671354 - Create nagios alert to warn of imminent signing key expiry

Status: RESOLVED DUPLICATE of bug 673303

(Release Engineering :: General, defect, P3)

Comment 1

[John Hopkins (:jhopkins)]

Checking the gpg key can be done by looking at a public key server.

Checking the Authenticode key can be done on the signing box by looking at the certificate store.

Comment 2

[Mark Banner (:standard8)]

This was an idea that was had around the time a Thunderbird signing key was due to expire. 

I don't know if this is relevant in the releng land or if something is already set up. So feel free to close as wontfix/invalid if it isn't necessary or wanted.

Comment 3

[Chris Cooper [:coop] (he/him)]

We already get (lots of) email from Thawte when keys are due to expire. Provided we don't ignore that mail, maybe this is WONTFIX?

Comment 4

[Chris AtLee [:catlee]]

We still need to check GPG keys, and maybe apple signing keys.

Comment 5

[[e-mail] (:bhearsum)]

(In reply to Chris AtLee [:catlee] from comment #4)
> We still need to check GPG keys, and maybe apple signing keys.

bug 673303 talks about having the signing servers check expiry dates. This is probably much easier to do than hacking it into Nagios.