lacework-global-213

Load balancer SSL certificate expiring soon (Automated)

Alert when the SSL certificate in a load balancer expires within 45 days. Rotate SSL certificates in a timely basis to ensure security and usability.

note

This policy checks for expiring certificates attached to both backend sets and listeners.

From Console:

From CLI:

(Note: The OCI CLI does not currently have a means of renewing certificates, as per the console.)

Execute the following command to get a list of load balancers:
```
oci lb load-balancer list --compartment-id <compartment_ocid>
```
For each load balancer, execute the following command to get the attached backend-sets:
```
oci lb backend-set list --load-balancer-id <load_balancer_ocid>
```
note
OCI CLI does not provide a command to allow to direct listing of listeners. You can extract them from the command in step 1, within the listeners element.

For each backend set/listener, examine the ssl-configuration, extract the certificate-ids and execute the following command:
```
oci certs-mgmt certificate get --certificate-id <certificate_ocid>
```

If the date in time-of-validity-not-after is less than 45 days, then you must delete the certificate and create a new one, as follows:

oci lb certificate delete --load-balancer-id <load_balancer_ocid> --certificate-name <certificate_name>

And

oci lb certificate create --load-balancer-id <load_balancer_ocid> --certificate-name <certificate_name>