Notification on Certificate expiration

Question

Hello, 
 we have multiple environments of Sophos SG and XG Clusters. As we are not able to check every Cluster itself we automated a notification for WAF Certificate Expiration. 
 On SG this is built-in but not so on the XG. 
 I searched a little, and the last thing I think could help is to query it via api. 
 Is there any possibility to check this? 
 SNMP would be possible as well... 
 Any Insights?

Vivek Jagad · Answer

Hello Niclas Lilie , Thank you for reaching out to the community, currently SFOS only offers the following list of notifications : 
 This would be a Feature Request; I'd recommend you reach out to your Account Manager, Sales Engineer, or Sales Representative so that they can enter this request into our system. 
 Additionally , you can use the in-product feedback in the Sophos Firewall located in the Top Menu Bar, or raise a support case to create a FR.

dtconnect · Answer

You can indeed utilize the API for this purpose. However, it's not the most straightforward process since there isn't a direct method to instantly identify expiring certificates. Instead, you'll need to call an API endpoint that provides you with a .tar file. This file contains several components: Entities.xml : Contains certificate information such as names as seen in your GUI. *.pem : The certificate files themselves. *.key : Private keys for the certificates. You'll need to extract the contents of the .tar file and then verify the validity of each .pem file. Please see the script provided below: import logging import tarfile from io import BytesIO import requests import urllib3 import xmltodict from cryptography import x509 from cryptography.hazmat.backends import default_backend # Setup sophos_api_url = 'https://sophos:4444/webconsole/APIController' sophos_api_username = 'admin' sophos_api_password = 'password' ssl_verify = False logging.basicConfig(level=logging.INFO) urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # Prepare XML Request xml = f""" {sophos_api_username} {sophos_api_password} """ # Execute API Request response = requests.request('GET', sophos_api_url, files={"reqxml": (None, xml)}, verify=ssl_verify) # Process Answer xml_info = {} cert_info = {} # Extract downloaded tar file in memory. The file contains an XML File and several Certificates # This script only handles PEM based certificates if response.status_code == 200: with tarfile.open(fileobj=BytesIO(response.content)) as tar: for member in tar.getmembers(): f = tar.extractfile(member) if f: content = f.read() if member.name == "./Entities.xml": try: xml_data = xmltodict.parse(content) for cert in xml_data['Response']['Certificate']: xml_info[cert.get('CertificateFile')] = cert.get('Name') except Exception as e: logging.error(f"Error parsing XML: {e}") else: try: cert = x509.load_pem_x509_certificate(content, default_backend()) cert_info[member.name.split('/')[-1]] = cert.not_valid_after_utc except ValueError: logging.warning(f"Skipping non-PEM file: {member.name}") except Exception as e: logging.error(f"Error loading certificate: {e}") else: logging.error(f"Error downloading file: Status-Code {response.status_code}") # Merge result dicts common_keys = xml_info.keys() & cert_info.keys() certificates = {xml_info[key]: cert_info[key] for key in common_keys} # Output for cert_name, valid_until in certificates.items(): logging.info(f"Certificate Name: {cert_name}, Valid Until: {valid_until.strftime('%Y-%m-%d %H:%M:%S %Z')}")

Notification on Certificate expiration

Top Replies