Skip to content

Certificate Dashboard

Source: Certificate Dashboard Technical Appendix (OPS 21003730995)

Overview

The RaaS Certificate Monitoring Dashboard provides centralised visibility into TLS certificate expiry across all customer accounts.

  • URL: https://zpkt7dman0.execute-api.us-west-2.amazonaws.com/
  • Auth: Cognito login (us-west-2_4buzXMwkY)
  • Data source: DynamoDB raas-cert-status table (management account 640815619001, us-west-2)
  • Live as of: 17 March 2026 — actively monitoring 19 customer accounts

Certificate Types Monitored

Type Key Description Method
rhapsody-wmc-file Cert file at /data/orionhealth/certificates/server.crt File read via SSM
rhapsody-wmc-live Live cert served on port 8444 TLS handshake
rhapsody-ldap LDAP TLS cert (if LDAP enabled) TLS handshake
haproxy-smtp HAProxy SMTP relay cert TLS handshake
acm-lb ACM cert on load balancer (added 17 March 2026) Lambda scan

Status Thresholds

Status Days to Expiry Colour
ok > 30 days Green
warning 14–30 days Amber
critical 1–13 days Red
expired ≤ 0 days Dark red
error Check failed Grey

Alerting Thresholds

Days to Expiry Action
≤ 30 days SNS notification sent
≤ 7 days Jira OPS ticket created automatically
≤ 1 day GitHub Actions workflow dispatched (cert renewal attempt)

Architecture

SSM State Manager (per-account)
    └→ cert-check script (runs on each RaaS instance)
        └→ Assumes raas-cert-monitor-writer role (management account)
            └→ Writes to DynamoDB raas-cert-status

Lambda raas-cert-acm-scanner (management account)
    └→ Assumes raas-cert-recheck role (per customer account)
        └→ Calls acm:ListCertificates + acm:DescribeCertificate
            └→ Writes acm-lb records to DynamoDB

Lambda raas-cert-dashboard-sso → API Gateway → Cognito → Browser UI
Lambda raas-cert-alerter (schedule currently disabled for phase 3 rollout)

DynamoDB Data Model

raas-cert-status

Attribute Description
PK <account_id>#<env>#<hostname>
SK <cert_type> (e.g. rhapsody-wmc-file)
days_to_expiry Integer
status ok / warning / critical / expired / error
expiry_date ISO 8601 date string
last_checked ISO 8601 timestamp
cert_subject Common name from the certificate

raas-cert-accounts

Holds per-account metadata used by the dashboard and alerter: account ID, customer code, region, SSM association ID.

Cross-Account IAM

Role Account Purpose
raas-cert-monitor-writer 640815619001 (management) Trusted by org (o-ygi804pjmg); instances assume this to write to DynamoDB
raas-cert-recheck Each customer account Assumed by raas-cert-acm-scanner Lambda to read ACM certs
CoralogixAWSMetricsRole-<customer_code> Each customer account Assumed by Coralogix to read CloudWatch metrics

Certificate Renewal Flow

  1. Operator generates or receives renewed certificate file
  2. Deploy via Ansible Tower (cert-deploy playbook) or GitHub Actions certificate workflow
  3. Certificate file written to /data/orionhealth/certificates/server.crt
  4. Dashboard shows RESTART PENDING banner for that instance
  5. Operator confirms restart in the dashboard UI (sends restart_confirmed: true in POST body)
  6. Lambda triggers Rhapsody restart via GitHub Actions
  7. Dashboard refreshes — rhapsody-wmc-live cert updates to reflect new cert

Engine restart requires senior engineer authorisation

The restart_engine: true flow is server-side enforced. The UI must send restart_confirmed: true. Never trigger an engine restart without explicit authorisation from Lee or a senior engineer.

Deployment Scope (as of 17 March 2026)

Account Customer Region Notes
944682177265 Lincolnshire (Envoy) eu-west-2 First live Envoy customer
943397710386 raas-customer-uk (HSCN) eu-west-2 PoC account
+ 17 others Various Various See raas-cert-accounts DynamoDB table

Known Boundaries

  • The cert-check script only runs on instances tagged Role=rhapsody — instances with different tags will not be checked
  • ACM scanner only covers certs attached to ALBs in the customer account; private CAs are not scanned
  • The alerter (SNS/Jira/GitHub dispatch) is on a disabled schedule pending Phase 3 fleet rollout — do not rely on automated alerts yet
  • Dashboard login uses Cognito credentials — contact Lee to add new users to the user pool

Technical Operations

See raas/raas-cert-monitoring/ for deployment scripts.

For deploying to a new account, see the deployment scripts in the raas/raas-cert-monitoring/ folder in the RaaS workspace.