SSL certificate validation script for Zabbix https://www.zabbix.org/wiki/Docs/howto/ssl_certificate_check

zext_ssl_cert.sh

#! /bin/sh
#
# Modified script from https://www.zabbix.org/wiki/Docs/howto/ssl_certificate_check
# which is able to check multiple hosts at once.
#
# Define a host macros like {$SNI} => 'domain1.com,domain2.com'
#
# Kostya Esmukov <[email protected]>
#

#------------------------------------------------------------
# zext_ssl_cert.sh
# Script checks for number of days until certificate expires or the issuing authority
# depending on switch passed on command line.
#
#Based on script from aperto.fr (http://aperto.fr/cms/en/blog/15-blog-en/15-ssl-certificate-expiration-monitoring-with-zabbix.html)
#with additions by [email protected]
#------------------------------------------------------------

DEBUG=0
if [ $DEBUG -gt 0 ]
then
    exec 2>>/tmp/my.log
    set -x
fi

f=$1
host=$2
port=$3
sni=$4
proto=$5

if [ -z "$sni" ]
then
    servernames=$host
else
    servernames=$sni
fi

if [ -n "$proto" ]
then
    starttls="-starttls $proto"
fi

min() {
    [ $1 -le $2 ] && echo "$1" || echo "$2"
}

case $f in
-d)
min_expire_days=9999999

while IFS=',' read -ra ADDR; do
    for servername in "${ADDR[@]}"; do


        end_date=`openssl s_client -servername $servername -host $host -port $port -showcerts $starttls -prexit </dev/null 2>/dev/null |
                  sed -n '/BEGIN CERTIFICATE/,/END CERT/p' |
                  openssl x509 -text 2>/dev/null |
                  sed -n 's/ *Not After : *//p'`

        if [ -n "$end_date" ]
        then
            end_date_seconds=`date '+%s' --date "$end_date"`
            now_seconds=`date '+%s'`
            min_expire_days=`min $min_expire_days $(expr '(' $end_date_seconds - $now_seconds ')' / 24 / 3600)`
        fi


    done
done <<< "$servernames"

echo "$min_expire_days"
;;

-i)
while IFS=',' read -ra ADDR; do
    for servername in "${ADDR[@]}"; do


        issue_dn=`openssl s_client -servername $servername -host $host -port $port -showcerts $starttls -prexit </dev/null 2>/dev/null |
                  sed -n '/BEGIN CERTIFICATE/,/END CERT/p' |
                  openssl x509 -text 2>/dev/null |
                  sed -n 's/ *Issuer: *//p'`

        if [ -n "$issue_dn" ]
        then
            issuer=`echo $issue_dn | sed -n 's/.*CN=*//p'`
            printf "'%s:%s' " "$servername" "$issuer"
        fi


    done
done <<< "$servernames"
echo

;;
*)
echo "usage: $0 [-i|-d] hostname port sni"
echo "    -i Show Issuer"
echo "    -d Show valid days remaining"
;;
esac