All cryptographic certificates have an effective lifetime. This lifetime is defined in the validity fields notBefore and notAfter values stored within each cryptographic certificate. Ideally, a cryptographic certificate should not be used prior to the date configured in the notBefore field. The cryptographic certificate is considered as expired beyond the date configured in the notAfter field and should not be used after that date.
When a cryptographic certificate nears its expiration date, then a notification is generated with the configured warning level.
Note
Notifications can be RASLog or SNMP or both.
Notifications to users can be classified as Warning or Error as seen in the RASLOG entries. Messages of the type Warnings are only generated if the alert levels are configured. The valid alert levels are INFO, MINOR, MAJOR, and CRITICAL and are configured independent of each other. These classifications are applicable to both RASLOG entries and SNMP Notifications.
The notifications of the type Error are always generated irrespective of the configured alert levels. By default, RASLOGs are always written for notifying certificate expiry. SNMP notifications are only generated when SNMP is enabled on the device.
For the Warning type of messages, when notifications are generated, these incorporate the configured alert level, along with the details of the expiring certificate. This is generated for each certificate that will expire in the near term.
A single warning is generated when the number of remaining days for a certificate's expiry is equal to (=) or becomes lesser than (<) the configured period for that severity level.
For the Error type of messages, notifications are always generated once a day at midnight (00:00 hours) for each certificate that has expired. This notification is generated till the expired certificates are renewed or their validity extended.
Depending on the setting of the notAfter field in each certificate, the generation of the notification may be delayed by upto 24 hours.
Certificate validity verification is performed once every 24 hours at midnight (00:00 hours). When configured, the certificate expiration event might not get triggered immediately and depends on the time of day when the configuration is performed. It is only triggered when the device's clock next reaches 00:00 hours.
The following certificates are monitored for expiry: