Certificate expiry alerts can be configured for four (4) different alert levels. These alert levels can be configured independent of each other.
SLX # configure terminal
SLX (config)# crypto cert expiry-level info period 50 SLX (config)#
SLX (config)# crypto cert expiry-level minor period 30 SLX (config)#
SLX (config)# crypto cert expiry-level major period 10 SLX (config)#
SLX (config)# crypto cert expiry-level critical period 5 SLX (config)#
The certificate expiry alert level is configured for the Info, Minor, Major, and Critical levels only.
The notifications are generated in the following order, based on the above configuration example:
On the fiftieth (50th) day, you will receive one Warning notification with the level info.
On the thirtieth (30th) day, you will receive one Warning notification with the level minor. You will not receive any notifications of the type info in between.
On the tenth (10th) day from certificate expiry, you will receive one Warning notification with the level major. You will not receive any notifications of the type minor in between.
On the fifth (5th) day from certificate expiry, you will receive one Warning notification with the level critical. You will not receive any notifications of the type major in between.
Once the certificate has expired, you will receive an Error notification every day at midnight (00:00 hours) till the certificate is renewed or its validity extended.
Each Warning notification will be sent with the alert level mentioned in message and the details of the certificate which is about to expire. The calculation, as to when to send the notification, will consider time to the granularity of days and will disregard the hours, minutes or seconds remaining till certificate expiry.
Note
This configuration is affected by the Year 2038 Problem. On or after the 19th of January 2038 (2038-01-19), due to a change in system time, the Certificate Expiry Alert feature will stop working.
Certificate validity verification is performed once every 24 hours at midnight (00:00 hours). When configured, the certificate expiration event might not get triggered immediately and depends on the time of day when the configuration is performed. It is only triggered when the device's clock next reaches 00:00 hours.