4

Was about to ask how to check the date of SSL certificates automatically but then figured it out, so below you can find my answer too.

  • 2
    Welcome to Unix & Linux. Instead of posting a solution as a question, you should go forth and post the question as you were going to and then answer it yourself. See can I answer my own question? – drs Sep 7 '14 at 18:40
  • 1
    Hi good fairy. It looks like you have two accounts, this one and this one. I'm assuming this was not intentional. If so you can contact Stack Exchange and they will merge them for you. – slm Sep 8 '14 at 1:44
6

Here is the solution I came up with:

Make this a script and call it daily through cron, then you will get an email as soon as one of the certificates is about to expire:

#!/bin/bash 
gracedays=14
for server in myserver1 myserver2 myserver3;
do
    data=`echo | openssl s_client -connect "${server}:443" -servername "${server}" 2>/dev/null | openssl x509 -noout -enddate | sed -e 's#notAfter=##'`

    ssldate=`date -d "${data}" '+%s'`
    nowdate=`date '+%s'`
    diff="$((${ssldate}-${nowdate}))"

    if test "${diff}" -lt "$((${gracedays}*24*3600))";
    then
        if test "${diff}" -lt "0";
        then
            echo "The certificate for ${server} has already expired."
        else
            echo "The certificate for ${server} will expire in $((${diff}/3600/24)) days."
        fi
    fi
done

Problem is solved for me, if anyone wants to make it cooler or put in some repository, make it a module: Feel free!

  • This whole reputation and registration needed stuff is annoying, I will leave it like this now. The question has been shrunk (still needs approval) and the answer is moved to here. Feel free to make it community wiki, however that works. – good fairy Sep 7 '14 at 22:28
  • 1
    Unfortunately this is the state of the internet. Reputations are needed to perform various tasks on many websites, not just SE sites, to dissuade the bad people of the world from destroying online communities. Earning rep isn't that hard to earn with a little persistance. – slm Sep 8 '14 at 1:29
1
data=`echo | openssl s_client -connect "${server}:443" -servername "${server}" 2>/dev/null | openssl x509 -noout -dates | grep notAfter | sed -e 's#notAfter=##'`

With SNI hosts support.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.