Manage certificate expiration settings

You can configure the certificate expiration monitor.

To view this administrative console page, click Security > SSL certificate and key management. Under Configuration settings, click Manage certificate expiration.

Attention: To see the changes to the Expiration checking fields, you must click Apply.

Start now

Specifies to start certificate monitoring. When the monitor runs, it visits all the key stores and checks to see if they are within certificate expiration range. If you set the option to delete or replace expired certificates, you can run these operations immediately by pressing Start now.

Expiration notification threshold

Specifies the period of time that occurs chronologically just before the expiration day of the certificate, within which, if the ExpirationMonitor thread runs, and Automatically replace expiring self-signed and chained certificates is enabled, a new self-signed, or chained certificate is generated. By default, the replacement period for the certificate is 60 days in length or less as defined in the daysBeforeNotification property.

Avoid trouble: Enabling WebSphere Application Server to automatically replace the expiring certificates in a production environment can potentially cause a short- or long-term outage because its operation, in many cases, can take a considerable time when there are many certificates in the environment. It is recommended instead that you change certificates manually when you are notified of their impending expiration, and disable the Automatically replace expiring self-signed and chained certificates choice by default.

There is a pre-notification period where the certificate is added to the notification list but not touched for 90 days prior to the 60 days. By default, this pre-notification period is 90 days in length as defined in the com.ibm.ws.security.expirationMonitorNotificationPeriod property.

Information	Value
Data type:	Integer
Default:	60 days or less

Certificate pre-notification threshold

The Certificate pre-notification threshold means that you are warned when the certificate monitor is about to replace a certificate.

Set the Certificate pre-notification threshold in the box that is labeled, Certificate pre-notification threshold. The Certificate pre-notification threshold is the number of days before the start of the expiration notification threshold where the certificate monitor reports the date that a certificate can start getting replaced.

If the certificate pre-notification is set to 90 days, and the expiration notification threshold is 30 days, your certificate does not expire for another 60 days.

Information	Value
Data type	Integer
Default	90 days

Enable checking

Specifies the certificate monitor is active and will run as scheduled.

Scheduled time of day to check for expired certificates

Specifies the scheduled time that the system checks for expired certificates.

You can type the scheduled time in hours and minutes, specify either A.M. or P.M., or 24-hour.

Information	Value
Data type	Integer
Default:	0, 0
Range:	1–12, 0–59

Check by calendar

Indicates that you want to schedule a specific day of the week on which the expiration monitor runs. For example, it might run on Sunday.

Information	Value
Default:	Enabled

Weekday

Specifies the day of the week on which the expiration monitor runs if Check on a specific day is selected.

Information	Value
Default:	Sunday
Range:	Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday

Repeat interval

Specifies the time between each schedule time to check for expired certificates or the interval between schedule checks.

Information	Value
Default:	Daily
Range:	Daily, Weekly

Check by number of days

Specifies that you want to schedule a specific number of days between each run of the expiration monitor. The day of the week on which this occurs is not counted. For example, if you set the interval to check for expired certificates every seven days, the expiration monitor runs on day eight.

Information	Value
Default:	Disabled

Next start date

Specifies the date for the next scheduled check. This allows the deployment manager to be stopped and restarted without resetting the date.

Expiration check notification

Specifies the notification type (either email, or an entry in the system log) when an expiration monitor runs.

Information	Value
Default:

Automatically replace expiring self-signed certificates and chained certificates

Specifies a new self-signed certificate or chained certificate be generated by using the same certificate information if the expiration notification threshold is reached. The old certificate is replaced and uses the same alias. All old signers are managed by the key store configuration are also replaced. The system replaces only self-signed certificates.

Note: This checkbox is only applicable when you use file-based keystores.

Information	Value
Default:	Enabled

Delete expiring certificates and signers after replacement

Specifies whether to completely remove old, self-signed certificates from the key store during a replace operation or leave them there under a renamed alias. If an old certificate is not deleted, the system renames the alias so that the new certificate can use the old alias, which might be referenced elsewhere in the configuration.

Note: This checkbox is only applicable when you use file-based keystores.

Information	Value
Default:	Enabled