Added sslchecker.sh to domaintools

2026-09-16 17:52:06 +02:00
parent e87a48cd7a
commit 083f42ca51
4 changed files with 233 additions and 2 deletions
@@ -0,0 +1,115 @@
+#! /bin/usr/env bash
+# Tool zum Prüfen von SSL-Gültigkeit mehrer Domains
+# Maintainer: peignerpausz
+
+set -eo pipefail
+RED="\033[31m"
+GREEN="\033[32m"
+YELLOW="\033[33m"
+RESET="\033[0m"
+declare -a DOMAINS
+
+usage() {
+  cat <<USAGE
+    Verwendung:
+    bash $0 [OPTIONEN]
+    Oder interaktiv: bash $0
+
+    Optionen:
+    -d, --domains DOMAIN [DOMAINS...]
+      Zu prüfende Domains
+    -t, --type
+      Prüft gegen erwarteten Issuer, etwa Let's Encrypt, Sectigo oder GlobalSign
+    -h, --help
+      Diese Hilfe anzeigen
+    
+    Beispiele:
+      $0 -d domain1.tld domain2.tld -t le
+      
+      $0 --domains domain1.tld domain2.tld --type le
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -d|--domains)
+      shift
+      while [[ $# -gt 0 && "$1" != -* ]]; do
+        DOMAINS+=("$1")
+        shift
+      done
+      ;;
+      
+    -t|--type)
+      TYPE="$2"
+
+      case "$TYPE" in
+        le)
+        EXPECTED_ISSUER="Let's Encrypt"
+          ;;
+        digicert)
+	EXPECTED_ISSUER="DigiCert"
+	;;
+	sectigo)
+	EXPECTED_ISSUER="Sectigo"
+	;;
+	global)
+	EXPECTED_ISSUER="GlobalSign"
+	;;
+	*)
+          echo "Fehler: Ungültiger Typ '$TYPE'"
+          echo "Erlaubte Werte: le, digicert, sectigo, global"
+          exit 1
+          ;;
+      esac
+
+      shift 2
+      ;;
+      
+    -h|--help)
+      usage
+      exit 0
+      ;;
+      
+    *)
+      echo "Unbekannte Option: $1"
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+printf "+++SSLCHECKER v0.1+++\n"
+[[ ${#DOMAINS[@]} -eq 0 ]] && read -ra DOMAINS -p "Welche Domains sollen gesucht werden? " DOMAINS
+
+for domain in "${DOMAINS[@]}"; do
+  printf "\n========= %s =========\n" "$domain"
+  VALIDITY=$(curl -vI https://$domain 2>&1 | grep -F "SSL certificate verify ok")
+  EXPIRE=$(echo | openssl s_client -connect $domain:443 -servername $domain 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
+  TYPE=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null \
+    | openssl x509 -noout -issuer \
+    | grep -o 'O *= *[^,]*' \
+    | sed 's/O *= *//')
+  expire_ts=$(date -d "$EXPIRE" +%s)
+  now_ts=$(date +%s)
+  days_left=$(((expire_ts - now_ts) / 86400))
+  if [[ -n "$VALIDITY" ]]; then
+    printf "${GREEN}OK${RESET} valid SSL\n"
+  else
+    printf "${RED}X${RESET} not valid SSL\n"
+  fi
+  if [ "$days_left" -lt 30 ]; then
+    printf "${YELLOW}WARNING${RESET} SSL-Zertifikat läuft in $days_left Tagen ab ($EXPIRE)\n"
+  elif [ "$days_left" -lt 7 ]; then
+    printf "${RED}X${RESET} Zertifikat läuft in %d Tagen ab (%s)\n" "$days_left" "$EXPIRE"
+  else
+    printf "${GREEN}OK${RESET} SSL-Zertifikat gültig bis $EXPIRE ($days_left Tage verbleibend)\n"
+  fi 
+  
+  if [[ "$TYPE" == *"$EXPECTED_ISSUER"* ]]; then
+    printf "${GREEN}OK${RESET} Cert ist von %s" "$EXPECTED_ISSUER"
+  else
+    printf "${YELLOW}X${RESET} Cert ist nicht von %s (gefunden: %s)" "$EXPECTED_ISSUER" "$TYPE"
+  fi
+  printf "\n"
+done