How to check certificate expiration date from API or CLI?

[juanochoa]

Hello all,

Do you know if it is possible to check certificate expiration date from API or CLI for Firewall and Panorama.

Ideally also get all the certificate details. I haven't found a way.

Thanks

[SebRupik]

Hi there,

On the firewall CLI try show sslmgr-store config-certificate-info will give you certificate details including expiry dates.

cheers,

Seb.

[juanochoa]

Thank you.

Awesome, that's was exactly what I was looking for.

[JimmyHolland · Accepted solution]

And the equivalent XML API call:

https://{{host}}/api?key={{key}}&type=op&cmd=<show><sslmgr-store><config-certificate-info></config-certificate-info></sslmgr-store></show>

[efurlan]

Hi,

I not found a sslmgr-store option on my panorama

[JimmyHolland]

Hi @efurlan, another method is to look at the config, such as this example API call:

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate

The response includes the expiry (and begin) dates:

[JimmyHolland]

You could also do the sslmgr command on a managed-firewall via Panorama:

https://{{host}}/api?key={{key}}&type=op&cmd=<show><sslmgr-store><config-certificate-info></config-certificate-info></sslmgr-store></show>&target={{ngfw-serial-number}}

[Dave_Messenger]

Super helpful, thanks so much.

Led me on to the SDK:

https://pan-os-python.readthedocs.io/

[FabioSouza]

Hi Jymmy, 

Thank you for the post, I'm using exactly what you posted but looks like it does not send the certificate's name in the response. Do you have any suggestions about how to get a list of SSL Certificates installed? 

Response:

<response status="success">

    <result>04D53E620DFF9346DA94C3F500D97B2:FF74AB87368B853C438879E050464F0CE84D5010

    serial number: 

        issuer: /C=CA/ST=ON/L=Ottawa/O=MyOrg/CN=Issuing CA

        issuer-subjecthash: FF74AB87368B85986969E050464F0CE84D5010

        issuer-keyhash: 

        db-type: V

        db-exp-date: 220409191416Z(Apr  9 19:14:16 2022 GMT)

        db-rev-date: ()

        db-serialno: 04D53E620097097A94C3F500D97B26unknown

        db-file: unknown

        db-name: /C=CA/ST=Ontario/O=myOrg/CN=xpto.com

        db-status: V

Regards, 

Fabio

[JimmyHolland]

Hi @FabioSouza, which command are you using, how are you using it (Postman, curl, etc), and is it to Panorama or NGFW directly?

It looks like you are using the "sslmgr-store" command from earlier in the thread, but maybe try the config command later in the thread (here) which includes certificate names in the response.

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate

[Dave_Messenger]

Sharing a script that utilises the Python API for anyone that may be interested.

https://github.com/ip-life-net/palo-check-cert-expiry 

[TigeRRR]

@JimmyHolland I have the same question actually but I'm wondering what values do I need to substitute for the values I underlined below:

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='{{template-name}}']/config/shared/certificate

[JimmyHolland]

Hi @TigeRRR,

Good question. In my notation, anything inside {{ braces like this }} means replace with your own value.

• [@name='localhost.localdomain'] stays the same, this is a static value the same on every device.
• {{template-name}} is the name of your Panorama template where you are modifying certs or gathering cert info. My response was to someone asking about Panorama specifically.

Hope that helps?

[TigeRRR]

Thank you! I understood that it was to be your own values but I wasn't sure what it was referring to, what if this was to be pulled directly from a firewall and not Panorama?

[damom10]

Hi guys,

this is a really great thread and I thank you all for your inputs.

I'm currently trying to develop a certificate expiry monitoring solution for the 'default trusted certificate authorities'.

All the provided paths in this thread relate to the 'device certificates' only.

I believe I require a path that would access 'default trusted certificate authorities' on vsys1.

Could someone please point me in the right direction on how I could achieve this?

It's been a frustrating process thus far, so any direction will be much appreciated.

Thanks guys!