Standard view Table view

CISCO-PKI-MIB

        description
Source file
CISCO-PKI-MIB
Last revised
Identity
ciscoPkiMIB
Base OID
1.3.6.1.4.1.9.9.854
Imported Objects
CISCO-SMI ciscoMgmt
SNMPv2-CONF MODULE-COMPLIANCE NOTIFICATION-GROUP OBJECT-GROUP
SNMPv2-SMI Counter32 Integer32 MODULE-IDENTITY NOTIFICATION-TYPE OBJECT-TYPE Unsigned32
SNMPv2-TC DisplayString TimeInterval
Net-SNMP examples using the cisco MIB directory Show commands

These commands use the standard Observium installation path and load the selected MIB variant before the RFC and Net-SNMP directories.

Translate the module identity
/usr/bin/snmptranslate -Pud -Ir -On -m 'CISCO-PKI-MIB' -M '/opt/observium/mibs/cisco:/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'CISCO-PKI-MIB::ciscoPkiMIB'
Walk the MIB subtree
/usr/bin/snmpbulkwalk -v2c -c '<community>' -Pud -Ir -OQUs -m 'CISCO-PKI-MIB' -M '/opt/observium/mibs/cisco:/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'udp:<hostname>:161' 'CISCO-PKI-MIB::ciscoPkiMIB'
How SNMP, Net-SNMP, MIB paths, and variants work
Objects (68)
ciscoPkiMIB
.1.3.6.1.4.1.9.9.854
ciscoPkiMIBNotifs
.1.3.6.1.4.1.9.9.854.1
ciscoPkiMIBObjects
.1.3.6.1.4.1.9.9.854.2
ciscoPkiConfiguration
.1.3.6.1.4.1.9.9.854.2.1
ciscoPkiEnrollmentProfile
.1.3.6.1.4.1.9.9.854.2.1.1
ciscoPkiEnrollmentTable
.1.3.6.1.4.1.9.9.854.2.1.1.1
enrollProfEntry
enrollProfLabel
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1
enrolLocation
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.10
enrolVrf
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.11
enrolSourceInter
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.12
reenrolMethod
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.13
reenrolLocation
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.14
reenrolVrf
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.15
reenrolSourceInter
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.16
enrollProfLabel
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.3
enrolCredentials
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.4
authLocation
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.5
authMethod
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.6
authVrf
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.7
authSourceInter
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.8
enrolMethod
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.1.1.1.9
ciscoPkiTrustpoints
.1.3.6.1.4.1.9.9.854.2.1.2
pkiTPTable
.1.3.6.1.4.1.9.9.854.2.1.2.1
pkiTPEntry
tpLabel
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1
tpLabel
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.1
keyPairLabel
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.10
revocationMethod
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.11
hashAlgo
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.12
trustpointState
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.13
subjectName
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.2
subjectAltName
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.3
aaaListInfo
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.4
enrollmentConfig
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.5
vrfConfig
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.6
sourceInter
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.7
autoEnroll
OctetString
 .1.3.6.1.4.1.9.9.854.2.1.2.1.1.8
ciscoPkiCertificates
.1.3.6.1.4.1.9.9.854.2.2
certChainTable
.1.3.6.1.4.1.9.9.854.2.2.1
certChainEntry
certChainLabel
 .1.3.6.1.4.1.9.9.854.2.2.1.1
certChainLabel
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.1
certSerialNum
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.2
certIssuerName
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.3
certStartDate
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.4
certEndDate
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.5
certType
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.6
certRemainingLife
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.7
certTpLabel
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.8
certSubName
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.2.1.1.9
ciscoPkiRevocationInfo
.1.3.6.1.4.1.9.9.854.2.3
ciscoPkiCRLInfo
.1.3.6.1.4.1.9.9.854.2.3.1
pkiCRLTable
.1.3.6.1.4.1.9.9.854.2.3.1.1
pkiCRLEntry
crlTpLabel
 .1.3.6.1.4.1.9.9.854.2.3.1.1.1
crlTpLabel
SNMPv2-TCDisplayString
 .1.3.6.1.4.1.9.9.854.2.3.1.1.1.1
issuerName
OctetString
 .1.3.6.1.4.1.9.9.854.2.3.1.1.1.2
sequenceNumb
OctetString
 .1.3.6.1.4.1.9.9.854.2.3.1.1.1.3
nextUpdate
OctetString
 .1.3.6.1.4.1.9.9.854.2.3.1.1.1.4
crlSize
Unsigned32
 .1.3.6.1.4.1.9.9.854.2.3.1.1.1.5
deltaCRLFlag
SNMPv2-SMIUnsigned32
 .1.3.6.1.4.1.9.9.854.2.3.1.1.1.6
ciscoPkiOSCPInfo
.1.3.6.1.4.1.9.9.854.2.3.2
pkiOCSPTable
.1.3.6.1.4.1.9.9.854.2.3.2.1
pkiOCSPEntry
ocspTpLabel
 .1.3.6.1.4.1.9.9.854.2.3.2.1.1
ocspTpLabel
OctetString
 .1.3.6.1.4.1.9.9.854.2.3.2.1.1.1
responderID
OctetString
 .1.3.6.1.4.1.9.9.854.2.3.2.1.1.2
thisUpdate
OctetString
 .1.3.6.1.4.1.9.9.854.2.3.2.1.1.3
nexUpdate
OctetString
 .1.3.6.1.4.1.9.9.854.2.3.2.1.1.4
ciscoPkiMIBConform
.1.3.6.1.4.1.9.9.854.3
ciscoPkiMIBCompliances
.1.3.6.1.4.1.9.9.854.3.1
ciscoPkiMIBGroups
.1.3.6.1.4.1.9.9.854.3.2
Dependencies (4) 4 direct Show tree and compile order Hide dependency details

Each imported module is resolved in the importing module's source directory first, then through the normal default-variant rules.

Dependency tree
Dependency-first compile order
  1. SNMPv2-SMIrfc
  2. CISCO-SMIcisco
  3. SNMPv2-CONFrfc
  4. SNMPv2-TCrfc
  5. CISCO-PKI-MIBciscoselected
Conformance Groups (2)
ciscoPkiMIBMainObjectGroup
enrolMethod trustpointState revocationMethod enrollmentConfig subjectName subjectAltName aaaListInfo vrfConfig sourceInter autoEnroll keyPairLabel issuerName sequenceNumb nextUpdate crlSize deltaCRLFlag responderID thisUpdate nexUpdate certRemainingLife certSerialNum certIssuerName certStartDate certEndDate certType certTpLabel certSubName hashAlgo enrolCredentials authLocation authMethod authVrf authSourceInter enrolLocation enrolVrf enrolSourceInter reenrolMethod reenrolLocation reenrolVrf reenrolSourceInter
The is a test group.
 .1.3.6.1.4.1.9.9.854.3.2.1
ciscoPkiMIBNotificationGroup
ciscoPkiCertInstallAlert ciscoPkiCertExpiryAlert
Notification alert group consists of both installation and
expiry notifications.
 .1.3.6.1.4.1.9.9.854.3.2.2
Compliance Statements (1)

OID .1.3.6.1.4.1.9.9.854.3.1.1
This is a default module-compliance
containing default object groups.
Required groups
mandatory ciscoPkiMIBMainObjectGroup
mandatory ciscoPkiMIBNotificationGroup
Notifications / Traps (2)
NameOIDDescription
ciscoPkiCertInstallAlert
certSerialNum certIssuerName certStartDate certEndDate certType certTpLabel certSubName
.1.3.6.1.4.1.9.9.854.1.1
When a certificate is installed on the device, notification
will be sent with following information.

a) Certificates Serial number
b) Certificate Issuer-name
c) Certificate Subject name
d) Trustpoint name
e) Type of certificate. (i.e. CA/ID) certificate
f) Certificate Start Date
g) Certificate End Date

Alert will not be sent for RA certificates, trustpool
certificates and self-signed non-persistent certificates.
ciscoPkiCertExpiryAlert
certSerialNum certSubName certIssuerName certType certTpLabel certRemainingLife
.1.3.6.1.4.1.9.9.854.1.2
Certificate Expiry alert consists of following
a) Certificate Serial number
b) Certificate Issuer-name
c) Trustpoint name
d) Type of certificate (i.e. CA/ID/SUBCA/RA)
e) Certificate remaining lifetime in seconds.
f) Certificate subject-name

When a certificate is reaching its expiry on the router, a trap
will be sent to SNMP server at regular intervals starting from
60days to till 1week. From 1week onwards daily one trap will be
sent with
following information

a) Certificate Serial number
b) Certificate Issuer-name
c) Trustpoint name
d) Type of certificate (i.e. CA/ID)
e) Certificate remaining lifetime.

Alert will not be sent if trustpoint is configured with
auto-enroll and corresponding shadow certificate/rollover
certificate is present provided, shadow/rollover certificates
start time is same/behind certificate end time.

If shadow/rollover certificate start time is ahead of
certificate end time, alerts will be continued to send because
shadow certificate wont be valid from certificates expiry
time.

Expiry alerts will not be sent for trustpool certificates.