NewValidation: APIC SSL cert expire validation

[asraf-khan]

(use upvote 👍 for attentions)

Validation Type

[x] - Fault

[ ] - Config

[ ] - Bug

[ ] - Other

What needs to be validated

Expiring Certificates (Major Severity):

• F4501: KeyRing X.509 Certificate expiring - This fault occurs when a custom KeyRing X.509 Certificate is going to expire in one month.

• F3081: SAML X.509 Certificate expiring - This fault occurs when the SAML X.509 Certificate is going to expire in one month.

• F4617: TP X.509 Certificate expiring - This fault occurs when a Trust Point X.509 Certificate is expiring.

• F4752: Factory X.509 Certificate expiring - This fault occurs when the factory Certificate is expiring.

Expired Certificates (Critical Severity):

• F4502: KeyRing X.509 Certificate expired - This fault occurs when a custom KeyRing X.509 Certificate has expired.

• F4503: TP X.509 Certificate expired - This fault occurs when a Trust Point X.509 Certificate has expired.

• F3082: SAML X.509 Certificate expired - This fault occurs when the SAML Encryption X.509 Certificate has expired.

• F4753: Factory X.509 Certificate expired - This fault occurs when the factory Certificate has expired.

[monrog2]

for clarity, expired mgmt certs causes an issue with pulling in the installerscript from APIC to Switch nodes during upgrade, failing the switch upgrade process:

...INFO downloaderUtility.py: 283 CustomCertVerify url: https://x.x.x.x/fwscriptrepo/installerScripts.tar.gz
...DEBUG    connectionpool.py:1023 Starting new HTTPS connection (1): x.x.x.x:443
...INFO downloaderUtility.py: 538 Caught exception: HTTPSConnectionPool(host='x.x.x', port=443): Max retries exceeded with url: /fwscriptrepo/installerScripts.tar.gz (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] 

[monrog2]

This request is covered by open PR #407, which implements the APIC certificate-expiration validation for all eight fault codes listed here. It distinguishes expiring certificates (MANUAL) from expired certificates (FAIL_O), includes factory-certificate verification for releases before 6.1(5e), and now incorporates the related switch-certificate validation from PR #390.

PR #407 is currently mergeable, its Python 2.7 and Python 3.8 CI checks pass, and it received an implementation update on July 27, 2026. This issue should remain open until #407 is reviewed and merged.

Tracking implementation: #407

[asraf-khan]

@monrog2 Diwakar concluded that we will not add leaf/spine cert validation check as it's not impacting customer.

[asraf-khan]

@monrog2 only leaf/spine validation need to be removed along with APIC validation but still APIC side cert validation will be there.

[monrog2]

reopened issue + PR. misinterpreted previous comment, apologies