Repository navigation
Unify the certificate-expiration buffer to an integer day count #543
Description
Problem
*_cert_expiration_buffer carries the same name in four roles but two incompatible value
formats:
| role | type |
default | how it is evaluated |
|---|---|---|---|
| beats | str |
"+30d" |
community.crypto.x509_certificate_info with valid_at.check_period -> boolean |
| elasticsearch / kibana / logstash | int |
30 |
own cert_info module -> not_valid_after -> day count compared with | int |
The split has a real cause: the three roles inspect passphrase-protected .p12 files, which
x509_certificate_info cannot read (path: "PEM and DER formats are supported", and there is no
passphrase option) - hence the own cert_info module, which returns only a date and no
validity boolean.
The consequence is a silent failure. A user who sets one format everywhere breaks the other
side: "+30d" | int evaluates to 0, so days <= 0 is never true and the certificate is
never renewed - without any error.
Want
One value format in all four roles: an integer day count. Change the beats role to compute the
remaining days from the module's not_after return and compare it as an int, like the other
three roles already do. No module change needed, and the concrete "expires in N days" message
becomes available in beats too.
Breaking: beats_cert_expiration_buffer: "+30d" becomes beats_cert_expiration_buffer: 30.
Activity