Here’s how you can decode an SNMP response from an SRX firewall and retrieve certificate details:

To decode the expiration date of a PKI certificate:

1. Query the SNMP data using the relevant OID.
2. Convert the Hex-STRING into a human-readable date format using a hex decoder.

By following these steps, you’ll be able to extract and interpret CA certificate details clearly and effectively.

Identify the Relevant MIB OID

To query certificate details, you need the correct OIDs from the Juniper-Cert-MIB. These are the most relevant ones:

• jnxCertValidFrom: Certificate start date
• jnxCertValidTo: Certificate expiration date
• jnxCertIssuer: Issuer details
• jnxCertSerialNumber: Certificate serial number

Query Using SNMP

Use the SNMP walk command to query these OIDs. You can retrieve data in raw or ASCII-decoded format.

Example Command (ASCII Format):

root@test> show snmp mib walk ascii 1.3.6.1.4.1.2636.3.39.1.3.1.1

jnxJsLoadedLocalCertSubject."TWM-CA01" = /C=TW/ST=Taipei/O=TWM/OU=VPNs/CN=b08-34
jnxJsLoadedLocalCertSubject."aamw-srx-cert" = /C=US/O=G06KJydQ94z1sAxjTLNair8IhOvBwG3J/OU=SRX/CN=EkQgFGmgXwW4t9UBaM8DMHq8D4xI2xdJIRd3RHHhYB7jJXaDzLayVw==/UID=empty/[email protected]
jnxJsLoadedLocalCertSubject."test1" = /CN=JN1262EA9JCA
jnxJsLoadedLocalCertExpire."TWM-CA01" = 07 e8 05 02  0a 33 03 00  2b 00 00
jnxJsLoadedLocalCertExpire."aamw-srx-cert" = 07 f6 01 12  0f 00 00 00  2b 00 00
jnxJsLoadedLocalCertExpire."test1" = 07 ed 02 11  0f 0a 17 00  2b 00 00
jnxJsLoadedLocalCertIssuer."TWM-CA01" = C = TW, ST = Taipei, L = TPE, O = TWM, OU = CA, CN = TWM-CA01
jnxJsLoadedLocalCertIssuer."aamw-srx-cert" = C = US, O = Juniper Networks Inc, OU = SecIntel, CN = SecIntel (junipersecurity.net), emailAddress = [email protected]
jnxJsLoadedLocalCertIssuer."test1" = CN = JN1262EA9JCA

Decoding the above values:

Certificate Information

Certificate Subjects

• TWM-CA01: /C=TW/ST=Taipei/O=TWM/OU=VPNs/CN=b08-34
• aamw-srx-cert: /C=US/O=G06KJydQ94z1sAxjTLNair8IhOvBwG3J/OU=SRX/CN=EkQgFGmgXwW4t9UBaM8DMHq8D4xI2xdJIRd3RHHhYB7jJXaDzLayVw==/UID=empty/[email protected]
• test1: /CN=JN1262EA9JCA

Certificate Expiry (Hex Values)

• TWM-CA01: 07 e8 05 02 0a 33 03 00 2b 00 00
  • Decoded: May 2, 2008, 10:51:03 UTC+0
• aamw-srx-cert: 07 f6 01 12 0f 00 00 00 2b 00 00
  • Decoded: Jan 18, 2022, 15:00:00 UTC+0
• test1: 07 ed 02 11 0f 0a 17 00 2b 00 00
  • Decoded: Feb 17, 2013, 15:10:23 UTC+0

How to Decode Expiry Dates (Hex-STRING to Date)

The certificate expiration values are in a hex-string format. Use the following mapping to decode the values into a human-readable date:

1. Year: Octets 1–2
2. Month: Octet 3
3. Day: Octet 4
4. Hour: Octet 5
5. Minutes: Octet 6
6. Seconds: Octet 7

Example: Decoding 07 e8 05 02 0a 33 03 00 2b 00 00

• Year: 07 e8 → 2008
• Month: 05 → May
• Day: 02 → 2nd
• Hour: 0a → 10
• Minutes: 33 → 51
• Seconds: 03 → 3
• Decoded Result: May 2, 2008, 10:51:03

Summary of Decoded Certificate Information

By following the decoding steps above, you can extract and interpret all relevant certificate information from the MIB walk output.