search

smallstep / cli

🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc.
https://smallstep.com/cli
Apache License 2.0
3.66k stars 253 forks source link

Feature Request: Notifications #366

Open shoopdawoop opened 4 years ago

shoopdawoop commented 4 years ago

Notifications for events, e.g. successful or failed auto-renewals.

This could be useful when running the step command as a service, e.g. in step ca renew -daemon mode, which could become something like step ca renew -daemon -notification script or step ca renew -daemon -notification pushover, triggering a preconfigured notification or simply running a custom shell script that does the job.

mmalone commented 4 years ago

@shoopdawoop better alerts are a good idea. We're thinking about the best way to do this.

In the meantime, I think you could use the --exec command to step ca renew to call a script after a certificate has been successfully renewed.

You could also use something like step certificate inspect https://google.com --format json | jq -r .validity.end to get the expiry date of a certificate in a script (e.g., running on a systemd timer) and send an alert if it's approaching expiry.

I remember discussing a simpler mechanism to detect whether a certificate is about to expire (some subcommand that let's you ask "is this certificate within of expiring?" and get a 0/1 exit value) but I don't think we ever built it. We probably should, but the jq approach works decently for now I guess.

Hopefully this helps! Happy to answer any follow-up questions, and if you get something knocked together I'd love to see it!

shoopdawoop commented 4 years ago

@mmalone thank you,

right now I am using certbot renew --post-hook "some-script.sh" on the client side, so I will probably stick with that for now (no need to install step on the client).

So I guess I should add to my suggestion a notification functionality on the server side, which would be quite useful as well. I might just monitor the servers logs and see how well that works for me.

mmalone commented 4 years ago

@shoopdawoop ah, ok. Didn't realize you wanted this stuff server-side.

Monitoring the logs should work pretty well. You may want to add:

    "logger": {
        "format": "json"
    },

to your ca.json to make them a bit easier to parse programmatically.

We have a few open issues around exporting information from the step-ca database, and we're planning some alerting functionality for our hosted product (alerts for certificates that are about to expire are high priority). So you should see more functionality here soon.

dopey commented 3 years ago

Hey, circling back on this issue - we've released certificate observability (visibility, alerting, monitoring) as part of our hosted product. You can "link" an open source CA to the hosted product and start seeing new certificates in the UI.

Linking a single open source CA is free. Sign up here: https://info.smallstep.com/certificate-manager-early-access-mvp/, and follow the directions to link an existing CA. Encourage anyone looking to get visibility into their step-ca PKI to try this out and give us feedback. cheers!

Note: you'll need to recreate your provisioners using the new step beta ca provisioner subcommand group. Let us know if you're having any issues there and we'll be happy to help. For real time help, come find us on Discord - https://discord.gg/ypu2T7qg9y.