domaintools/sslchecker/sslchecker.sh

@@ -1,8 +1,8 @@
-#! /bin/usr/env bash
+#!/usr/bin/env bash
 # Tool zum Prüfen von SSL-Gültigkeit mehrer Domains
 # Maintainer: peignerpausz
 
-set -eo pipefail
+set -o pipefail
 RED="\033[31m"
 GREEN="\033[32m"
 YELLOW="\033[33m"
@@ -32,7 +32,7 @@ USAGE
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    -d|--domains)
+  -d | --domains)
     shift
     while [[ $# -gt 0 && "$1" != -* ]]; do
       DOMAINS+=("$1")
@@ -40,10 +40,10 @@ while [[ $# -gt 0 ]]; do
     done
     ;;
 
-    -t|--type)
+  -t | --type)
-      TYPE="$2"
+    ISSUER="$2"
 
-      case "$TYPE" in
+    case "$ISSUER" in
     le)
       EXPECTED_ISSUER="Let's Encrypt"
       ;;
@@ -57,7 +57,7 @@ while [[ $# -gt 0 ]]; do
       EXPECTED_ISSUER="GlobalSign"
       ;;
     *)
-          echo "Fehler: Ungültiger Typ '$TYPE'"
+      echo "Fehler: Ungültiger Typ '$ISSUER'"
       echo "Erlaubte Werte: le, digicert, sectigo, global"
       exit 1
       ;;
@@ -66,7 +66,7 @@ while [[ $# -gt 0 ]]; do
     shift 2
     ;;
 
-    -h|--help)
+  -h | --help)
     usage
     exit 0
     ;;
@@ -81,15 +81,14 @@ done
 
 printf "+++SSLCHECKER v0.1+++\n"
 [[ ${#DOMAINS[@]} -eq 0 ]] && read -ra DOMAINS -p "Welche Domains sollen gesucht werden? " DOMAINS
-
 for domain in "${DOMAINS[@]}"; do
   printf "\n========= %s =========\n" "$domain"
   VALIDITY=$(curl -vI https://$domain 2>&1 | grep -F "SSL certificate verify ok")
   EXPIRE=$(echo | openssl s_client -connect $domain:443 -servername $domain 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
-  TYPE=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null \
+  ISSUER=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null |
-    | openssl x509 -noout -issuer \
+    openssl x509 -noout -issuer |
-    | grep -o 'O *= *[^,]*' \
+    grep -o 'O *= *[^,]*' |
-    | sed 's/O *= *//')
+    sed 's/O *= *//')
   expire_ts=$(date -d "$EXPIRE" +%s)
   now_ts=$(date +%s)
   days_left=$(((expire_ts - now_ts) / 86400))
@@ -98,18 +97,23 @@ for domain in "${DOMAINS[@]}"; do
   else
     printf "${RED}X${RESET} not valid SSL\n"
   fi
-  if [ "$days_left" -lt 30 ]; then
+  if [ "$days_left" -lt 0 ]; then
-    printf "${YELLOW}WARNING${RESET} SSL-Zertifikat läuft in $days_left Tagen ab ($EXPIRE)\n"
+    printf "${RED}CRITICAL${RESET} Zertifikat ist seit %d Tagen abgelaufen (%s)\n" "$((-days_left))" "$EXPIRE"
   elif [ "$days_left" -lt 7 ]; then
-    printf "${RED}X${RESET} Zertifikat läuft in %d Tagen ab (%s)\n" "$days_left" "$EXPIRE"
+    printf "${RED}CRITICAL${RESET} Zertifikat läuft in %d Tagen ab (%s)\n" "$days_left" "$EXPIRE"
+  elif [ "$days_left" -lt 30 ]; then
+    printf "${YELLOW}WARNING${RESET} SSL-Zertifikat läuft in $days_left Tagen ab ($EXPIRE)\n"
   else
     printf "${GREEN}OK${RESET} SSL-Zertifikat gültig bis $EXPIRE ($days_left Tage verbleibend)\n"
   fi
-  
+  if [[ -n $EXPECTED_ISSUER ]]; then
-  if [[ "$TYPE" == *"$EXPECTED_ISSUER"* ]]; then
+    if [[ "$ISSUER" == *"$EXPECTED_ISSUER"* ]]; then
       printf "${GREEN}OK${RESET} Cert ist von %s" "$EXPECTED_ISSUER"
     else
-    printf "${YELLOW}X${RESET} Cert ist nicht von %s (gefunden: %s)" "$EXPECTED_ISSUER" "$TYPE"
+      printf "${YELLOW}X${RESET} Cert ist nicht von %s (gefunden: %s)" "$EXPECTED_ISSUER" "$ISSUER"
+    fi
+  else
+    printf "${GREEN}INFO${RESET} Cert-Aussteller: %s" "$ISSUER"
   fi
   printf "\n"
 done