Nagios charm needs to handle self-signed SSL certificate expiration.

[Paul Goins]

On a customer cloud using the self-signed certificate option, the certificate has expired. However, the charm does not appear to have anything in place for dealing with this. It creates the certificate one and only one time.

[Paul Goins (vultaire)]

The certificate is generated by charmhelpers, and it looks like the expiration is hard-coded to 365 days. If this expires, there is no charmed action to manage this.

The workaround is likely as follows:

* Delete the /etc/ssl/certs/<ip>.pem and /etc/ssl/private/<ip>.key files
* Run the config-changed hook by hand.

[Paul Goins (vultaire)]

The workaround works, in case others hit this.

[Dariusz Smigiel (smigiel-dariusz)]

Bumping up the bug.
I spent half of the day trying to find where the issue happened.

FTR: the certificate is on a remote (cloud's) nagios unit.

[Facundo Ciccioli (fandanbango)]

We should also monitor the certificate's expiry date when 'monitor_self' is turned on, whether is a self-signed one or not. As of today, I think we don't have any such monitoring and this always hits us by surprise with a misleading alert (bootstack-thruk-CUSTOMER-agent-0-bootstack-CUSTOMER-thruk-CUSTOMER-agent-0).

While this issue seems to be for adding a 'reissue-certificate' action or something similar when using a self-signed certificate, I believe the monitoring could be implemented as part of it.

[Eric Chen (eric-chen)]

This charm is no longer being actively maintained. New feature won't be implemented.
Please consider using the new Canonical Observability Stack instead.
(https://charmhub.io/topics/canonical-observability-stack).