cert.remote.sh

#!/bin/bash
# Thomas Merkel <[email protected]>
# Allow you to show ssl certificate details or show only the PEM
# format.

export PATH=/opt/pkg/bin:${PATH}

show_help() {
	echo "${0} [-d|-s] host port starttls"
	echo
	echo " -d: show details"
	echo " -s: show only pem format"
	exit 1
}

if (( ${#} < 1 )); then
	show_help
fi

OPTION=${1}; shift
REMHOST=${1}; shift
REMPORT=${1:-443}; shift
STARTTLS=${@}

if [[ -n ${STARTTLS} ]]; then
	STARTTLS='-starttls '${STARTTLS}
fi

save_cert() {
	echo |\
	openssl s_client -connect ${REMHOST}:${REMPORT} -servername ${REMHOST} ${STARTTLS} 2>&1 |\
	sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
}

detail_cert() {
	echo |\
	openssl s_client -connect ${REMHOST}:${REMPORT} -servername ${REMHOST} ${STARTTLS} 2>&1 |\
	sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' |\
	openssl x509 -text
}

case ${OPTION} in
	-d|-detail)
		detail_cert
	;;
	-s|-save)
		save_cert
	;;
	*)
		echo -e "/!\\ WARNING: legacy support\n"
		STARTTLS=${@}
		REMPORT=${REMHOST:-443}
		REMHOST=${OPTION}
		detail_cert
	;;
esac