Check certificate expiry

One-line run

Source

#!/usr/bin/env bash
# 证书到期检查
#
# 只读脚本，不需要 root。扫本机常见证书目录，也可以顺带查一个域名的线上证书。
# 用法：bash cert-check.sh [域名]      例：bash cert-check.sh www.moiu.cn

set -u

DOMAIN="$1"

echo '====== 证书到期检查 ======'

if ! command -v openssl >/dev/null 2>&1; then
    echo '[!] 没有 openssl，查不了'
    exit 1
fi

NOW_TS=$(date +%s)

# 把「到期时间字符串」换算成「还剩多少天」，两处调用共用
report() {
    LABEL="$1"
    END="$2"
    if [ -z "$END" ]; then
        echo "  [!] $LABEL 读不出到期时间"
        return 0
    fi
    END_TS=$(date -d "$END" +%s 2>/dev/null || echo 0)
    if [ "$END_TS" -eq 0 ]; then
        printf '  %s\n      到期：%s\n' "$LABEL" "$END"
        return 0
    fi
    DAYS=$(( (END_TS - NOW_TS) / 86400 ))
    MARK='[√] 正常'
    if [ "$DAYS" -lt 0 ]; then
        MARK='[!] 已过期'
    elif [ "$DAYS" -lt 14 ]; then
        MARK='[!] 快到期'
    fi
    printf '  %-46s 还剩 %4d 天  %s\n' "$LABEL" "$DAYS" "$MARK"
}

echo '--- 本机证书文件 ---'
FOUND=0
for f in /etc/letsencrypt/live/*/fullchain.pem /etc/nginx/ssl/*.pem /etc/ssl/private/*.pem; do
    if [ -r "$f" ]; then
        FOUND=1
        END=$(openssl x509 -in "$f" -noout -enddate 2>/dev/null | cut -d= -f2)
        report "$f" "$END"
    fi
done
if [ "$FOUND" -eq 0 ]; then
    echo '  （常见目录里没找到证书，本机可能不是终端节点）'
fi

if [ -n "$DOMAIN" ]; then
    echo ''
    echo "--- 线上：$DOMAIN ---"
    # </dev/null 避免 s_client 等在标准输入上
    END=$(openssl s_client -servername "$DOMAIN" -connect "$DOMAIN":443 </dev/null 2>/dev/null \
        | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
    report "$DOMAIN" "$END"
fi

Download the raw file