120 lines
3.0 KiB
Bash
120 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
|
# Tool zum Prüfen von SSL-Gültigkeit mehrer Domains
|
|
# Maintainer: peignerpausz
|
|
|
|
set -o pipefail
|
|
RED="\033[31m"
|
|
GREEN="\033[32m"
|
|
YELLOW="\033[33m"
|
|
RESET="\033[0m"
|
|
declare -a DOMAINS
|
|
|
|
usage() {
|
|
cat <<USAGE
|
|
Verwendung:
|
|
bash $0 [OPTIONEN]
|
|
Oder interaktiv: bash $0
|
|
|
|
Optionen:
|
|
-d, --domains DOMAIN [DOMAINS...]
|
|
Zu prüfende Domains
|
|
-t, --type
|
|
Prüft gegen erwarteten Issuer, etwa Let's Encrypt, Sectigo oder GlobalSign
|
|
-h, --help
|
|
Diese Hilfe anzeigen
|
|
|
|
Beispiele:
|
|
$0 -d domain1.tld domain2.tld -t le
|
|
|
|
$0 --domains domain1.tld domain2.tld --type le
|
|
USAGE
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-d | --domains)
|
|
shift
|
|
while [[ $# -gt 0 && "$1" != -* ]]; do
|
|
DOMAINS+=("$1")
|
|
shift
|
|
done
|
|
;;
|
|
|
|
-t | --type)
|
|
ISSUER="$2"
|
|
|
|
case "$ISSUER" in
|
|
le)
|
|
EXPECTED_ISSUER="Let's Encrypt"
|
|
;;
|
|
digicert)
|
|
EXPECTED_ISSUER="DigiCert"
|
|
;;
|
|
sectigo)
|
|
EXPECTED_ISSUER="Sectigo"
|
|
;;
|
|
global)
|
|
EXPECTED_ISSUER="GlobalSign"
|
|
;;
|
|
*)
|
|
echo "Fehler: Ungültiger Typ '$ISSUER'"
|
|
echo "Erlaubte Werte: le, digicert, sectigo, global"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
shift 2
|
|
;;
|
|
|
|
-h | --help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
|
|
*)
|
|
echo "Unbekannte Option: $1"
|
|
usage
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
printf "+++SSLCHECKER v0.1+++\n"
|
|
[[ ${#DOMAINS[@]} -eq 0 ]] && read -ra DOMAINS -p "Welche Domains sollen gesucht werden? " DOMAINS
|
|
for domain in "${DOMAINS[@]}"; do
|
|
printf "\n========= %s =========\n" "$domain"
|
|
VALIDITY=$(curl -vI https://$domain 2>&1 | grep -F "SSL certificate verify ok")
|
|
EXPIRE=$(echo | openssl s_client -connect $domain:443 -servername $domain 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
|
|
ISSUER=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null |
|
|
openssl x509 -noout -issuer |
|
|
grep -o 'O *= *[^,]*' |
|
|
sed 's/O *= *//')
|
|
expire_ts=$(date -d "$EXPIRE" +%s)
|
|
now_ts=$(date +%s)
|
|
days_left=$(((expire_ts - now_ts) / 86400))
|
|
if [[ -n "$VALIDITY" ]]; then
|
|
printf "${GREEN}OK${RESET} valid SSL\n"
|
|
else
|
|
printf "${RED}X${RESET} not valid SSL\n"
|
|
fi
|
|
if [ "$days_left" -lt 0 ]; then
|
|
printf "${RED}CRITICAL${RESET} Zertifikat ist seit %d Tagen abgelaufen (%s)\n" "$((-days_left))" "$EXPIRE"
|
|
elif [ "$days_left" -lt 7 ]; then
|
|
printf "${RED}CRITICAL${RESET} Zertifikat läuft in %d Tagen ab (%s)\n" "$days_left" "$EXPIRE"
|
|
elif [ "$days_left" -lt 30 ]; then
|
|
printf "${YELLOW}WARNING${RESET} SSL-Zertifikat läuft in $days_left Tagen ab ($EXPIRE)\n"
|
|
else
|
|
printf "${GREEN}OK${RESET} SSL-Zertifikat gültig bis $EXPIRE ($days_left Tage verbleibend)\n"
|
|
fi
|
|
if [[ -n $EXPECTED_ISSUER ]]; then
|
|
if [[ "$ISSUER" == *"$EXPECTED_ISSUER"* ]]; then
|
|
printf "${GREEN}OK${RESET} Cert ist von %s" "$EXPECTED_ISSUER"
|
|
else
|
|
printf "${YELLOW}X${RESET} Cert ist nicht von %s (gefunden: %s)" "$EXPECTED_ISSUER" "$ISSUER"
|
|
fi
|
|
else
|
|
printf "${GREEN}INFO${RESET} Cert-Aussteller: %s" "$ISSUER"
|
|
fi
|
|
printf "\n"
|
|
done
|