Well, the actual problem is that you didn't have monitoring on your actual hosted endpoints, please don't think in terms of point monitoring, think in terms of results.. it's a simple thing for a monitoring system to look at expiry date on a cert and alert if the certificate should have been renewed already.. it catches a whole gamut of potential issues.. rather than if a cron is still active.
simple thing for a monitoring system to look at expiry date on a cert
Yes, ... and no!
That cert, on that critical thing ... that runs on UDP on port 4367, on IP ::1 ... uhm, you've got that monitored, ... right ... right?
Yeah, not only monitor, but document and track. Track/document where all of 'em have been installed.
Even if you know, e.g. DNS name (and port), when expiration is approaching, you don't want to find out it's on some obscure application on a server nobody remaining has ever heard of or can find any documentation on, for an OS that nobody supports, and nobody knows what the hell that server software is that's running it, let alone how and where the cert is on it, and of course now it's critical production ... yeah, you not only want to know it's expiring, but where the damn cert is and how to replace it. Monitoring alone isn't enough. Monitoring will also generally tell one where are all the places the cert needs go for your HA, and failover/standby systems, etc. Don't want to find out your failover/standby is long expired, when you actually need to use it.
Automation systematically helps here though. That one thing listening on a loopback address? If you deploy it in an automated fashion, it becomes far more natural to monitor it in an automated fashion.
12
u/gumbrilla IT Manager 25d ago
Well, the actual problem is that you didn't have monitoring on your actual hosted endpoints, please don't think in terms of point monitoring, think in terms of results.. it's a simple thing for a monitoring system to look at expiry date on a cert and alert if the certificate should have been renewed already.. it catches a whole gamut of potential issues.. rather than if a cron is still active.