2 # Check peer certificate validity
3 # Require perl module : IO::Socket, Net::SSLeay, Date::Parse
4 # Require unix programs : openssl, echo, sendmail
6 # Copyright (C) 2003 Emmanuel Lacour <elacour@home-dn.net>
8 # This file is free software; you can redistribute it and/or modify it
9 # under the terms of the GNU General Public License as published by the
10 # Free Software Foundation; either version 2, or (at your option) any
13 # This file is distributed in the hope that it will be
14 # useful, but WITHOUT ANY WARRANTY; without even the implied warranty
15 # of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 # General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this file; see the file COPYING. If not, write to the Free
20 # Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
25 # Local variables are prefixed with "l_"
33 Net::SSLeay::SSLeay_add_ssl_algorithms();
34 Net::SSLeay::randomize();
36 my $VERSION = '0.6.2';
37 my $AUTHOR = 'Emmanuel Lacour, <elacour@home-dn.net>';
39 my $opensslpath = "/usr/bin/openssl";
40 my $sendmailpath = "/usr/lib/sendmail";
44 my $conf = "/etc/sslexpire/sslexpire.conf";
58 # output : -m = mail, default = stdout
59 # host : -h host, -p port, default = from config file
60 # config : -f configfile, default /etc/sslexpire/sslexpire.conf
61 # standard : --help, --version
73 if (($opts{'host'}) && ($opts{'port'})) {
74 push @{$hosts{$opts{'host'}}}, $opts{'port'};
77 $mailreport = 1 if ($opts{'mail'});
80 $conf = $opts{'conf'};
87 if ($opts{'version'}) {
88 print "sslexpire $VERSION\n";
89 print "Written by $AUTHOR\n";
104 ($tmp,$alert) = split /=/, $_;
106 } elsif (/^mail[ ]*=/) {
107 ($tmp,$mail) = split /=/, $_;
108 # Use hosts from config file if noone are given by command line
109 } elsif ((!$opts{'host'}) && (!$opts{'port'}) && (/:/)) {
110 ($tmp,$portlist) = split /:/, $_;
113 # There is multiple ports
115 @ports = split /,/, $portlist;
117 push @{$hosts{$tmp}}, $_;
119 # There is only one port
121 push @{$hosts{$tmp}},$portlist;
130 # Print program usage
132 print "Usage: sslexpire [OPTION]...
133 -h, --host=HOST check only this host
134 -p, --port=TCPPORT check this port on the previous host
135 -m, --mail report by mail instead of STDOUT
136 -c, --conf=FILE use this config file
137 --help print this help, then exit
143 # This will return the expiration date
146 my ($l_host,$l_port) = @_;
147 my ($l_expdate,$l_comment);
149 # Connect to $l_host:$l_port
150 my $socket = IO::Socket::INET->new(
155 # If we connected successfully
158 my $l_ctx = Net::SSLeay::CTX_new();
159 my $l_ssl = Net::SSLeay::new($l_ctx);
161 Net::SSLeay::set_fd($l_ssl, fileno($socket));
162 my $res = Net::SSLeay::connect($l_ssl);
164 # Get peer certificate
165 my $l_x509 = Net::SSLeay::get_peer_certificate($l_ssl);
167 my $l_string = Net::SSLeay::PEM_get_string_X509($l_x509);
168 # Get the expiration date, using openssl
169 ($l_expdate,$l_comment) = split(/\n/, `echo "$l_string" | $opensslpath x509 -enddate -subject -noout 2>&1`);
170 $l_expdate =~ s/.*=//;
178 Net::SSLeay::free($l_ssl);
179 Net::SSLeay::CTX_free($l_ctx);
185 return ($l_expdate,$l_comment);
193 # Convert date into epoch using date command
194 my ($l_expdate,$l_comment,$l_host,$l_port) = @_;
197 if ($l_expdate ne "1") {
200 my $l_epochdate = str2time($l_expdate);
202 # Calculate diff between expiration date and today
203 my $l_diff = ($l_epochdate - $l_today)/(3600*24);
206 if ($l_diff < $alert) {
207 $l_subject = "Warning ssl certificate on $l_host:$l_port expires in $l_diff days:" if ($l_diff > 1);
208 $l_subject = "Warning ssl certificate on $l_host:$l_port expires today:" if (($l_diff > 0) && ($l_diff < 1));
209 $l_subject = "Warning ssl certificate on $l_host:$l_port expired:" if ($l_diff <= 0);
210 my $l_mesg = "Expiration date: $l_expdate\n$l_comment\n";
213 sendmail($mail, $l_subject, $l_mesg);
215 print "$l_subject\n";
220 $l_subject = "Unable to read certificate on $l_host:$l_port!";
222 sendmail($mail, $l_subject, "");
224 print "$l_subject\n";
230 # Send mail - sendmail (to,subject,body)
238 open (MAIL,"| $sendmailpath -t") or die "Couldn't open $sendmailpath";
239 print MAIL "To: $to\n";
240 print MAIL "Subject: $subj\n";
242 print MAIL "$mesg\n" if $mesg;
244 if ((my $status = $?>>8) != 0) {
245 die "sendmail: exit status $status\n";
253 # We haven't hosts to check...
254 if (!%hosts) {&usage;};
258 foreach $host (keys %hosts) {
259 # Parse ports for each hosts
260 foreach $port (@{$hosts{$host}}) {
261 if ($opts{'verbose'}) {
262 print "Checking\t$host:$port\n";
265 # Get expiration date
266 my ($expdate,$comment) = &getExpire($host,$port);
269 &report("$expdate","$comment","$host","$port");
274 # script documentation (POD style)
278 sslexpire - Remotely check ssl certificate expiration date.
282 This program connect to an host:port to retrieve the expiration date of the ssl
283 certificate. It gives a report to STDOUT or by email using configuration file.
285 =head1 COMMAND LINE PARAMETERS
287 Optional command line parameters are the host and the port to connect. This
288 allow checking a single host instead of using those given in the configuration
289 file for periodically checks.
293 =head2 B<-c> I<FILE>, B<--conf>=I<FILE>
295 Specify an alternate config file.
297 =head2 B<-h> I<HOST>, B<--host>=I<HOST>
299 Connect to I<HOST> instead of those given in the config file.
301 =head2 B<-p> I<PORT>, B<--port>=I<PORT>
303 Specify the port to connect to (used in conjonction with --host).
305 =head2 B<-v>, B<--verbose>
307 Prints out verbose messages.
309 =head2 B<-m>, B<--mail>
311 Send report by mail instead of STDOUT. It will use the address given in the
312 config file or root by default.
316 Prints out command-line help.
320 Prints out version information.
324 /etc/sslexpire/sslexpire.conf
328 Emmanuel Lacour, elacour@home-dn.net