Configure Certificate Expiry Alert

Certificate expiry alerts can be configured for four (4) different alert levels. These alert levels can be configured independent of each other.

  1. Enter the configure terminal mode.
    SLX # configure terminal
  2. Configure the Info certificate expiry alert level. Here the Info level is configured and set to fifty (50) days.
    SLX (config)# crypto cert expiry-level info period 50
    SLX (config)# 
  3. Configure the Minor certificate expiry alert level. Here the Minor level is configured and set to thirty (30) days.
    SLX (config)# crypto cert expiry-level minor period 30
    SLX (config)#
  4. Configure the Major certificate expiry alert level. Here the Major level is configured and set to ten (10) days.
    SLX (config)# crypto cert expiry-level major period 10
    SLX (config)# 
  5. Configure the Critical certificate expiry alert level. Here the level is configured to five (5) days.
    SLX (config)# crypto cert expiry-level critical period 5
    SLX (config)# 

The certificate expiry alert level is configured for the Info, Minor, Major, and Critical levels only.

The notifications are generated in the following order, based on the above configuration example:

  • On the fiftieth (50th) day, you will receive one Warning notification with the level info.

  • On the thirtieth (30th) day, you will receive one Warning notification with the level minor. You will not receive any notifications of the type info in between.

  • On the tenth (10th) day from certificate expiry, you will receive one Warning notification with the level major. You will not receive any notifications of the type minor in between.

  • On the fifth (5th) day from certificate expiry, you will receive one Warning notification with the level critical. You will not receive any notifications of the type major in between.

  • Once the certificate has expired, you will receive an Error notification every day at midnight (00:00 hours) till the certificate is renewed or its validity extended.

Each Warning notification will be sent with the alert level mentioned in message and the details of the certificate which is about to expire. The calculation, as to when to send the notification, will consider time to the granularity of days and will disregard the hours, minutes or seconds remaining till certificate expiry.

Note

Note

  • This configuration is affected by the Year 2038 Problem. On or after the 19th of January 2038 (2038-01-19), due to a change in system time, the Certificate Expiry Alert feature will stop working.

  • Certificate validity verification is performed once every 24 hours at midnight (00:00 hours). When configured, the certificate expiration event might not get triggered immediately and depends on the time of day when the configuration is performed. It is only triggered when the device's clock next reaches 00:00 hours.

  • Notifications will be sent once after the configuration is done. When the system's clock is reset within the last 24 hours to the previous day, certificate expiry alert will not be generated.