Private/Checks/VCenter/Test-VcfVcenterCRLs.ps1
|
# Copyright (c) 2026 Broadcom. All Rights Reserved. # Broadcom Confidential. The term "Broadcom" refers to Broadcom Inc. # and/or its subsidiaries. # # ============================================================================= # # SOFTWARE LICENSE AGREEMENT # # Copyright (c) CA, Inc. All rights reserved. # # You are hereby granted a non-exclusive, worldwide, royalty-free license # under CA, Inc.'s copyrights to use, copy, modify, and distribute this # software in source code or binary form for use in connection with CA, Inc. # products. # # This copyright notice shall be included in all copies or substantial # portions of the software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS # IN THE SOFTWARE. # # ============================================================================= function Test-VcfVcenterCRLs { <# .SYNOPSIS Checks the number of entries in the vCenter appliance's TRUSTED_ROOT_CRLS VECS store. .DESCRIPTION Queries the TRUSTED_ROOT_CRLS VMware Endpoint Certificate Store (VECS) on each vCenter appliance via `vecs-cli entry list --store TRUSTED_ROOT_CRLS` using Invoke-VcfCheckVCenterApplianceCliCheck. Parses the total entry count from the command output. Note that this check evaluates total entry count in the certificate revocation list (CRL) store rather than CRL expiration or freshness. Evaluation logic: - Pass: Entry count is less than 1000. - Fail: Entry count is 1000 or greater. - Error: Unable to execute the command or parse the entry count from output. Populates a structured Rows table detailing StoreName, EntryCount, and Threshold. .PARAMETER Context The VcfCheck.Context object. Must already be connected to SDDC Manager. .PARAMETER DisplayName Optional friendly display name for the check result. .OUTPUTS [PSObject[]] Per-vCenter check results generated by Invoke-VcfCheckVCenterApplianceCliCheck. #> [CmdletBinding()] [OutputType([PSObject])] Param ( [Parameter(Mandatory = $true)] [PSObject]$Context, [Parameter(Mandatory = $false)] [String]$DisplayName = '' ) return Invoke-VcfCheckVCenterApplianceCliCheck -Context $Context -CheckId 'vcenter_CRLs' -DisplayName $DisplayName ` -ScriptText '/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store TRUSTED_ROOT_CRLS | grep "Number of entries"' ` -ParseOutcome { param($CommandResult) $countLine = ($CommandResult.ScriptOutput -split "`n" | Where-Object { $_ -match 'Number of entries' } | Select-Object -First 1) $entryCount = 0 $parsed = $false if ($countLine -and $countLine -match ':\s*(\d+)\s*$') { $parsed = [Int32]::TryParse($Matches[1], [ref]$entryCount) } if (-not $parsed) { return [PSCustomObject]@{ Status = 'Error'; Detail = "Could not parse vecs-cli output: $($CommandResult.ScriptOutput)"; Rows = @() } } $rows = @([PSCustomObject]@{ StoreName = 'TRUSTED_ROOT_CRLS' EntryCount = $entryCount Threshold = 1000 }) if ($entryCount -ge 1000) { return [PSCustomObject]@{ Status = 'Fail'; Detail = "TRUSTED_ROOT_CRLS store has $entryCount entries (threshold: 1000)."; Rows = $rows } } return [PSCustomObject]@{ Status = 'Pass'; Detail = "TRUSTED_ROOT_CRLS store has $entryCount entries."; Rows = $rows } } } |