Add tls_cert_not_after to varz

[sciascid]

Expose the server's certificate expiration date in the varz monitor endpoint.

Fixes #7684

Signed-off-by: Daniele Sciascia daniele@nats.io

[neilalexander]

Approach looks fine, but WebSockets, leafnodes, routes, gateways can also have their own TLS configurations, can we extend to those too?

From opts.Cluster.TLSConfig, opts.Gateway.TLSConfig, opts.LeafNode.TLSConfig, opts.MQTT.TLSConfig, opts.WebSocket.TLSConfig off the top of my head. Each has their own section in varz I think.

[sciascid]

Approach looks fine, but WebSockets, leafnodes, routes, gateways can also have their own TLS configurations, can we extend to those too?

Done. I had to change the approach slightly: storing time.Time values would no longer work with omitempty and structures within structure. So I switched to strings.

[neilalexander]

LGTM!

[derekcollison]

Yes I know it was merged. But not reeleased yet. @neilalexander what are your thoughts here?

[neilalexander]

I don't have a strong opinion either way, but "Not before" and "Not after" match OpenSSL, Go's crypto/x509, Java's X509Certificate etc, so it seems OK to me.

[ripienaar]

Those terms are also in OpenSSL command line tools etc that’s why I suggested we use same

[derekcollison]

Thanks, did not realize there was a precedence already on naming this. I prefer simple as you know.

[ripienaar]

Though been thinking about this and I think as it stands someone has to make a bunch of HTTP requests to monitor the server - if it was all in varz in a struct a single call can be used to monitor all certs deployed, so maybe a map or array of entries all in one place would be better

[sciascid]

Not sure I follow. This is all in Varz. One request is enough to get all expiration dates. The other structures are embedded in Varz. For example, Varz contains one instance of ClusterOptsVarz. Same for the other structs.

…

Though been thinking about this and I think as it stands someone has to make a bunch of HTTP requests to monitor the server - if it was all in varz in a struct a single call can be used to monitor all certs deployed, so maybe a map or array of entries all in one place would be better

[ripienaar]

You’re right sorry for the noise. PR review on the phone :(