Expired Server Certificates

carlosinfl · 03-17-2008, 12:59 PM

Every day I get an email from my web server that sits on my DMZ with the following:

################# SSL Certificate Warning ################

Certificate for hostname 'www.mydomain.org', in file:
/etc/httpd/conf/ssl.crt/www.mydomain.org.crt

The certificate needs to be renewed; this can be done
using the 'genkey' program.

Browsers will not be able to correctly connect to this
web site using SSL until the certificate is renewed.

##########################################################
Generated by certwatch(1)

Now when I go to www.mydomain.org and view my certificate this server is hosting, I can cleary see it expires in 2010. Anyone know how to force this "certwatch utility to read the correct file or how to fix this?

I provided and example of my cert below:

Example

unSpawn · 03-18-2008, 07:33 AM

IIGC the 'certwatch' cronjob does a 'httpd -t -DDUMP_CERTS'. Executing that manually gives you what?

carlosinfl · 03-18-2008, 10:05 AM

OK - so I found certwatch to be located in two locations ... so far. I don't want this on my servers any longer and I did not install it so I assume it was the previous admin.

Now I moved "certwatch" from /etc/cron.daily/ where it was running and this takes care of me getting bogus emails every day however I would like to remove it properly and I see its in /usr/bin/ so my question is do I simply just rm /usr/bin/certwatch to remove this properly from my servers or is there another way?

frndrfoe · 03-18-2008, 12:25 PM

I would think that removing it from cron would be sufficient. It is part of the crypto-utils package in redhat systems. Or you could just remove the execute bit.

Code:

$ rpm -q --whatprovides /usr/bin/certwatch 
crypto-utils-2.1-4.2

BTW I have found it useful at times.

unSpawn · 03-19-2008, 06:18 AM

Quote:

Originally Posted by Carlwill

Now I moved "certwatch" from /etc/cron.daily/ where it was running

The docs tell you about a httpd.conf setting that keeps certwatch from polling for info. And I agree that if you use certs you'll want to check its validity. Nothing worse than finding out the cert has expired, having to wait for renewal to complete while finding business goes elsewhere because of a, for customers, incomprehensible and irrepairable failure.