[feature] Notification for soon expiring certificates and display of expired status

[okraits]

Is your feature request related to a problem? Please describe.
Currently the user is not notified if a certificate will expire soon.
Additionally it is not easily visible which certificates are already expired. You have to check the validity end.

Describe the solution you'd like
A notification should be sent a configurable timespan ahead of a certificate expiring.
In the certificates list view, beside the Revoked column, an additional column Expired should be added to display the expired state.

Additionally, an option to automatically renew expired certificates might be useful.

[nemesifier]

Is your feature request related to a problem? Please describe. Currently the user is not notified if a certificate will expire soon. Additionally it is not easily visible which certificates are already expired. You have to check the validity end.

Describe the solution you'd like A notification should be sent a configurable timespan ahead of a certificate expiring. In the certificates list view, beside the Revoked column, an additional column Expired should be added to display the expired state.

This needs to be defined further (notified when certs expire? Before? Both?), but this module does not implement notifications, it may be better to implement this feature in OpenWISP Controller which has access to the notifications module.

The expired column can be added to this module.

Additionally, an option to automatically renew expired certificates might be useful.

We need to define this further. But this module does not have celery background tasks, so we have two choices:

• Implement this feature here, adding the dependency to celery (we have an extra in openwisp-utils[celery])
• Implement this feature in OpenWISP Controller

Maybe keeping this feature here makes sense as it could be useful to a broader audience and adding the dependency to celery is not a big deal.

[okraits]

This needs to be defined further (notified when certs expire? Before? Both?), but this module does not implement notifications, it may be better to implement this feature in OpenWISP Controller which has access to the notifications module.

Like I wrote, the user should be notified a configurable timespan before the certificate expires. Maybe/possibly (configurable) also when the certificate expires.

Additionally, an option to automatically renew expired certificates might be useful.

We need to define this further. But this module does not have celery background tasks, so we have two choices:

* Implement this feature here, adding the dependency to celery (we have an extra in `openwisp-utils[celery]`)

* Implement this feature in OpenWISP Controller

Maybe keeping this feature here makes sense as it could be useful to a broader audience and adding the dependency to celery is not a big deal.

We would need background tasks for both the expire notification and the automatic renewal. For the notification we would additionally need the notifications module. Maybe we could make the notifications module an optional dependency, needed only if the expire notification is configured to be sent.

In general, I would say, if you're dealing with certificates, then you want to be notified when a certificate is going to expire.

The question is: how many people use django-x509 independently of OpenWISP, thus not having the notifications module? I think we should design it mainly for the usecase as a part of a OpenWISP system.

[nemesifier]

In general, I would say, if you're dealing with certificates, then you want to be notified when a certificate is going to expire.

That is a valid concern.

This is a base django-app, so users using this are able to implement this however they want if they need it.
OpenWISP Notifications requires OpenWISP Users and a lot of dependencies, this is just not the right place in the openwisp architecture where we should place these dependencies, but we can still provide the basics for this feature.

We can implement the base logic to fire a django signal which fires when certs are close to expiration or have expired.

We can hook a default action which does the following:

• check if either ADMINS or MANAGER setting are filled and if so use the mail_admins and/or mail_managersfunction from Django to notify admins/managers
• if both settings are not set, get use send_mass_mail from Django to email all superusers

The aim would be to implement this in a way that can overrideen if needed.

In OpenWISP Controller we can simply disconnect the default signal receiver and connect a new signal receiver which implements the same using the notifications module. I created an issue for this: openwisp/openwisp-controller#1198

We'll need to make sure the README is updated to explain this functionality and list the signals.

The question is: how many people use django-x509 independently of OpenWISP, thus not having the notifications module? I think we should design it mainly for the usecase as a part of a OpenWISP system.

I have no way of knowing exact numbers, but if you look at raw download numbers shown in the README badge and compare it with openwisp-controller, this modules has more downloads than openwisp-controller, which makes me thing there's an amount of users who use it independently.

---

What about auto renew? How do we let users instruct the system the want certs to be auto-renewed?

Do we also want to allow users to auto-renew CAs when they expire?
Note: Renewing a CA renews also all certificates generated by it, by overwriting the existing objects.

The easiest thing would be a new field in the CA model:

Automatic renewal:

• disabled (default, for backward compatibility)
• auto renew certificates generated by this CA
• auto renew both certificates and CA

We'll need to add this to the admin and make sure this feature is mentioned in the README.

[nemesifier]

We need to further define how notification preferences should work. The following proposal outlines the intended behavior.

expire_notified flag

A periodic Celery task runs daily and checks for expired CAs and certificates that have not yet triggered a notification.

We introduce a new hidden database column, expire_notified, defaulting to NULL. Relying on a single notification sent exactly on the expiration date is fragile: on small production instances, workers may be temporarily unavailable, causing notifications to be missed.

Once administrators are successfully notified, the flag is set to True. Until then, expired objects continue to be eligible for notification.

Notification content based on auto renew status

Notification messages should differ depending on whether auto renew is enabled.

Auto renew enabled

• On expiration
  Notify whether the CA or certificates have been successfully renewed.
• Before expiration
  Notify the upcoming expiration date and clearly state that no manual action is required because auto renew is enabled.

Auto renew disabled

• On expiration
  Notify that the CA or certificates have expired and that manual action is required. Suggest enabling auto renew and link to the relevant admin object.
• Before expiration
  Notify the upcoming expiration date and clarify that manual action will be required because auto renew is disabled. Suggest enabling auto renew and link to the relevant admin object.

Avoiding notification spam

To avoid spamming users, notifications must be aggregated. If multiple CAs or certificates expire or approach expiration on the same day, all related information should be included in a single email.

Configuring advance notices

Users should be able to control how many days in advance they are notified before expiration.

The simplest approach is a global setting with a sensible default, for example 2 or 3 days.

Eg;

DJANGO_X509_EXPIRATION_NOTICE_DAYS = 3