CA Configuration Automation

  • Private Community
 View Only

  • 1.  SSL Certification and Expiry dates

    Posted Apr 13, 2016 03:14 AM

    Hi Team,

     

    Is CA discovery is capable of detecting SSL certificates and their expiry dates. If yes, what is the procedure for the same to capture it.

    Any suggestions here?

    Regards



  • 2.  Re: SSL Certification and Expiry dates
    Best Answer

    Broadcom Employee
    Posted Apr 13, 2016 10:35 AM

    Hi,

     

    No, CCA cannot do that out of the box,you may be better off using a security scanner that can (but they usually get the registered certs, not the certs that may just be copied to the machine(, BUT, I did create the attached blueprint a few years back that does exactly that, gets all the ssl certificates (registered or not) along with the expired date.  Note, I only created it for Windows, if someone can do something for SSH and add it to the thread for the community, that would be great

     

    Please let me know if you have any questions, as mentioned it was a few years ago, havent tested it it since, but don't see why it shouldn't work on a Windows machine



  • 3.  Re: SSL Certification and Expiry dates

    Posted May 31, 2016 07:11 AM

    Hi Adnan,

     

    I have ran the custom blue print which you had provided but unfortunately it didn't detected SSL expiry certificates. It has only detected few certificates of other CA products.

    Could you please let me know how to proceed further on this? Do you want me to raise a support ticket for this one.?

     

    Regards

    VK



  • 4.  Re: SSL Certification and Expiry dates

    Broadcom Employee
    Posted May 31, 2016 09:41 AM

    Hi,

     

    This is an unsupported field developed utility, therefore, any support ticket won't be assisted to a great extent.  However, we can try our best to assist here in the communities

     

    What this blueprint does is run a VBS script with first running a query against a WMI Class to get all file names with extensions of:

    'cer','crt','csr','der','p7b','p7r','spc','pfx','p12','crl','ssl','stl','sto','pem','p12','key','jks','ser'

     

    If you have a cert file with a different extension, you can add it to the list within the Configuration --> Configuration Executables --> Get Certificate Expired Data --> Command (Windows)

     

    Next, for each cert found, it will lookup the "NotAfter" value, which is when the certificate will expire

    Those results will be displayed

     

    Keep in mind, this blueprint will get the expired dates, not get the expired certificates, meaning it will get any and all expired dates of a cert instead of checking if something is expired as of today.  The reason for this is, you may want to be proactive to renew the cert before it expires. everyone's process has a different timeline to do that so by displaying all, it covered the basis

     

    You are free to modify the script to either display expired ones or about to expire in N days if needed.

     

    Also, this does not just get the CA Products certificates, ti does any cert existing on the system,   The difference between this script and other products that inspect certificates is the other products usually look for (installed \ added  \ registered) certificates to the OS, versus any certificate file existing on the system, regardless of it being used or not

     

    Last thing to keep in mind is that it will check all drives, so the more files existing, the longer it will take,

     

    If any of the above does not help finding the the certificate in question (as you menaiton a few only fouynd, what was not found?), please let us know some details about the file and we can look at it more