Scan all domains in a route53 zone for TLS certificate expiration dates

r53_cert_scan.sh

#!/bin/bash
export DOMAIN=test.info
export PROFILE=default

aws --profile ${PROFILE} route53 list-resource-record-sets  --hosted-zone-id $(aws --profile ${PROFILE} route53 list-hosted-zones-by-name --dns-name ${DOMAIN} --max-items 1 | jq -r .HostedZones[0].Id) > /tmp/${DOMAIN}.json

for a in $(cat /tmp/${DOMAIN}.json | jq -r '.[][] | "\(.Name),\(.ResourceRecords[0].Value)"' | sort | uniq); do        
    rr=$(echo $a | awk -F"," '{print $1}')
    value=$(echo $a | awk -F"," '{print $2}')
    echo -n "$rr,$value,"
    echo | timeout 2 openssl s_client -servername $rr -connect $rr:443 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null| grep notAfter | awk -F"=" '{print $2}';
    echo
done