diff --git a/domaintools/sslchecker/sslchecker.sh b/domaintools/sslchecker/sslchecker.sh index f43db30..0282e2e 100644 --- a/domaintools/sslchecker/sslchecker.sh +++ b/domaintools/sslchecker/sslchecker.sh @@ -1,8 +1,8 @@ -#! /bin/usr/env bash +#!/usr/bin/env bash # Tool zum Prüfen von SSL-Gültigkeit mehrer Domains # Maintainer: peignerpausz -set -eo pipefail +set -o pipefail RED="\033[31m" GREEN="\033[32m" YELLOW="\033[33m" @@ -32,64 +32,63 @@ USAGE while [[ $# -gt 0 ]]; do case "$1" in - -d|--domains) + -d | --domains) + shift + while [[ $# -gt 0 && "$1" != -* ]]; do + DOMAINS+=("$1") shift - while [[ $# -gt 0 && "$1" != -* ]]; do - DOMAINS+=("$1") - shift - done - ;; - - -t|--type) - TYPE="$2" + done + ;; - case "$TYPE" in - le) - EXPECTED_ISSUER="Let's Encrypt" - ;; - digicert) - EXPECTED_ISSUER="DigiCert" - ;; - sectigo) - EXPECTED_ISSUER="Sectigo" - ;; - global) - EXPECTED_ISSUER="GlobalSign" - ;; - *) - echo "Fehler: Ungültiger Typ '$TYPE'" - echo "Erlaubte Werte: le, digicert, sectigo, global" - exit 1 - ;; - esac + -t | --type) + ISSUER="$2" - shift 2 + case "$ISSUER" in + le) + EXPECTED_ISSUER="Let's Encrypt" ;; - - -h|--help) - usage - exit 0 + digicert) + EXPECTED_ISSUER="DigiCert" + ;; + sectigo) + EXPECTED_ISSUER="Sectigo" + ;; + global) + EXPECTED_ISSUER="GlobalSign" ;; - *) - echo "Unbekannte Option: $1" - usage + echo "Fehler: Ungültiger Typ '$ISSUER'" + echo "Erlaubte Werte: le, digicert, sectigo, global" exit 1 ;; + esac + + shift 2 + ;; + + -h | --help) + usage + exit 0 + ;; + + *) + echo "Unbekannte Option: $1" + usage + exit 1 + ;; esac done printf "+++SSLCHECKER v0.1+++\n" [[ ${#DOMAINS[@]} -eq 0 ]] && read -ra DOMAINS -p "Welche Domains sollen gesucht werden? " DOMAINS - for domain in "${DOMAINS[@]}"; do printf "\n========= %s =========\n" "$domain" VALIDITY=$(curl -vI https://$domain 2>&1 | grep -F "SSL certificate verify ok") EXPIRE=$(echo | openssl s_client -connect $domain:443 -servername $domain 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2) - TYPE=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null \ - | openssl x509 -noout -issuer \ - | grep -o 'O *= *[^,]*' \ - | sed 's/O *= *//') + ISSUER=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null | + openssl x509 -noout -issuer | + grep -o 'O *= *[^,]*' | + sed 's/O *= *//') expire_ts=$(date -d "$EXPIRE" +%s) now_ts=$(date +%s) days_left=$(((expire_ts - now_ts) / 86400)) @@ -98,18 +97,23 @@ for domain in "${DOMAINS[@]}"; do else printf "${RED}X${RESET} not valid SSL\n" fi - if [ "$days_left" -lt 30 ]; then - printf "${YELLOW}WARNING${RESET} SSL-Zertifikat läuft in $days_left Tagen ab ($EXPIRE)\n" + if [ "$days_left" -lt 0 ]; then + printf "${RED}CRITICAL${RESET} Zertifikat ist seit %d Tagen abgelaufen (%s)\n" "$((-days_left))" "$EXPIRE" elif [ "$days_left" -lt 7 ]; then - printf "${RED}X${RESET} Zertifikat läuft in %d Tagen ab (%s)\n" "$days_left" "$EXPIRE" + printf "${RED}CRITICAL${RESET} Zertifikat läuft in %d Tagen ab (%s)\n" "$days_left" "$EXPIRE" + elif [ "$days_left" -lt 30 ]; then + printf "${YELLOW}WARNING${RESET} SSL-Zertifikat läuft in $days_left Tagen ab ($EXPIRE)\n" else printf "${GREEN}OK${RESET} SSL-Zertifikat gültig bis $EXPIRE ($days_left Tage verbleibend)\n" - fi - - if [[ "$TYPE" == *"$EXPECTED_ISSUER"* ]]; then - printf "${GREEN}OK${RESET} Cert ist von %s" "$EXPECTED_ISSUER" + fi + if [[ -n $EXPECTED_ISSUER ]]; then + if [[ "$ISSUER" == *"$EXPECTED_ISSUER"* ]]; then + printf "${GREEN}OK${RESET} Cert ist von %s" "$EXPECTED_ISSUER" + else + printf "${YELLOW}X${RESET} Cert ist nicht von %s (gefunden: %s)" "$EXPECTED_ISSUER" "$ISSUER" + fi else - printf "${YELLOW}X${RESET} Cert ist nicht von %s (gefunden: %s)" "$EXPECTED_ISSUER" "$TYPE" + printf "${GREEN}INFO${RESET} Cert-Aussteller: %s" "$ISSUER" fi printf "\n" done