Back to Checks
aws

Directory Service LDAP certificate expires in more than 90 days

directoryservice_ldap_certificate_expiration
Service: directoryserviceSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Directory Service Secure LDAP (LDAPS) certificates are assessed for upcoming expiration by comparing each directory's certificate expiration to the current time and identifying those with <= 90 days remaining.

Prowler logoProwlerprowler-provider-aws

Risk

Expired LDAPS certificates cause TLS handshakes to fail, blocking directory binds and queries and disrupting authentication and app integrations (availability). If clients fall back to plain LDAP, credentials and directory data can be intercepted or altered (confidentiality and integrity).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks directoryservice_ldap_certificate_expiration

Recommendation

Adopt certificate lifecycle management: inventory LDAPS certificates, alert well before expiry, and automate renewal with staged rollout and overlap. Enforce TLS-only LDAP and disable plaintext fallback. Apply least privilege and separation of duties to certificate issuance and deployment.

Remediation

CLI

aws ds register-certificate --directory-id <DIRECTORY_ID> --certificate-data file://certificate.pem

Other

1In the AWS Console, open Directory Service and select your AWS Managed Microsoft AD (<example_resource_id>)
2Go to Networking & security > Secure LDAP
3Click Edit (Manage certificate)
4Choose Replace certificate (or Upload certificate)
5Upload a new LDAPS server certificate with private key from a trusted CA (valid for >90 days); enter the password if using a .pfx
6Save and wait until the certificate status is Active

Check Code

from datetime import datetime

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.directoryservice.directoryservice_client import (
    directoryservice_client,
)

DAYS_TO_EXPIRE_THRESHOLD = 90
"""Number of days to notify about a certificate expiration"""


class directoryservice_ldap_certificate_expiration(Check):
    def execute(self):
        findings = []
        for directory in directoryservice_client.directories.values():
            for certificate in directory.certificates:
                report = Check_Report_AWS(metadata=self.metadata(), resource=directory)
                report.resource_id = certificate.id

                remaining_days_to_expire = (
                    certificate.expiry_date_time
                    - datetime.now(
                        certificate.expiry_date_time.tzinfo
                        if hasattr(certificate.expiry_date_time, "tzinfo")
                        else None
                    )
                ).days

                if remaining_days_to_expire <= DAYS_TO_EXPIRE_THRESHOLD:
                    report.status = "FAIL"
                    report.status_extended = f"LDAP Certificate {certificate.id} configured at {directory.id} is about to expire in {remaining_days_to_expire} days."
                else:
                    report.status = "PASS"
                    report.status_extended = f"LDAP Certificate {certificate.id} configured at {directory.id} expires in {remaining_days_to_expire} days."

                findings.append(report)

        return findings

References