Checking the remaining valid days for certificates.

cert_valid_days_local.sh

#!/usr/bin/env bash
# Return the number of days the given certificate file is still valid
#
if [ "$#" -eq 0 ]; then
  echo "Usage: crt_valid_days <certificate>"
  exit 1
fi

if ! command -v openssl &> /dev/null; then
  echo "ERROR: OpenSSL not installed."
  exit 1
fi

CERT_FILE=$1
not_after=$(openssl x509 -in ${CERT_FILE} -noout -enddate | cut -d= -f2)
expire_seconds=$(date -ud "$not_after" +%s)
current_seconds=$(date +%s)
seconds_per_day=86400
echo $(( (expire_seconds - current_seconds) / seconds_per_day ))

cert_valid_days_tls.sh

# Return number of days the certificate is valid

if [ "$#" -eq 0 ]; then
  echo "Usage: crt_valid_days_tls <domain>"
  exit 1
fi
# Hostname of the website
DOMAIN_NAME=$1

# Webserver to connect to, usually identic
SERVER_NAME=${DOMAIN_NAME}

notAfter=$(echo | openssl s_client -servername ${DOMAIN_NAME} -connect ${SERVER_NAME}:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
expire_seconds=$(date -ud "$notAfter" +%s)
current_seconds=$(date +%s)
seconds_per_day=86400
echo $(( (expire_seconds - current_seconds) / seconds_per_day ))

main.go

package main

import (
        "crypto/x509"
        "encoding/pem"
        "fmt"
        "io/ioutil"
        "log"
        "os"
        "time"
)

func main() {
        if len(os.Args) < 2 {
                log.Fatalf("Missing certifcate file name.")
                os.Exit(99)
        }

        cert_path := os.Args[1]
        certPEM, err := ioutil.ReadFile(cert_path)
        if err != nil {
                log.Fatalf("error loading certificate: %v", err)
        }

        // PEM-Block decodieren
        block, _ := pem.Decode(certPEM)
        if block == nil {
                log.Fatalf("error decoding PEM block.")
        }

        // Zertifikat parsen
        cert, err := x509.ParseCertificate(block.Bytes)
        if err != nil {
                log.Fatalf("error parsing certificate: %v", err)
        }

        // Gültigkeitsdaten ausgeben
        now := time.Now()
        if now.Before(cert.NotBefore) || now.After(cert.NotAfter) {
                fmt.Println(-1)
                os.Exit(0)
        }
        remainingDays := cert.NotAfter.Sub(now).Hours() / 24
        fmt.Println(int(remainingDays))

}

Usage

All scripts are designed to return certificate validity metrics for monitoring systems.

The script cert_valid_days_local.sh checks the validity of a certificate file provided as a parameter and prints the remaining days until expiration.

The script cert_valid_days_tls.sh connects via TLS to a specified server and prints the remaining days until the server's certificate expires.

The Go source code accomplishes the same tasks in a system-independent manner using the Go crypto library. It can be compiled for both Linux and Windows.

Compilation Instructions

To compile the Go script for Linux:

GOOS=linux GOARCH=amd64 go build -o cert_valid_days

To compile the Go script for Windows:

GOOS=windows GOARCH=amd64 go build -o cert_valid_days.exe