Can this OID notificate the expired certificates for SSL decryption and Global Protect?

[MasaW]

Hi,

I found the below OID in SNMP Trap.
Can this OID notificate the expired certificates for SSL decryption and Global Protect?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBfzCAG

====
panCryptoCertExpiryTrap  .1.3.6.1.4.1.25461.2.1.3.2.0.100  Certificate expired
====

Best regards,
MasaW

[BPry · Accepted solution]

@MasaW,

This will not generate alerts for anything other than the device management certificate. You can automate these checks easily through some API calls and have whatever alert interval you wish, I've found this to work better than anything you can do natively.

A brief example of how you would do this, note that I specifically don't give working examples of scripts as someone implementing them needs to be able to maintain them.

#Collect the current certificates#
Get_Cert_List = requests.get('https://' + str(myFirewallUrl) + '/api/?type=config&action=get&xpath=/config/shared/certificate',headers=headers)

#Take the return and parse it#
Certificate_Dict = xmltodict.parse(Get_Cert_List.content)

Certificates = Certificate_Dict['response']['result']['certificate']['entry']
for Certificate in Certificates:
    Certificate_Name = Certificate['@name']
    Certificate_Expiration = Certificate['not-valid-after']
    Certificate_ExpiryEpoch = Certificate['expiry-epoch']
    Expiration_Date = datetime.datetime.fromtimestamp(int(Certificate_ExpiryEpoch))
    Current_Date = datetime.datetime.now()
    Date_Delta = Expiration_Date - Current_Date
    Day_Count = Date_Delta.days
    if Day_Count <=30:
        Alert_Certificate_Expiration(Certificate_Name=str(Certificate_Name),Certificate_Expiration=str(Certificate_Expiration),Date_Delta=str(Day_Count),NoAlert=NoAlert)

This should give you enough of an example if you choose to do this through the API that is more adaptable to what you specifically want.