097097A94C3F500D97B26unknown

        db-file: unknown

        db-name: /C=CA/ST=Ontario/O=myOrg/CN=xpto.com

        db-status: V

Regards, 

Fabio

[JimmyHolland]

Hi @FabioSouza, which command are you using, how are you using it (Postman, curl, etc), and is it to Panorama or NGFW directly?

It looks like you are using the "sslmgr-store" command from earlier in the thread, but maybe try the config command later in the thread (here) which includes certificate names in the response.

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate