Orion Poplawski via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Does anyone know of a script or way to get a list of certificates
issued by
the IPA CA that are about to expire?
I do have a small script for byobu that warns when certificates are
about to expire and I verify refresh really works - that's only useful
for small installations with a small number of certificates.
In short: get a time interval with date and feed the dates into "ipa
cert-find". Have fun!
#! /bin/bash
#
# Display the expiring certificates for the next few weeks
# This is called from byobu every 20 minutes
#
now=$(date +"%Y-%m-%d")
end=$(date -d "+27 days" +"%Y-%m-%d")
count=0
revoked=0
# If we call the script manually with "--verbose", give a list
# of the expiring certificates - display subject, expiry date and
# serial number. Stop the script execution.
if [ "x$1" = "x--verbose" ]; then
env LC_ALL=C.UTF-8 KRB5_CLIENT_KTNAME=~/work/freeipa/jochen.keytab \
ipa cert-find --validnotafter-from="$now" --validnotafter-to="$end" |
\
grep -E "(Subject|Not After|Serial number):"
exit
fi
# Count the expiring and possibly revoked certificates
eval "$(env LC_ALL=C.UTF-8 ipa cert-find --validnotafter-from="$now"
--validnotafter-to="$end" | \
awk '/certificates matched/ { count=$1 } /REVOKED/ { revoked++ } END {
printf("count=%d\nrevoked=%d\n", count, revoked) }')"
# If no cert is near expiry - display nothing
if [ "$count" -ne 0 ]; then
if [ "$count" -eq "$revoked" ]; then
# all expiring certificates are also revoked - display green
echo "#[fg=green]$count certs, $revoked revoked#[default]"
else
# there are expiring certificates which are possibly still active
# Looking for a already renewed certificate seems to be
# expensive performance-wise.
echo "#[bg=red]$count certs, $revoked revoked#[default]"
fi
fi
--
This space is intentionally left blank.