topic Re: Tracking VPN certificate expiration in Aerohive Migrated Content

Tracking VPN certificate expiration

fraser_hess — Fri, 30 Aug 2019 22:30:43 GMT

The certificate on our Aerohive VPN appliance expired yesterday. We were able to quickly replace it and get folks up and running again, but this is at least the 3rd time this has happened. Looking to know how people track the expiration of certificates so that they can replace them before they expire. Our HTTPS certificates are found by Nessus and LogicMonitor, but neither of those systems "see" the certificate on UDP 500.

Re: Tracking VPN certificate expiration

samantha_lynn — Sat, 31 Aug 2019 01:41:55 GMT

We don't have a way to alert you that a certificate is expiring via the HiveManager or the CLI. I can put in a feature request to see if we can add this functionality to a later release if you would like?

Re: Tracking VPN certificate expiration

fraser_hess — Sat, 31 Aug 2019 02:33:30 GMT

I didn't think so, but I wondered how other customers manage that expiration if there's no alerting. Maybe a calendar appt, or a ticket that opens in the future, or some other monitoring.

Re: Tracking VPN certificate expiration

fraser_hess — Sat, 21 Sep 2019 00:56:12 GMT

The way we solved this in the end was to write a new test in our monitoring tool, which is LogicMonitor. This test logs into the VG-VA as a read-only user and runs "show vpn ike configuration | in After" which gives us the expiration date as a string. We turn this into a date and compare it to the current date.