Password and Certificate expiration warning

Certificate expiration warnings were implemented as messages to the console in CSM 6.3.13. An fix for an issue based on time zones as added in 6.3.14. The console can be monitored for message IWNR2306I via rsyslog or other means. Expired passwords are prompted for at the time of login. Marking this IDEA complete based on what was delivered in 6.3.13.

Will reconsider this request

While I understand the reasoning behind this request, I unfortunately do not think it's feasible across all CSM environments. CSM does not "manage" certificates. Certificates can be updated on the server or HMC that csm is running on, however these are stored in a keystore and used by the underlying Java/WAS architecture when creating a secure connection. I do not think CSM should be accessing this keystore regularly and as it's possible to have multiple certs, this could result in false positives leading to bigger problems. On HMC installs, CSM doesn't control the keystore either, as CSM communication is controlled through a proxy on the HMC so that all communication can use the same keystore.

CSM's default cert was previously created with an expiration "years" out. A issue in recent releases made it so the default was only made as a 1 year expiration from installation. We have since corrected that and the latest releases should once again be creating certs with longer expirations. However, a 1 year default expiration is actually the industry standard. However, I believe that is the primary reason we're seeing some of these issues today.

With that said, it is highly recommended that customers use their own certs, and not the default certs. This is a more secure way to manage your environment, and would allow you to manage the expiration of the certs across various products outside of CSM.