#!/bin/bash
#
# Script: certinfo
#
# Usage: certinfo path
#
# Example: certinfo /etc/letsencrypt/live/example.com/cert.pem
#
# Description: A tool for reviewing SAN Names and Expiration date of SSL Certificates
#
# Author: Keith Muska
#
# Changelog:
# * 05.19.2026: Keith Muska
# - Initial write
#

if [ -z $1 ]; then
  echo "No Certificate Path given"
  echo "Example Usage:  certinfo /etc/letsencrypt/live/example.com/cert.pem"
  exit 3
fi

if [ ! -f $1 ]; then
  echo "Certificate file not found"
  exit 3
fi

## Placeholders for Exit Status:
WARN=0
CRIT=0

## Get Certificate Details:
openssl x509 -in $1 -text -noout > /tmp/certinfo.certdetails.$$

## Get the SANs that are covered by this Certificate File:
SAN=$(grep DNS /tmp/certinfo.certdetails.$$)

## Get the first Non-Wildcard SAN for testing with curl
FirstSAN=$(echo ${SAN} | sed 's;DNS:;;g' | sed 's;, ;\n;g' | grep -v "\*" | head -1)

## Get the Expiration Date from the Certificate File:
Expires=$(grep After /tmp/certinfo.certdetails.$$ | sed "s;[[:blank:]]\+Not\ After\ :\ ;;g")
DaysUntilExp=$(( ( $(date -d "${Expires}" +%s) - $(date +%s) ) / (60*60*24) ))

## Remove our openssl tmp file
rm -rf /tmp/certinfo.certdetails.$$

## Test that we can connect to the first SAN listed in the Certificate, and get the Server Type:
curl -m1 -s -I https://${FirstSAN} -o /tmp/certinfo.curlheaders.$$
CurlExit=$?
ServerType=$(grep -i ^server /tmp/certinfo.curlheaders.$$ 2>&1 | cut -d\  -f2 | tr '[:lower:]' '[:upper:]')
rm -f /tmp/certinfo.curlheaders.$$

## Display SANs and Expiration Date of Certificate File:
echo; echo "SANs Included in Certificate:"
echo ${SAN}

echo; echo Certificate File Expiration: $(date -d "${Expires}" +'%b %d, %Y')

## Check number of days until Certificate File Expiration:
if [ ${DaysUntilExp} -le 7 ]; then
  echo -e "\033[1;31m CRITICAL: \033[0m Certificate expires in ${DaysUntilExp} Days"
  CRIT=1
elif [ ${DaysUntilExp} -le 30 ]; then
  echo -e "\033[1;33m WARNING: \033[0m Certificate expires in ${DaysUntilExp} Days"
  WARN=1
else
  echo -e "\033[1;34m OK: \033[0m Certificate expires in ${DaysUntilExp} Days"
fi

## If we cannot curl the site, display an error:
if [ ${CurlExit} -ne 0 ]; then
  echo; echo -e "\033[1;31m CRITICAL: \033[0m Curl Connection Error. Could not check SSL Certificate on the site. Curl Exit Status: ${CurlExit}"
  CRIT=1
else

## If we Can curl the site,  Compare the SSL Certificate used by the Web Server to the Certificate File:
  SiteSSLExpires=$(echo | openssl s_client -connect ${FirstSAN}:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
  SiteDaysUntilExp=$(( ( $(date -d "${SiteSSLExpires}" +%s) - $(date +%s) ) / (60*60*24) ))

  echo; echo Site Certificate Expiration: $(date -d "${SiteSSLExpires}" +'%b %d, %Y')

  if [ ${DaysUntilExp} -ne ${SiteDaysUntilExp} ]; then

## If the site uses CloudFlare, an expiration date discrepancy is expected, but show a Warning just in case.
    if [ $(echo ${ServerType} | grep -ci "CLOUDFLARE") -gt 0 ]; then
      echo -e "\033[1;33m WARNING: \033[0m Certificate File vs Server Certificate Discrepancy.  WAF may be in use, so this might be OK."
      echo "Server Type: ${ServerType}"
      WARN=1
    else
## If the site does Not use CloudFlare, an expiration date discrepancy is Critical
      echo -e "\033[1;31m CRITICAL: \033[0m Certificate File vs Web Server Certificate Discrepancy.  Web Server Reload may be needed."
      echo "Server Type: ${ServerType}"
      CRIT=1
    fi
  else
## Certificate File matches the Web Server, all good.
    echo -e "\033[1;34m OK: \033[0m Certificate File matches Web Server Certificate"
  fi
fi

echo

## If we got a Critical Alert anywhere along the way, use Exit Status 2
if [ ${CRIT} -eq 1 ]; then
  exit 2
## If we got a Warning anywhere along the way, use Exit Status 1
elif [ ${WARN} -eq 1 ]; then
  exit 1
else
  exit 0
fi