CISCO-PKI-MIB

All MIBs › CISCO-PKI-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2014-10-16

Category: Cisco Devices, VPN and Security

Description: Manages PKI certificate enrollment, trustpoints, and certificate lifecycle on Cisco security-enabled devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-PKI-MIB?

CISCO-PKI-MIB manages Public Key Infrastructure (PKI) operations on Cisco devices, covering certificate enrollment, trustpoints, certificate chains, and certificate revocation lists (CRLs). It exposes configuration/inventory data about installed certificates -- issuer, subject, serial number, validity dates -- and about the trustpoints and CRLs used to validate them. It supports monitoring software/security status: certRemainingLife and certEndDate let an operator detect certificates approaching expiration before they cause an outage of certificate-dependent services (e.g., VPN, HTTPS management). It has no dependency on external standard MIBs beyond general X.509/PKIX certificate conventions it models in SNMP form. It is deployed on Cisco security-capable routers, switches, and VPN devices that use PKI-based authentication for management access, VPN tunnels, or 802.1X. Engineers can download the CISCO-PKI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-PKI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco router/switch/VPN device with PKI (certificate-based) authentication enabled

Monitoring Examples

certChainTable/certChainEntry rows (indexed by certChainLabel) expose certSerialNum, certIssuerName, certStartDate, certEndDate, and certRemainingLife, letting an administrator poll for certificates nearing expiration before a VPN tunnel or HTTPS service fails. certTpLabel and certSubName identify which trustpoint and subject a given certificate belongs to, while pkiCRLTable tracks the certificate revocation lists used to validate peer certificates. A shrinking certRemainingLife value on a device's own identity certificate would trigger a renewal action ahead of an outage.

What Can Be Monitored

certificate remaining validity/expiration date
certificate issuer/subject
trustpoint association
CRL status

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TimeInterval

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoPkiMIB	1.3.6.1.4.1.9.9.854			description
ciscoPkiMIBNotifs	1.3.6.1.4.1.9.9.854.1
NTF ciscoPkiCertInstallAlert	1.3.6.1.4.1.9.9.854.1.1			When a certificate is installed on the device, notification will be sent with following information. a) Certificates Serial number b) Certificate Issuer-name c) Certificate Subject name d) Trustpoint name e) Type of certificate. (i.e. CA/ID) certificate f) Certificate Start Date g) Certificate End Date Alert will not be sent for RA certificates, trustpool certificates and self-signed non-persistent certificates.
NTF ciscoPkiCertExpiryAlert	1.3.6.1.4.1.9.9.854.1.2			Certificate Expiry alert consists of following a) Certificate Serial number b) Certificate Issuer-name c) Trustpoint name d) Type of certificate (i.e. CA/ID/SUBCA/RA) e) Certificate remaining lifetime in seconds. f) Certificate subject-name When a certificate is reaching its expiry on the router, a trap will be sent to SNMP server at regular intervals starting from 60days to till 1week. From 1week onwards daily one trap will be sent with following information a) Certificate Serial number b) Certificate Issuer-name c) Trustpoint name d) Type of certificate (i.e. CA/ID) e) Certificate remaining lifetime. Alert will not be sent if trustpoint is configured with auto-enroll and corresponding shadow certificate/rollover certificate is present provided, shadow/rollover certificates start time is same/behind certificate end time. If shadow/rollover certificate start time is ahead of certificate end time, alerts will be continued to send because shadow certificate wont be valid from certificates expiry time. Expiry alerts will not be sent for trustpool certificates.
ciscoPkiMIBObjects	1.3.6.1.4.1.9.9.854.2
ciscoPkiConfiguration	1.3.6.1.4.1.9.9.854.2.1
ciscoPkiEnrollmentProfile	1.3.6.1.4.1.9.9.854.2.1.1
ciscoPkiEnrollmentTable	1.3.6.1.4.1.9.9.854.2.1.1.1		not-accessible	Please enter the Table Description here.
enrollProfEntry	1.3.6.1.4.1.9.9.854.2.1.1.1.1		not-accessible	An entry (conceptual row) in the xxxTable.
STR enrollProfLabel	1.3.6.1.4.1.9.9.854.2.1.1.1.1.3	DisplayString	not-accessible	Unique value to display Enrollment Label. If enrollment profiles are not present, string size of 0 will show nothing.
STR enrolCredentials	1.3.6.1.4.1.9.9.854.2.1.1.1.1.4	DisplayString	read-only	Please enter the object description here
STR authLocation	1.3.6.1.4.1.9.9.854.2.1.1.1.1.5	DisplayString	read-only	Please enter the object description here
STR authMethod	1.3.6.1.4.1.9.9.854.2.1.1.1.1.6	DisplayString	read-only	Please enter the object description here
STR authVrf	1.3.6.1.4.1.9.9.854.2.1.1.1.1.7	DisplayString	read-only	Please enter the object description here
STR authSourceInter	1.3.6.1.4.1.9.9.854.2.1.1.1.1.8	DisplayString	read-only	Please enter the object description here
STR enrolMethod	1.3.6.1.4.1.9.9.854.2.1.1.1.1.9	DisplayString	read-only	Enrollment method will be displayed which will be used to authenticate and enroll. If enrollment method is configured as terminal, this parameter gives enrollment terminal If enrollment method is configured with url, this parameter returns enrollment url ip_addresss If vrf is configured as part of enrollment url, it will be shown as part of enrollment url ip_address vrf interface
STR enrolLocation	1.3.6.1.4.1.9.9.854.2.1.1.1.1.10	DisplayString	read-only	Please enter the object description here
STR enrolVrf	1.3.6.1.4.1.9.9.854.2.1.1.1.1.11	DisplayString	read-only	Please enter the object description here
STR enrolSourceInter	1.3.6.1.4.1.9.9.854.2.1.1.1.1.12	DisplayString	read-only	Please enter the object description here
STR reenrolMethod	1.3.6.1.4.1.9.9.854.2.1.1.1.1.13	DisplayString	read-only	Please enter the object description here
STR reenrolLocation	1.3.6.1.4.1.9.9.854.2.1.1.1.1.14	DisplayString	read-only	Please enter the object description here
STR reenrolVrf	1.3.6.1.4.1.9.9.854.2.1.1.1.1.15	DisplayString	read-only	Please enter the object description here
STR reenrolSourceInter	1.3.6.1.4.1.9.9.854.2.1.1.1.1.16	DisplayString	read-only	Please enter the object description here
ciscoPkiTrustpoints	1.3.6.1.4.1.9.9.854.2.1.2
pkiTPTable	1.3.6.1.4.1.9.9.854.2.1.2.1		not-accessible	Please enter the Table Description here.
pkiTPEntry	1.3.6.1.4.1.9.9.854.2.1.2.1.1		not-accessible	An entry (conceptual row) in the xxxTable.
STR tpLabel	1.3.6.1.4.1.9.9.854.2.1.2.1.1.1	DisplayString	not-accessible	Unique name of Trustpoint Label. When there is no trustpoint configured, size 0 shows no trustpoint configured.
STR subjectName	1.3.6.1.4.1.9.9.854.2.1.2.1.1.2	DisplayString	read-only	Subject name configured under the trustpoint will be returned
STR subjectAltName	1.3.6.1.4.1.9.9.854.2.1.2.1.1.3	DisplayString	read-only	subject alternate name configured under the trustpoint which can be used while generating the csr.
STR aaaListInfo	1.3.6.1.4.1.9.9.854.2.1.2.1.1.4	DisplayString	read-only	Returns AAA authorization list to be used configured under trustpoint. AAA authorization list will be used during peer certificate validations etc. In order to access information on AAA list, please check AAA MIB corresponding to this AAA label.
STR enrollmentConfig	1.3.6.1.4.1.9.9.854.2.1.2.1.1.5	DisplayString	read-only	Enrollment configuration which is configured under the trustpoint will be returned.
STR vrfConfig	1.3.6.1.4.1.9.9.854.2.1.2.1.1.6	DisplayString	read-only	VRF interface configured under trustpoint which can be used for enrollment and obtaining CRL's
STR sourceInter	1.3.6.1.4.1.9.9.854.2.1.2.1.1.7	DisplayString	read-only	source Interface configured under trustpoint.
STR autoEnroll	1.3.6.1.4.1.9.9.854.2.1.2.1.1.8	DisplayString	read-only	If autoEnroll is configured under the trustpoint, autoEnroll returns with the percentage configured. If the percentage is not configured, but auto-enroll is configured under trustpoint, this parameter return auto-enroll. If percentage is configured, parameter returns auto-enroll
STR keyPairLabel	1.3.6.1.4.1.9.9.854.2.1.2.1.1.10	DisplayString	read-only	Displays keypairLabel associated to this trustpoint if it is enrolled. During authentication, we wont generate the keypair Label.
STR revocationMethod	1.3.6.1.4.1.9.9.854.2.1.2.1.1.11	DisplayString	read-only	This object displays revocation check configured on the device. If nothing is configured under the trustpoint, by default revocation-check crl will be updated.
STR hashAlgo	1.3.6.1.4.1.9.9.854.2.1.2.1.1.12	DisplayString	read-only	Hash algorithm configured under the trustpoint. This will be used while selecting the HASH algorithm when CA server responded with GetCACapabilities list. Default value is sha1
STR trustpointState	1.3.6.1.4.1.9.9.854.2.1.2.1.1.13	DisplayString	read-only	Trustpoint state displays following 1) Authenticated - Trustpoint is in Authenticated state. 2) Enrolled - Trustpoint is authenticated and enrolled. Certificate state is granted. 3) Pending - Trustpoint is authenticated but enrollment is in pending state. This means CA server returned PENDING for the router certificate. 4) None - Trustpoint is neither authenticated nor enrolled.
ciscoPkiCertificates	1.3.6.1.4.1.9.9.854.2.2
certChainTable	1.3.6.1.4.1.9.9.854.2.2.1		not-accessible	Please enter the Table Description here.
certChainEntry	1.3.6.1.4.1.9.9.854.2.2.1.1		not-accessible	An entry (conceptual row) in the xxxTable.
STR certChainLabel	1.3.6.1.4.1.9.9.854.2.2.1.1.1	DisplayString	not-accessible	Please enter the object description here
STR certSerialNum	1.3.6.1.4.1.9.9.854.2.2.1.1.2	DisplayString	read-only	Please enter the object description here
STR certIssuerName	1.3.6.1.4.1.9.9.854.2.2.1.1.3	DisplayString	read-only	Please enter the object description here
STR certStartDate	1.3.6.1.4.1.9.9.854.2.2.1.1.4	DisplayString	read-only	Please enter the object description here
STR certEndDate	1.3.6.1.4.1.9.9.854.2.2.1.1.5	DisplayString	read-only	Please enter the object description here
STR certType	1.3.6.1.4.1.9.9.854.2.2.1.1.6	DisplayString	read-only	Please enter the object description here
STR certRemainingLife	1.3.6.1.4.1.9.9.854.2.2.1.1.7	DisplayString	accessible-for-notify	Please enter the object description here
STR certTpLabel	1.3.6.1.4.1.9.9.854.2.2.1.1.8	DisplayString	read-only	Please enter the object description here
STR certSubName	1.3.6.1.4.1.9.9.854.2.2.1.1.9	DisplayString	read-only	Please enter the object description here
ciscoPkiRevocationInfo	1.3.6.1.4.1.9.9.854.2.3
ciscoPkiCRLInfo	1.3.6.1.4.1.9.9.854.2.3.1
pkiCRLTable	1.3.6.1.4.1.9.9.854.2.3.1.1		not-accessible	Please enter the Table Description here.
pkiCRLEntry	1.3.6.1.4.1.9.9.854.2.3.1.1.1		not-accessible	An entry (conceptual row) in the xxxTable.
STR crlTpLabel	1.3.6.1.4.1.9.9.854.2.3.1.1.1.1	DisplayString	not-accessible	Unique trustpoint Label
STR issuerName	1.3.6.1.4.1.9.9.854.2.3.1.1.1.2	DisplayString	read-only	CRL Issuer name
STR sequenceNumb	1.3.6.1.4.1.9.9.854.2.3.1.1.1.3	DisplayString	read-only	Please enter the object description here
STR nextUpdate	1.3.6.1.4.1.9.9.854.2.3.1.1.1.4	DisplayString	read-only	Please enter the object description here
U32 crlSize	1.3.6.1.4.1.9.9.854.2.3.1.1.1.5	Unsigned32	read-only	Please enter the object description here
U32 deltaCRLFlag	1.3.6.1.4.1.9.9.854.2.3.1.1.1.6	Unsigned32	read-only	This object specifies the storage type for this conceptual row. The following columnar objects are allowed to be writable when the storageType of this conceptual row is permanent(4): (replace with list of columns)
ciscoPkiOSCPInfo	1.3.6.1.4.1.9.9.854.2.3.2
pkiOCSPTable	1.3.6.1.4.1.9.9.854.2.3.2.1		not-accessible	Please enter the Table Description here.
pkiOCSPEntry	1.3.6.1.4.1.9.9.854.2.3.2.1.1		not-accessible	An entry (conceptual row) in the xxxTable.
STR ocspTpLabel	1.3.6.1.4.1.9.9.854.2.3.2.1.1.1	DisplayString	not-accessible	Please enter the object description here
STR responderID	1.3.6.1.4.1.9.9.854.2.3.2.1.1.2	DisplayString	read-only	An identifier of the responder (DN name or a hash of its key)
STR thisUpdate	1.3.6.1.4.1.9.9.854.2.3.2.1.1.3	DisplayString	read-only	The issuing time of the revocation information.
STR nexUpdate	1.3.6.1.4.1.9.9.854.2.3.2.1.1.4	DisplayString	read-only	The issuing time of the revocation information that will update that one.
ciscoPkiMIBConform	1.3.6.1.4.1.9.9.854.3
ciscoPkiMIBCompliances	1.3.6.1.4.1.9.9.854.3.1
ciscoPkiMIBCompliance	1.3.6.1.4.1.9.9.854.3.1.1			This is a default module-compliance containing default object groups.
ciscoPkiMIBGroups	1.3.6.1.4.1.9.9.854.3.2
ciscoPkiMIBMainObjectGroup	1.3.6.1.4.1.9.9.854.3.2.1			The is a test group.
ciscoPkiMIBNotificationGroup	1.3.6.1.4.1.9.9.854.3.2.2			Notification alert group consists of both installation and expiry notifications.

RFC description

Manages Public Key Infrastructure configuration including certificates, trustpoints, and certificate enrollment profiles.

Start monitoring Cisco router/switch/VPN device with PKI authentication with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-PKI-MIB

What Is CISCO-PKI-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description