Certificate Expiry Experiment
The Certificate Expiry experiment retrieves the certificate chain from the target host/port and validates that no certificates will expire within a given time frame. If there is no secure connection available, and therefore no certificates, this experiment will succeed.
This experiment requires you to specify either a hostname or IPaddress. Gremlin will use the endpoint specified by these arguments as the subject of the test.
Options
| Parameter |
Flag |
Default |
Version |
Description |
| Length |
-l int |
60 |
2.28.5 |
The length of the experiment (seconds). |
| IP Addresses |
-i IP address |
|
2.28.5 |
Only check traffic to these IP addresses. Also accepts CIDR values (i.e.
10.0.0.0/24). |
| Hostnames |
-h hostnames |
|
2.28.5 |
Only check traffic to these hostnames. |
| Remote Ports |
-p port numbers |
443 |
2.28.5 |
Only check certificates from one of these remote ports. One port will be randomly selected. Also accepts
port ranges (e.g. 8080-8085). |
| Not Less Than |
-n hours |
720 |
2.28.5 |
Check for certificates that are expiring within this number of hours. |
| Providers |
WebUI and API Only |
|
2.28.5 |
External service providers to affect. |
| Tags |
WebUI and API Only |
|
2.28.5 |
Only impact traffic to hosts running Gremlin clients associated with these tags. |
Privileges required
| Privilege |
Description |
| FAULT_COLLECT_CERTS | Allows performing certificate experiments |
