6.1 Getting the Certificate Expiration Notification

You can receive advance notification by running a bash script in the Administration Console. This script retrieves all the server certificate expiration dates through LDAP and checks the dates against the current month and year. If the certificate expires within the same month or it has already expired, you get a notification through an email. If the certificate is going to expire on the same day that the script is run, you get a special warning to repair the certificates immediately.

This script should be configured to run on the first day of the month at midnight. If the server certificate expired on the first day of the month before the start of the work day (for example, at 1 a.m.), the administrators should have already received an email.

Sample Bash Script:

DOMAIN=novell.com
ADMIN="admin1@novell.com admin2@novell.com admin3@novell.com"
LDAPHOST=LDAPHOST.novell.com
Organization='o=novell'
CERTLOG=/tmp/CERTLOG.log
mkdir -p /tmp/
ldapsearch -h$LDAPHOST -p389 -x -b "$Organization" | 
grep -B1 nDSPKINotAfter > $CERTLOG
NUMOFLINES=`cat $CERTLOG | wc -l`
i=2
while [ $i -le $NUMOFLINES ]; do
VAR1=`cat $CERTLOG | head -n$i | tail -n2`
EXPIRY=`echo $VAR1 | sed -e 's/nDSPKINotAfter: /~/' | cut -d~ -f2`
EXPIRY_YYYYMM=`echo $EXPIRY | cut -c-6`
CURRENT_YYYYMM=`date +%Y%m`
if [ $EXPIRY_YYYYMM -le $CURRENT_YYYYMM ]; then
EXPIRY_DATE=`echo $EXPIRY | cut -c-8`
EXPIRY_DAY=`echo $EXPIRY | cut -c7-8`
EXPIRY_MTH=`echo $EXPIRY | cut -c5-6`
EXPIRY_YEAR=`echo $EXPIRY | cut -c1-4`
CURRENT_DATE=`date +%Y%m%d`
CERTNAME=`echo $VAR1 | sed -e 's/nDSPKINotAfter: /~/' | cut -d~ -f1`
if [ $EXPIRY_DATE == $CURRENT_DATE ]; then
echo "Please use iManager to repair the Certificate IMMEDIATELY" | 
mail -r $HOST@$DOMAIN -s "Server Certificate will expire TODAY!! -->
$CERTNAME" $ADMIN
else        
echo "Please use iManager to repair the Certificate" | 
mail -r $HOST@$DOMAIN -s "Server Certificate will expire 
on $EXPIRY_DAY-$EXPIRY_MTH-$EXPIRY_YEAR (DD-MM-YYYY) --> 
$CERTNAME" $ADMIN
fi   
fi   ((i=$i+3))
done