| Author |
Message
|
| sandiksk |
 Posted: Thu Mar 17, 2011 9:40 am Post subject: SSL certs monitoring from central server |
 |
|
Centurion
Joined: 08 Jun 2005
Posts: 133
|
Hi,
Wondering if we have any software or freeware tools to montior mq ssl certificate expiration dates from one central location, where we can provide hostname and port. Basically what i am looking for is from one place we should be able to go to each mq server, check for certification expiry and send a mail.
I found some like ssl-cert-check, ssl expire but I don't think they will work for MQ.
Looking forward to some suggestions
Thanks,
sandeep |
|
| Back to top |
|
 |
| bruce2359 |
| Posted: Thu Mar 17, 2011 9:46 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
| but I don't think they will work for MQ. |
Why do you think they won't work?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| sandiksk |
| Posted: Thu Mar 17, 2011 10:05 am Post subject: |
|
|
Centurion
Joined: 08 Jun 2005
Posts: 133
|
| Well from what i understood sslchecker etc take hostname and port, but with just those how can it know about kdb file location and expiry date unless it asks the queuemanager somehow and queuemanager gets back with expiry date. |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Thu Mar 17, 2011 10:19 am Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
| Quote: |
| how can it know about kdb file location and expiry date unless it asks the queuemanager somehow and queuemanager gets back with expiry date. |
The kdb file is not part of WMQ. The qmgr doesn't know about the location of the kdb file until you tell it by setting the appropriate qmgr attribute.
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| sandiksk |
| Posted: Thu Mar 17, 2011 10:24 am Post subject: |
|
|
Centurion
Joined: 08 Jun 2005
Posts: 133
|
| I understand kdb is not part of wmq. We specify the location in qmgr attribute sslkeyr. SSL is setup fine and is working. But my thing is will external script know by querying the queue manager port whether a certificate is expiring. |
|
| Back to top |
|
|
| exerk |
| Posted: Thu Mar 17, 2011 11:14 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| sandiksk wrote: |
| ...will external script know by querying the queue manager port whether a certificate is expiring. |
No. But neither is it difficult for your script to query the key stores on each server for the default certificate details, which will contain the information you seek.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| sandiksk |
| Posted: Thu Mar 17, 2011 11:19 am Post subject: |
|
|
Centurion
Joined: 08 Jun 2005
Posts: 133
|
Yes instead of reinventing the wheel i thought i can look for something that is already written. I basically need to be able to monitor all our mq server certificates for expiration and send a mail if any is expiring in sometime.
we have certnanny which does it locally on each server but we are looking for something to monitor from one central server. |
|
| Back to top |
|
|
| exerk |
| Posted: Thu Mar 17, 2011 11:44 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
So harvest the details from each server and put it into a centralised calendar programme that does a daily check and puts out a report of any that are due expiry from NOW + 28 days.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
|
|
