Certificate monitor

You can configure a certificate monitor on the appliance.

You can use the certificate monitor to regularly check your certificates and output log messages that warn you if any have expired or are about to expire.

You can monitor the following types of certificate:
  • Certificates in queue manager key repositories
  • Web UI certificates
  • REST API certificates
  • Certificates used by role-based management for communicating with LDAP servers
When you configure the certificate monitor, you specify the following characteristics:
  • How often the certificates are checked
  • How many days in advance of expiration that warnings are issued
  • What log level is assigned to expiration warnings
  • Whether expired certificates should be disabled (not applicable to queue manager certificates)
You can configure the certificate monitor by using the command line interface, the REST API, or the Web UI.
Log events are generated with the cert-monitor category. Two types of log event are generated, one for certificates that are about to expire and one for certificates that have already expired, for example:
  • [0x806000e1] Certificate ‘mycert’ in domain ‘default’ expired at ‘2020-03-31T15:40:08Z’
  • [0x806000e2] Certificate ‘mycert’ in domain ‘default’ is about to expire at ‘2020-03-31T15:40:08Z’

The certificate name is the name of the certificate object.

Log events for queue manager certificates have a slightly different format:

  • [0x8060034b] Certificate ‘mycert’ for queue manager ‘QM1’ expired at ‘2020-03-31T15:40:08Z’
  • [0x8060034c] Certificate ‘mycert’ for queue manager ‘QM1’ is about to expire at ‘2020-03-31T15:40:08Z’

The certificate name in these two log messages is the certificate label in the queue manager key repository (as reported by the listcert command - see listcert (list certificate)).

The certificate monitor does not scan certificates for HA secondary or DR secondary queue managers. Certificates for these queue managers are scanned by the certificate monitor on the appliance where they have the primary role.