All MIBs › CISCO-PKI-MIB › ciscoPkiCertExpiryAlert
ciscoPkiCertExpiryAlert
Module: CISCO-PKI-MIB
OID (symbolic): CISCO-PKI-MIB::ciscoPkiCertExpiryAlert
OID (numeric): 1.3.6.1.4.1.9.9.854.1.2
Node type: NOTIFICATION-TYPE
Description: Certificate Expiry alert consists of following a) Certificate Serial number b) Certificate Issuer-name c) Trustpoint name d) Type of certificate (i.e. CA/ID/SUBCA/RA) e) Certificate remaining lifetime in seconds. f) Certificate subject-name
When a certificate is reaching its expiry on the router, a trap will be sent to SNMP server at regular intervals starting from 60days to till 1week. From 1week onwards daily one trap will be sent with following information
a) Certificate Serial number b) Certificate Issuer-name c) Trustpoint name d) Type of certificate (i.e. CA/ID) e) Certificate remaining lifetime.
Alert will not be sent if trustpoint is configured with auto-enroll and corresponding shadow certificate/rollover certificate is present provided, shadow/rollover certificates start time is same/behind certificate end time.
If shadow/rollover certificate start time is ahead of certificate end time, alerts will be continued to send because shadow certificate wont be valid from certificates expiry time.
Expiry alerts will not be sent for trustpool certificates.
Examples
Send this trap to an SNMP manager — replace <manager> with the IP or hostname of your monitoring server (SNMPv2c):
snmptrap -v2c -c public <manager> '' CISCO-PKI-MIB::ciscoPkiCertExpiryAlert snmptrap -v2c -c public <manager> '' 1.3.6.1.4.1.9.9.854.1.2
Listen for incoming traps on the manager host (-f keeps it in the foreground, -Lo prints to stdout — useful for testing):
snmptrapd -f -Lo -c /dev/null authCommunity log public
Example snmptrapd log entry:
zoo11-linux.zoo [UDP: [192.168.30.111]:64704->[192.168.30.10]:162]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (379530944) 43 days, 22:15:09.44 SNMPv2-MIB::snmpTrapOID.0 = OID: CISCO-PKI-MIB::ciscoPkiCertExpiryAlert
Start monitoring Cisco router/switch/VPN device with PKI authentication with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the CISCO-PKI-MIB::ciscoPkiCertExpiryAlert OID value, configure state conditions and alerts, and monitor any Cisco router/switch/VPN device with PKI authentication from a single console.
OID Breakdown
Upper-level ancestors (8 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.9 | cisco | CAT2600-MIB |
| 1.3.6.1.4.1.9.9 | ciscoMgmt | CISCO-SMI |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.9.9.854 | ciscoPkiMIB | CISCO-PKI-MIB |
| 1.3.6.1.4.1.9.9.854.1 | ciscoPkiMIBNotifs | CISCO-PKI-MIB |
| 1.3.6.1.4.1.9.9.854.1.2 | ciscoPkiCertExpiryAlert | CISCO-PKI-MIB |