11

Was about to ask how to check the date of SSL certificates automatically but then figured it out, so below you can find my answer too.

0

3 Answers 3

10

Here is the solution I came up with:

Make this a script and call it daily through cron, then you will get an email as soon as one of the certificates is about to expire:

#!/bin/bash 
gracedays=14
for server in myserver1 myserver2 myserver3;
do
    data=`echo | openssl s_client -connect "${server}:443" -servername "${server}" 2>/dev/null | openssl x509 -noout -enddate | sed -e 's#notAfter=##'`

    ssldate=`date -d "${data}" '+%s'`
    nowdate=`date '+%s'`
    diff="$((${ssldate}-${nowdate}))"

    if test "${diff}" -lt "$((${gracedays}*24*3600))";
    then
        if test "${diff}" -lt "0";
        then
            echo "The certificate for ${server} has already expired."
        else
            echo "The certificate for ${server} will expire in $((${diff}/3600/24)) days."
        fi
    fi
done

Problem is solved for me, if anyone wants to make it cooler or put in some repository, make it a module: Feel free!

0
6

Openssl has this functionality built in since at least 1.0.2. openssl x509 -checkend 86400 will check the certificate for expiry in the next day's worth of seconds, returning ERRORCODE for direct testing by bash scripts.

2
data=`echo | openssl s_client -connect "${server}:443" -servername "${server}" 2>/dev/null | openssl x509 -noout -dates | grep notAfter | sed -e 's#notAfter=##'`

With SNI hosts support.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .