monitor-expiring-certificates

  

Monitor Expiring PCF Certificates

This sample pipeline checks for expiring certificates of a PCF deployment.

It gets automatically triggered on a regular basis by a time resource to check for the list of certificates about to expire from the corresponding PCF Ops Manager.

The pipeline monitors five types of PCF certificates:

• Configurable Certificates
• Non-Configurable Certificates
• CA Certificates
• Bosh Director Trusted Certificates
• Ops Manager Root Certificates

If a certificate is about to expire within the given EXPIRATION_TIME_FRAME pipeline parameter, then the pipeline will throw an error and send out a notification (e.g. email) to the configured recipients.

---

How to use this pipeline

1. Update pcf_params.yml by following the instructions in the file.

   This parameter file contains information about the PCF foundation's Ops Manager and Director required to obtain information about its certificates.

2. If automatic email notification is desired, update the corresponding parameters for resource send-an-email (e.g. smtp_host, credentials) in the pipeline.yml file.

3. Adjust how often the time-trigger resource should trigger the pipeline execution by updating its interval parameter in pipeline.yml to the desired time interval.

4. Adjust parameter EXPIRATION_TIME_FRAME in pipeline.yml to the desired time frame to check for about-to-expire certificates (e.g. within the next 3 months=3m)

5. Create the pipeline in Concourse:

   fly -t <target> set-pipeline -p monitor-certificates -c pipeline.yml -l pcf_params.yml

6. Un-pause and run pipeline monitor-certificates

---