Over the past year I have seen quite a few STS certs expire in production environments. I have been meaning to write something to scan a VCSA and report back the expiry dates of all the certs. <\/p>\n\n\n\n
This has posed a problem because I have to use SSH and one command needs to follow another. In the end I discovered the SSHShellStream in the Posh-SSH module. I will document that (character building) journey in another post. <\/p>\n\n\n\n
This script will use the POSH-SSH module to connect to a VCSA and issue a one liner BASH script to get the cert info. This info is captured and processed by the script. But the STS cert info can not be captured in this way as it requires a python script to be uploaded and run. This script needs to be manually copied to the remote VCSA.<\/p>\n\n\n\n
Deployment of the script<\/p>\n\n\n\n
Thats it. you are ready to go.<\/p>\n\n\n\n
Running the script<\/p>\n\n\n\n
You will end up with a CSV file looking very much like this.<\/p>\n\n\n
\n"vCenter","location","Name","ExpDate","Days"\n"myvCenter.mydomain.com","lab","STORE MACHINE_SSL_CERT","15\/03\/2023 13:27:50","716"\n"myvCenter.mydomain.com","lab","STORE TRUSTED_ROOTS","09\/03\/2031 13:27:50","3633"\n"myvCenter.mydomain.com","lab","STORE TRUSTED_ROOTS","07\/01\/2029 13:27:50","2841"\n"myvCenter.mydomain.com","lab","STORE TRUSTED_ROOTS","08\/01\/2031 13:27:50","3573"\n"myvCenter.mydomain.com","lab","STORE TRUSTED_ROOTS","08\/01\/2031 13:27:50","3573"\n"myvCenter.mydomain.com","lab","STORE TRUSTED_ROOTS","09\/03\/2031 13:27:50","3633"\n"myvCenter.mydomain.com","lab","STORE machine","09\/03\/2031 13:27:50","3632"\n"myvCenter.mydomain.com","lab","STORE vsphere-webclient","09\/03\/2031 13:27:50","3633"\n"myvCenter.mydomain.com","lab","STORE vpxd","09\/03\/2031 13:27:50","3633"\n"myvCenter.mydomain.com","lab","STORE vpxd-extension","09\/03\/2031 13:27:50","3633"\n"myvCenter.mydomain.com","lab","STORE hvc","09\/03\/2031 13:27:50","3632"\n"myvCenter.mydomain.com","lab","STORE data-encipherment","09\/03\/2031 13:27:50","3633"\n"myvCenter.mydomain.com","lab","STORE SMS","14\/03\/2031 13:27:50","3638"\n"myvCenter.mydomain.com","lab","STORE wcp","14\/03\/2023 13:27:50","716"\n"myvCenter.mydomain.com","lab","STS Valid LEAF","13\/01\/2023 13:27:50","656"\n"myvCenter.mydomain.com","lab","STS Valid Root","08\/01\/2031 13:27:50","3573"\n<\/pre><\/div>\n\n\nNote: that the above output is from a VCSA server installed about 2 weeks ago, so All is looking good. I do not have any samples of an expired certificate (Ill update this post in 716 days) so I do not know how the script will deal with an expired Cert. But saying that, my On-call week is about to start so I may get an example. Im “lucky” like that.<\/p>\n\n\n\n
Anyhow, here is the script<\/p>\n\n\n
\nimport-module posh-ssh\n\n$Cred = Get-Credential\n\n$vcsa = 'MyvCenterServer.Domain.com'\n$location = 'HomeLab'\n\n# connect to vcsa with SSH and open the SSh stream\n$session = New-SSHSession -ComputerName $vcsa -Credential $cred \u2013AcceptKey\n$stream = New-SSHShellStream -SSHSession $session -TerminalName tty\n\n# send the commands and get the results in to $CertList and $STSCertList\n# drop to the BASH shell\n$stream.WriteLine('shell')\nsleep 3\n# send a BASH one liner to list the crets and there info\n$stream.WriteLine('for i in $(\/usr\/lib\/vmware-vmafd\/bin\/vecs-cli store list); do echo STORE $i; sudo \/usr\/lib\/vmware-vmafd\/bin\/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done')\nsleep 3\n# read the result of that in to the variable $CertList\n$CertList = $stream.Read()\nsleep 3\n$stream.WriteLine('cd \/tmp')\nsleep 3\n$DontCare = $stream.Read()\nsleep 3\n# run the checksys python script in \/tmp (if that is where you have deployed it to)\n$stream.WriteLine('python checksts.py')\nsleep 3\n# get the output of that script in to the $STSCertList variable\n$STSCertList = $stream.Read()\n\n# close the SSH session and stream\n$stream.Close()\nRemove-SSHSession -SSHSession $session | Out-Null\n\n\n# $CertList and $STSCertList are txt streams, split using newline to get an array of text lines (a text file)\n$NewCertList = $CertList.split([Environment]::NewLine)\n$NewSTSCertList = $STSCertList.split([Environment]::NewLine)\n\n# loop through each line and put the relivent info in to the $CertReport array\n$CertReport = @()\nforeach($line in $NewCertList)\n{\n if ($line -match "STORE"){$CurrentStore = $line}\n if (($Line -match "not After") -and ($Line -notmatch "egrep"))\n {\n\n $line = $line.replace("Not After :","")\n $line = $line.replace(" "," ")\n $line = $line.replace(" GMT"," ")\n $line = $line.trim()\n $cells = $line.split(" ")\n if ($cells[0] -eq "Jan"){$Month = 1}\n if ($cells[0] -eq "Feb"){$Month = 2}\n if ($cells[0] -eq "Mar"){$Month = 3}\n if ($cells[0] -eq "Apr"){$Month = 4}\n if ($cells[0] -eq "May"){$Month = 5}\n if ($cells[0] -eq "Jun"){$Month = 6}\n if ($cells[0] -eq "Jul"){$Month = 7}\n if ($cells[0] -eq "Aug"){$Month = 8}\n if ($cells[0] -eq "Sep"){$Month = 9}\n if ($cells[0] -eq "Oct"){$Month = 10}\n if ($cells[0] -eq "Nov"){$Month = 11}\n if ($cells[0] -eq "Dec"){$Month = 12}\n\n # get the exp date and convert to a date-time object\n $day = $Cells[1]\n $year = $cells[3]\n $ExpDate = get-date -year $year -month $Month -day $day\n\n # now get the number of days to cert expire\n $ExpIn = $ExpDate - (get-date)\n\n # create a tmp object with cert info and add to th result array, $CertReport\n $tmpInfo = '' | select vCenter,location,Name,ExpDate,Days\n $tmpInfo.vCenter = $vcsa\n $tmpInfo.location = $location\n $tmpInfo.Name = $CurrentStore\n $tmpInfo.ExpDate = $ExpDate\n $tmpInfo.Days = $ExpIn.days\n $CertReport += $tmpInfo\n }\n}\n\nforeach($line in $NewSTSCertList)\n{\n if($line -match "VALID CERTS"){$CertValid = "Valid"}\n if($line -match "EXPIRED CERTSS"){$CertValid = "Expired"}\n if($line -match "LEAF CERTS"){$CertType = "LEAF"}\n if($line -match "Root CERTS"){$CertType = "Root"}\n if($line -match "Certificate")\n {\n # split the line using a space as the delimiter\n $cells = $line.split(" ")\n $CellNum = 0\n # loop through the cells, if the cell = "days" get the cell before it as that is the number\n foreach ($Cell in $cells)\n {\n if ($cell -eq "days"){$ExpDays = $Cells[$CellNum - 1] }\n $CellNum ++\n }\n \n # create a tmp object with cert info and add to th result array, $CertReport\n $tmpInfo = '' | select vCenter,location,Name,ExpDate,Days\n $tmpInfo.vCenter = $vcsa\n $tmpInfo.location = $location\n $tmpInfo.Name = "STS " + $CertValid + " " + $CertType\n $tmpInfo.ExpDate = (get-date).adddays([int]$ExpDays)\n $tmpInfo.Days = $ExpDays\n $CertReport += $tmpInfo\n }\n}\n$CertReport | export-csv "C:\\temp\\certReport.csv" -NoTypeInformation\n\n\n\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"Over the past year I have seen quite a few STS certs expire in production environments. I have been meaning to write something to scan a VCSA and report back the expiry dates of all the certs. This has posed a problem because I have to use SSH and one command needs to follow another….<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[5,4,132,43],"tags":[126,133,12,13,102,128,46],"class_list":["post-668","post","type-post","status-publish","format-standard","hentry","category-powercli","category-powershell","category-reporting","category-vmware","tag-certificate","tag-expire","tag-powercli","tag-powershell","tag-ssh","tag-sts","tag-vcsa"],"_links":{"self":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts\/668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=668"}],"version-history":[{"count":3,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts\/668\/revisions"}],"predecessor-version":[{"id":671,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts\/668\/revisions\/671"}],"wp:attachment":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}