XEDIA-PKI-MIB

All MIBs › XEDIA-PKI-MIB

Organization: Xedia Corp.

Last Updated: 1998-09-16

Description: Xedia Public Key Infrastructure MIB managing RSA/DSA key pairs, X.509 certificates, and PKI enrollment configuration on Xedia network devices

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is XEDIA-PKI-MIB?

XEDIA-PKI-MIB is a Xedia Corporation proprietary MIB managing the router's PKI (Public Key Infrastructure) subsystem — key pairs, certificate requests, and installed certificates — for IPsec/VPN authentication. Its objects cover subject-name format/distinguished-name, an LDAP server reference, a key-pair table (name, algorithm, length, row status), a certificate-request table (public key, signature algorithm/signature, PEM-encoded request), a new-certificate install action, and a certificate table (subject/issuer names, associated key pair, type, serial number, validity start). As a configuration/status MIB it lets an administrator confirm a certificate's validity window and which key pair it's bound to before relying on it for VPN authentication. It is deployed on Xedia Corporation routers. Engineers can download the XEDIA-PKI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in XEDIA-PKI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Xedia Corporation routers

Monitoring Examples

An administrator checks pkiCertValidNotBefore alongside the certificate's issuer name to confirm a newly-installed PKI certificate is valid and correctly chained before enabling certificate-based IPsec authentication.

What Can Be Monitored

PKI key pairs and certificate validity

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Gauge32
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

From XEDIA-REG

LongDisplayString
xediaMibs	OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using pkiCrlRevokedCerts OID:

Select a Xedia Corporation router (certificate/key-pair validity status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type pkiCrlRevokedCerts into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of revoked certificates in this CRL. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Gauge32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
xediaPkiMIB	1.3.6.1.4.1.838.3.24			This module defines objects for management of Xedia's Public Key Infrastructure subsystem.
pkiObjects	1.3.6.1.4.1.838.3.24.1
pkiSubsystemGroup	1.3.6.1.4.1.838.3.24.1.1
BIT pkiSubjNameFormat	1.3.6.1.4.1.838.3.24.1.1.1	Bits	read-write	This object is used to specify the format of the subject name(s) for this system in PKI certificates and requests. There are multiple options for forming the subject's distinguished name. distNameFromLDAP(0) will use the system's LDAP directory name. distNameFromRtrAddr(1) will use the system's router IP address. If both options are disabled, then the pkiSubjDistName is set explicitly by the administrator. Default is distNameFromRtrAddr(1). The incIpAddrExt(3) option specifies that the system's router IP address (if configured) should be included as a subject alternate name extension in certificate requests. By default, this option is enabled. The incFQDomainNameExt(4) option specifies that the system's fully qualified domain name (if configured) should be included as a subject alternate name extension in certificate requests. By default, this option is enabled.
STR pkiSubjDistName	1.3.6.1.4.1.838.3.24.1.1.2	DisplayString	read-write	The X500 distinguished name for this system. This name corresponds to the subject name in this gateway's certificates and requests. For example: 'C=US, O=Xedia Corp, CN=198.202.232.217' This object can be set explicitly or may reflect the system's LDAP or router address as specified by pkiSubjNameFormat.
STR pkiLdapServer	1.3.6.1.4.1.838.3.24.1.1.3	DisplayString	read-write	The name of the LDAP Server used as the default Certificate and CRL repository. This may be in the form of a DNS or IP address with an optional port number specified after a colon. For example: 'ldap.xedia.com' '198.202.232.121' 'ldap.xedia.com:389' '198.202.232.121:389' When this object is set to a valid server, LDAP is automatically enabled as a PKI certificate and CRL retrieval mechanism. If cleared, LDAP is disabled for PKI purposes.
pkiKeyPairTable	1.3.6.1.4.1.838.3.24.1.2		not-accessible	The PKI key pair table is used to administer public/private key pairs for this system.
pkiKeyPairEntry	1.3.6.1.4.1.838.3.24.1.2.1		not-accessible	The attributes of a single PKI Key Pair. Note that a PkiKeyPairEntry cannot be modified if referenced by a PkiCertRqstEntry.
PKI pkiKeyPairName	1.3.6.1.4.1.838.3.24.1.2.1.1	PkiKeyPairName	not-accessible	The administrative name given to the key pair.
PKI pkiKeyPairAlgorithm	1.3.6.1.4.1.838.3.24.1.2.1.2	PkiAlgorithm	read-create	The algorithm used to generate the key pair.
I32 pkiKeyPairLength	1.3.6.1.4.1.838.3.24.1.2.1.3	Integer32	read-create	The length of the public key in bits. For RSA keys, the valid range is 512 to 2048, and the default is 1024. For DSS keys, the valid range is 512 to 1024, and the default is 1024.
ROW pkiKeyPairRowStatus	1.3.6.1.4.1.838.3.24.1.2.1.4	RowStatus	read-create	This object is used to create and delete entries in this table.
pkiCertRqstTable	1.3.6.1.4.1.838.3.24.1.3		not-accessible	The PKI key pair table is used to administer PKCS #10 certificate requests for this system.
pkiCertRqstEntry	1.3.6.1.4.1.838.3.24.1.3.1		not-accessible	The attributes of a single PKCS #10 certificate request.
PKI pkiCertRqstPublicKey	1.3.6.1.4.1.838.3.24.1.3.1.1	PkiKeyPairName	not-accessible	The system's public key included in this certificate request. This object references an entry in the pkiKeyPairTable.
PKI pkiCertRqstSigAlgorithm	1.3.6.1.4.1.838.3.24.1.3.1.2	PkiSigAlgorithm	read-create	The signature algorithm used to sign the public key information in this certificate request. For both RSA and DSA key pairs, the hash will default to SHA-1.
OCT pkiCertRqstSignature	1.3.6.1.4.1.838.3.24.1.3.1.3	OCTET STRING	read-only	The signature of the certificate request. After the certificate request is tranported to the CA, many CAs display the certificate request signature and suggest that it is checked against the signature on the generating system.
STR pkiCertRqstPem	1.3.6.1.4.1.838.3.24.1.3.1.4	PemString	read-only	The full ANS.1 DER encoded PKCS #10 certificate request in PEM/base64 format. This object may be manually cut and pasted over to the certificate authority for X.509 certificate generation.
STR pkiNewCert	1.3.6.1.4.1.838.3.24.1.4	PemString	read-write	X.509 Certificate generated by a Certificate Authority based on the pkiPublicKeyCertRequest information in base64/PEM format. This object provides a manual mechanism for the administrator to load static certificates into the pkiCertTable. When this object is written, the system parses the certificate and loads it into the local certificate database as a static entry.
pkiCertTable	1.3.6.1.4.1.838.3.24.1.5		not-accessible	This table contains the certificates in the system's local database including static certificates loaded via network management and dynamic certificates retrieved from certificate operational protocols such as LDAP.
pkiCertEntry	1.3.6.1.4.1.838.3.24.1.5.1		not-accessible	The attributes that make up a single certificate.
I32 pkiCertIndex	1.3.6.1.4.1.838.3.24.1.5.1.1	Integer32	read-only	The unique index for this certificate.
STR pkiCertSubjNames	1.3.6.1.4.1.838.3.24.1.5.1.2	DisplayString	read-only	The subject name(s) of the network entity or user being certified. The certificate's subject name can consist of multiple names including distinguished name fields, IP Address, domain name, etc. This object concatenates all these names into one string.
STR pkiCertIssuerNames	1.3.6.1.4.1.838.3.24.1.5.1.3	DisplayString	read-only	The name(s) of the certificate authority which issued this certificate. The certificate's issuer name can consist of multiple names including distinguished name fields, IP Address, domain name, etc. This object concatenates all these names into one string.
PKI pkiCertKeyPair	1.3.6.1.4.1.838.3.24.1.5.1.4	PkiKeyPairName	read-only	This system's public/private keypair associated with this certificate. If the certificate is not for this gateway, the object will be a zero length string.
PKI pkiCertType	1.3.6.1.4.1.838.3.24.1.5.1.5	PkiCertType	read-only	The type of certificate.
STR pkiCertSerialNum	1.3.6.1.4.1.838.3.24.1.5.1.6	DisplayString	read-only	The serial number for this certificate.
STR pkiCertValidNotBefore	1.3.6.1.4.1.838.3.24.1.5.1.7	DisplayString	read-only	The start of the validity period for this certificate.
STR pkiCertValidNotAfter	1.3.6.1.4.1.838.3.24.1.5.1.8	DisplayString	read-only	The end of the validity period for this certificate.
INT pkiCertCreation	1.3.6.1.4.1.838.3.24.1.5.1.9	INTEGER	read-only	Specifies how the certificate was obtained. If a dynamic certificate is modified via network management, it becomes 'static'.
T/F pkiCertCertAuthority	1.3.6.1.4.1.838.3.24.1.5.1.10	TruthValue	read-only	Indicates whether or not this certificate is for a Certificate Authority.
T/F pkiCertCrlIssuer	1.3.6.1.4.1.838.3.24.1.5.1.11	TruthValue	read-write	Certificate Authorities periodically issue Certificate Revocation Lists (CRLs) for certificates which have been revoked. Certificates issued by a CA need to be checked against a current CRL issued by the CA, otherwise they cannot be trusted. By default, all CA's are considered CRL issuers. Disabling this object disables CRL checking when computing trust for subordinate certificates.
BIT pkiCertTrustStatus	1.3.6.1.4.1.838.3.24.1.5.1.12	Bits	read-only	The certificate's current trust status. If the trust computation succeeds, it will be 'trusted(0)' otherwise this object will give the set of errors detected while computing the trust status for this certificate. To be trusted(0), all issuer certificates in the chain must be trusted. Note that when a self signed root certificate is added, the trustStatus remains 'untrustedRoot(7)' until it is manually set trusted via pkiCertForceTrusted. This gives the administrator the opportunity to view and verify a root certificate before it is used to verify subordinate certificates.
T/F pkiCertForceTrusted	1.3.6.1.4.1.838.3.24.1.5.1.13	TruthValue	read-write	A mechanism whereby the administrator can set any certificate trusted. Enabling 'forceTrusted' will set the certificate trusted for it's entire validity period and if it's a CA certificate may result in subordinate certificates becoming trusted. Note that 'forceTrusted' must be set enabled for root certificates.
STR pkiCertSubjPubKeyAlgorithm	1.3.6.1.4.1.838.3.24.1.5.1.14	DisplayString	read-only	The subject's public key algorithm.
STR pkiCertSignatureAlgorithm	1.3.6.1.4.1.838.3.24.1.5.1.15	DisplayString	read-only	The algorithm used to sign the certificate.
OCT pkiCertSignature	1.3.6.1.4.1.838.3.24.1.5.1.16	OCTET STRING	read-only	The certificate's digital signature. After loading a CA certificate, it is recommended that this value be checked against the CA certificate signature to verify that the certificate was not compromised in transit.
INT pkiCertRemove	1.3.6.1.4.1.838.3.24.1.5.1.17	INTEGER	read-write	This object is used to delete certificates.
STR pkiNewCrl	1.3.6.1.4.1.838.3.24.1.6	PemString	read-write	X.509 Certificate Revocation list generated by a Certificate Authority in base64/PEM format. This object provides a manual mechanism for the administrator to load static CRLS into the pkiCrlTable. When this object is written, the system parses the CRL and loads it into the local CRL database as a static entry.
pkiCrlTable	1.3.6.1.4.1.838.3.24.1.7		not-accessible	This table contains the CRLs in the system's local database including static CRLs loaded via network management and dynamic CRLs retrieved from operational protocols such as LDAP.
pkiCrlEntry	1.3.6.1.4.1.838.3.24.1.7.1		not-accessible	The attributes that make up a single CRL.
I32 pkiCrlIndex	1.3.6.1.4.1.838.3.24.1.7.1.1	Integer32	read-only	The unique index for this CRL.
STR pkiCrlIssuerNames	1.3.6.1.4.1.838.3.24.1.7.1.2	DisplayString	read-only	The name(s) of the certificate authority which issued this CRL. The CRL's issuer name can consist of multiple names including distinguished name fields, IP Address, domain name, etc. This object concatenates all these names into one string.
STR pkiCrlNumber	1.3.6.1.4.1.838.3.24.1.7.1.3	DisplayString	read-only	The CRL number which is unique for all CRLs issued by a particular CA.
PKI pkiCrlType	1.3.6.1.4.1.838.3.24.1.7.1.4	PkiCertType	read-only	The type of certificates in the CRL.
STR pkiCrlUpdateTime	1.3.6.1.4.1.838.3.24.1.7.1.5	DisplayString	read-only	The time when this CRL was updated.
STR pkiCrlNextUpdateTime	1.3.6.1.4.1.838.3.24.1.7.1.6	DisplayString	read-only	The time when this CRL will be updated next.
BIT pkiCrlTrustStatus	1.3.6.1.4.1.838.3.24.1.7.1.7	Bits	read-only	The CRL's current trust status. If the trust computation succeeds, it will be 'trusted(0)' otherwise this object will give the set of errors detected while computing the trust status for this CRL. To be trusted, all issuer certificates in the chain must be trusted.
INT pkiCrlCreation	1.3.6.1.4.1.838.3.24.1.7.1.8	INTEGER	read-only	Specifies how the CRL was obtained. If a dynamic CRL is modified via network management, it becomes 'static'.
G32 pkiCrlRevokedCertsEx	1.3.6.1.4.1.838.3.24.1.7.1.9	Gauge32	read-only	The number of revoked certificates in this CRL.
INT pkiCrlRemove	1.3.6.1.4.1.838.3.24.1.7.1.10	INTEGER	read-write	This object is used to delete CRLs.
pkiCrlCertTable	1.3.6.1.4.1.838.3.24.1.8		not-accessible	This table contains the list of revoked certificates from CRLs in the pkiCrlTable.
pkiCrlCertEntry	1.3.6.1.4.1.838.3.24.1.8.1		not-accessible	A revoked certificate entry from a CRL.
I32 pkiCrlCertIndex	1.3.6.1.4.1.838.3.24.1.8.1.1	Integer32	read-only	The unique index for this CRL certificate.
STR pkiCrlCertSerialNumber	1.3.6.1.4.1.838.3.24.1.8.1.2	DisplayString	read-only	The serial number for the revoked certificate.
STR pkiCrlCertRevokedDate	1.3.6.1.4.1.838.3.24.1.8.1.3	DisplayString	read-only	The date and time at which the certificate was revoked.
STR pkiCrlCertInvalidDate	1.3.6.1.4.1.838.3.24.1.8.1.4	DisplayString	read-only	The date and time at which the certificate becomes invalid.
STR pkiCrlCertIssuerNames	1.3.6.1.4.1.838.3.24.1.8.1.5	DisplayString	read-only	The name(s) of the certificate authority which revoked the certificate. The certificate's issuer name can consist of multiple names including distinguished name fields, IP Address, domain name, etc. This object concatenates all these names into one string.
pkiConformance	1.3.6.1.4.1.838.3.24.2
pkiCompliances	1.3.6.1.4.1.838.3.24.2.1
pkiCompliance	1.3.6.1.4.1.838.3.24.2.1.1			The compliance statement for all agents that support this MIB. A compliant agent implements all objects defined in this MIB.
pkiGroups	1.3.6.1.4.1.838.3.24.2.2
pkiAllGroup	1.3.6.1.4.1.838.3.24.2.2.1			The set of all accessible objects in this MIB.

RFC description

Manages Public Key Infrastructure (PKI) subsystem including cryptographic key pairs, certificates, and algorithms for Xedia devices.

Start monitoring Xedia Corporation routers (certificate/key-pair validity status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download XEDIA-PKI-MIB