Signal/Signal-Server
1
0
Fork 0
mirror of https://github.com/signalapp/Signal-Server synced 2026-04-20 14:48:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

Report the number of days until the CDS CA cert expires as a metric so we can set an alarm.

Browse Source
This commit is contained in:
Jon Chambers
2020-05-05 17:12:47 -04:00
committed by Jon Chambers
parent b1d11d4f69
commit 1c73c91133
3 changed files with 80 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
service/src/main/java/org/whispersystems/textsecuregcm/storage/DirectoryReconciliationClient.java
View File

@@ -16,12 +16,15 @@
*/
package org.whispersystems.textsecuregcm.storage;
import com.codahale.metrics.SharedMetricRegistries;
import org.bouncycastle.openssl.PEMReader;
import org.glassfish.jersey.SslConfigurator;
import org.glassfish.jersey.client.authentication.HttpAuthenticationFeature;
import org.whispersystems.textsecuregcm.configuration.DirectoryServerConfiguration;
import org.whispersystems.textsecuregcm.entities.DirectoryReconciliationRequest;
import org.whispersystems.textsecuregcm.entities.DirectoryReconciliationResponse;
import org.whispersystems.textsecuregcm.util.CertificateExpirationGauge;
import org.whispersystems.textsecuregcm.util.Constants;
import javax.net.ssl.SSLContext;
import javax.ws.rs.client.Client;
@@ -37,6 +40,8 @@ import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import static com.codahale.metrics.MetricRegistry.name;
public class DirectoryReconciliationClient {
private final String replicationUrl;
@@ -47,6 +52,10 @@ public class DirectoryReconciliationClient {
{
this.replicationUrl = directoryServerConfiguration.getReplicationUrl();
this.client = initializeClient(directoryServerConfiguration);
SharedMetricRegistries.getOrCreate(Constants.METRICS_NAME)
.register(name(getClass(), "days_until_certificate_expiration"),
new CertificateExpirationGauge(getCertificate(directoryServerConfiguration.getReplicationCaCertificate())));
}
public DirectoryReconciliationResponse sendChunk(DirectoryReconciliationRequest request) {
@@ -74,8 +83,7 @@ public class DirectoryReconciliationClient {
throws CertificateException
{
try {
PEMReader reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(caCertificatePem.getBytes())));
X509Certificate certificate = (X509Certificate) reader.readObject();
X509Certificate certificate = getCertificate(caCertificatePem);
if (certificate == null) {
throw new CertificateException("No certificate found in parsing!");
@@ -92,4 +100,11 @@ public class DirectoryReconciliationClient {
}
}
private static X509Certificate getCertificate(final String certificatePem) throws CertificateException {
try (PEMReader reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(certificatePem.getBytes())))) {
return (X509Certificate) reader.readObject();
} catch (IOException e) {
throw new CertificateException(e);
}
}
}

32
service/src/main/java/org/whispersystems/textsecuregcm/util/CertificateExpirationGauge.java Normal file
View File

@@ -0,0 +1,32 @@
package org.whispersystems.textsecuregcm.util;
import com.codahale.metrics.CachedGauge;
import org.bouncycastle.openssl.PEMReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.time.Duration;
import java.time.Instant;
import java.util.concurrent.TimeUnit;
/**
* Measures and reports the number of days until a certificate expires.
*/
public class CertificateExpirationGauge extends CachedGauge<Long> {
private final Instant certificateExpiration;
public CertificateExpirationGauge(final X509Certificate certificate) {
super(1, TimeUnit.HOURS);
certificateExpiration = certificate.getNotAfter().toInstant();
}
@Override
protected Long loadValue() {
return Duration.between(Instant.now(), certificateExpiration).toDays();
}
}