Check For Expired Certificates

This is an interactive task for checking for expired and due to expire x509 certificates on an Ubuntu Server.

It requires:

A PAM Server to be provisioned as a Vault in PPA
One or more Ubuntu Server devices provisioned in the PAM Server
The Ubuntu Server control account must be part of the sudoers group

Playbook Files

plugins:
  pam: ~0.2
  ppa: ~3
  ppa_tools: ~3.3
  ssh: ~1

set:
  pam_address: example.pam.hostname # The hostname or IP address of the PAM server vault.
  expiry_seconds: 0
  expiring_in_days: 0
  cert_progress: 0
  expiring_certs: []
  expired_certs: []

steps:
  - name: Greeting
    actions:
      - ppa.ui.output_markdown:
          doc: >
            {{ globals.icons.ssh.full }}


            #### Check for Expired/Expiring Certificates



            This task allows you to select an Ubuntu Server device provisioned on your PAM Server, and check for expired/due to expire x509 certificates.


            You will need to:

            - Select an Ubuntu Server

            - Choose whether to view certificates close to expiry

            - Pick the number of days before expiry (if applicable)

      - ppa.ui.input_accept:
          text: Start

  - name: Get Devices
    actions:
      - pam.devices.search:
          queries:
            - attribute: device_vendor_name
              query: like
              value: "%canonical%"
        load:
          pam_address: pam_address
        save: devices

      - pam.devices.input_table:
          text: Select Ubuntu Server to check
          minimum: 1
          maximum: 1
        load:
          device_list: devices
        save: ubuntu_device

      - ppa_tools.lists.get_first_item:
        load:
          items: ubuntu_device
        save: ubuntu_device

  - name: Check For Certficates Approaching Expiry Date
    actions:
      - ppa_tools.date.now:
        save: todays_date

      - ppa.ui.input_confirm:
          text: By default this task will show you all expired certificates. Include certificates approaching expiry date?
          confirm: Yes
          cancel: No
        save: approaching_expiry

      - ppa.ui.output_info:
          text: PPA will show you certificates due to expire within a certain number of days.
        when: approaching_expiry

      - ppa.ui.input_choice:
          text: Choose number of days
          options:
            - 30
            - 90
            - 180
            - 365
        when: approaching_expiry
        save: expiring_in_days

      - eval:
          expression: 86400 * {{ expiring_in_days }}
        save: expiry_seconds
        when: approaching_expiry and expiring_in_days

  - name: Find All Certificates
    actions:
      - ppa.ui.output_progress:
          text: Getting connection details
          element_id: all_certs_progress

      - pam.devices.reveal_control_account:
        load:
          pam_address: pam_address
          device_id: ubuntu_device.id
        save: ubuntu_secrets

      - set:
          name: ubuntu_server
          value:
            address: "{{ ubuntu_device.ip_address }}"
            port: 22
            username: "{{ ubuntu_secrets.account_username }}"
            password: "{{ ubuntu_secrets.password }}"
            base_prompt: '.*@.*\:\~\$\s*'

      - ppa.ui.output_progress:
          text: Scanning for certificates
          percent: 50
          element_id: all_certs_progress

      - ssh.client.run_commands:
          prompt_timeout: 300
          commands:
            - command: sudo find / -wholename /proc -prune -o -wholename /dev -prune -o -name *.pem -exec bash -c 'if [[ $(head -1 {}) = *CERTIFICATE* ]]; then openssl x509 -checkend {{ expiry_seconds }} -noout -in {} > /dev/null 2> /dev/null || echo {}; fi' \;
              questions:
                - prompt: "\\[sudo\\] password for .*"
                  answer: "{{ ubuntu_server.password }}"
        load:
          ssh_server: ubuntu_server
        save: all_certificates

      - ppa_tools.text.split_lines:
        load:
          text: all_certificates.0
        save: all_certificates

      - ppa.ui.output_progress:
          text: Found {{ all_certificates | length }} certificates to check
          percent: 100
          element_id: all_certs_progress

      - eval:
          expression: 100 / {{ all_certificates | length }}
        save: cert_progress_increment

  - name: Check Each Certificate
    sequence: all_certificates
    actions:
      - set:
          name: failed_cert
          value: false

      - ppa.ui.output_progress:
          text: Checking certificate {{loop.step.item.index + 1}} of {{all_certificates | length}}
          element_id: checking_cert_progress
        load:
          percent: cert_progress

      - ssh.client.run_command:
          prompt_timeout: 300
          command: date -d "$(openssl x509 -in {{ loop.step.item.value }} -noout -enddate | sed 's/notAfter=//g')" -u +%s
        load:
          ssh_server: ubuntu_server
        save: expiry_timestamp

      - set:
          name: failed_cert
          value: true
        when: '"unable to load certificate" in expiry_timestamp'

      - ppa.ui.output_error:
          text: "Failed to load certificate: {{ loop.step.item.value }}"
        when: failed_cert

      - ppa_tools.text.split_lines:
        load:
          text: expiry_timestamp
        save: expiry_timestamp

      - ppa_tools.lists.get_item:
          index: 1
        load:
          items: expiry_timestamp
        save: expiry_timestamp

      - ppa_tools.date.from_timestamp:
        load:
          timestamp: expiry_timestamp
        save: cert_expiry_date
        when: not failed_cert

      - ppa_tools.date.days_between:
        load:
          start_timestamp: todays_date.timestamp
          end_timestamp: expiry_timestamp
        save: days_remaining
        when: not failed_cert

      - ppa_tools.lists.append:
          value:
            - "{{ loop.step.item.value }}"
            - "{{ cert_expiry_date.display }}"
            - "{{ days_remaining }}"
        load:
          items: expiring_certs
        save: expiring_certs
        when: not failed_cert and days_remaining <= expiring_in_days and days_remaining > 0

      - ppa_tools.lists.append:
          value:
            - "{{ loop.step.item.value }}"
            - "{{ cert_expiry_date.display }}"
        load:
          items: expired_certs
        save: expired_certs
        when: not failed_cert and days_remaining <= 0

      - eval:
          expression: "{{cert_progress }} + {{ cert_progress_increment }}"
        save: cert_progress

      - ppa.ui.output_progress:
          text: Checked all certificates
          element_id: checking_cert_progress
          percent: 100
        when: (loop["step"]["item"]["index"] + 1) == len(all_certificates)

  - name: Display Certificates
    actions:
      - ppa.ui.output_error:
          text: Found {{ expired_certs | length }} expired certificates!
        when: len(expired_certs) > 0

      - ppa.ui.output_table:
          text: Expired Certificates
          header:
            - Certificate Path
            - Expiry Date
        load:
          rows: expired_certs
        when: len(expired_certs) > 0

      - ppa.ui.output_table:
          text: Certificates Expiring in {{ expiring_in_days }} days
          header:
            - Certificate Path
            - Expiry Date
            - Remaining Days
        load:
          rows: expiring_certs
        when: len(expiring_certs) > 0

Running this Playbook

Click download playbook
Import the downloaded file via the Playbooks page on PPA
Build the playbook from the Edit & Build tab
Run the playbook from the Preview & Deploy tab

* Requires PPA v2.9.x or newer

Integrations

PPA User Interface
PAM Server Devices
SSH Client
PPA Tools Date
& Lists & Text

Required PAM Inventory

One or more Ubuntu devices

Credentials

This task will use the selected Ubuntu Server device's control account to make the connection.

The control account must be part of the sudoers group.

What the Task Does

Once started, this task will:

Ask the user to select one Ubuntu Server device from a list obtained from the PAM Server
Ask the user if they would like to check for certificates expiring in the near future by selecting one of the following:
- 30
- 90
- 180
- 365
Display the expired certificates
Display the certificates due to expire in the selected timeframe

See our other playbooks

Get PPA for free!

Start automating your estate with a free 30 day trial today. No signup required!

Get PPA Express

Documentation

Installation Guide
See how easy it is to get started with our installation guide
Playbooks
View our task writing reference guide
Plugins
See how to integrate with different systems using our plugins reference guide.