ssl check
This commit is contained in:
parent
ad2f04e6a0
commit
98e47f2436
|
|
@ -0,0 +1,199 @@
|
|||
#!/usr/bin/perl -w
|
||||
#
|
||||
# check_ssl_certificate
|
||||
# Nagios script to check ssl certificate expirations
|
||||
#
|
||||
# Copyright (c) 2006-2008 David Alden <alden@math.ohio-state.edu>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License
|
||||
# as published by the Free Software Foundation; either version 2
|
||||
# of the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
#
|
||||
#
|
||||
# Changes:
|
||||
# 10/30/2008 dja <alden@math.ohio-state.edu>
|
||||
# - fixed a bug which caused it to not deal with certs that expire
|
||||
# on a single digit day (thanks to Christian Sava, Kyle Smith &
|
||||
# Raphael Berlamont)
|
||||
#
|
||||
# 10/09/2007 dja <alden@math.ohio-state.edu>
|
||||
# - fixed a bug which caused it to improperly report expired certs
|
||||
# (thanks to Hassan Alusesi for pointing this out)
|
||||
# - no longer use temporary files or Date::Manip
|
||||
# (thanks to tommybobbins on NagiosExchange)
|
||||
# - added the printing of the Common Name (CN) if verbose is specified
|
||||
# (thanks to mp72 on NagiosExchange)
|
||||
#
|
||||
#
|
||||
# Description:
|
||||
# This script will check if an SSL certificate is going to expire. For
|
||||
# example, to check the IMAP certificate on an imaps port:
|
||||
#
|
||||
# check_ssl_certificate -H 1.1.1.1 -p 993
|
||||
#
|
||||
#
|
||||
# Installation:
|
||||
# Edit this script, replacing the line:
|
||||
# use lib "/usr/lib/nagios/plugins";
|
||||
# with the path to your nagios plugins directory (where utils.pm is
|
||||
# located). Also edit the line:
|
||||
# my $openssl = "/usr/bin/openssl";
|
||||
# with the path to your openssl binary. Then copy the script into
|
||||
# your nagios plugins directory.
|
||||
#
|
||||
#
|
||||
use strict;
|
||||
use Time::Local;
|
||||
use Getopt::Long;
|
||||
use lib "/usr/lib64/nagios/plugins";
|
||||
use utils qw(%ERRORS &print_revision &support &usage);
|
||||
|
||||
my $PROGNAME="check_ssl_certificates";
|
||||
my $REVISION="1.2";
|
||||
|
||||
#
|
||||
$ENV{PATH}="/usr/sbin:/usr/bin:/bin";
|
||||
|
||||
#
|
||||
my $openssl = "/usr/bin/openssl";
|
||||
|
||||
my $critical = 7;
|
||||
my $help;
|
||||
my $host;
|
||||
my $port = 443;
|
||||
my $additional = '';
|
||||
my $verbose;
|
||||
my $version;
|
||||
my $warning = 30;
|
||||
|
||||
#
|
||||
my %months = ('Jan' => 0, 'Feb' => 1, 'Mar' => 2, 'Apr' => 3, 'May' => 4,
|
||||
'Jun' => 5, 'Jul' => 6, 'Aug' => 7, 'Sep' => 8, 'Oct' => 9,
|
||||
'Nov' => 10, 'Dec' => 11);
|
||||
|
||||
#
|
||||
Getopt::Long::Configure('bundling');
|
||||
if (GetOptions(
|
||||
"a=s" => \$additional,
|
||||
"c:s" => \$critical,
|
||||
"h" => \$help,
|
||||
"H:s" => \$host,
|
||||
"o=s" => \$openssl,
|
||||
"p=i" => \$port,
|
||||
"v" => \$verbose,
|
||||
"V" => \$version,
|
||||
"w:s" => \$warning,
|
||||
) == 0) {
|
||||
|
||||
print_usage();
|
||||
exit $ERRORS{'UNKNOWN'}
|
||||
}
|
||||
|
||||
if ($version) {
|
||||
print_revision($PROGNAME, "\$Revision: $REVISION \$");
|
||||
exit $ERRORS{'OK'};
|
||||
}
|
||||
|
||||
if ($help) {
|
||||
print_help();
|
||||
exit $ERRORS{'OK'};
|
||||
}
|
||||
|
||||
if (! utils::is_hostname($host)) {
|
||||
usage("");
|
||||
exit $ERRORS{'UNKNOWN'};
|
||||
}
|
||||
|
||||
open(OPENSSL, "$openssl s_client -connect $host:$port $additional < /dev/null 2>&1 | $openssl x509 -enddate -noout |") ||
|
||||
die "unable to open $openssl: $!";
|
||||
|
||||
my $date;
|
||||
while (<OPENSSL>) {
|
||||
if ($_ =~ /^notAfter=(.*)/) {
|
||||
$date = $1;
|
||||
chomp($date);
|
||||
# last;
|
||||
}
|
||||
}
|
||||
close(OPENSSL);
|
||||
|
||||
$date =~ s/ +/ /g;
|
||||
|
||||
my ($month, $day, $hour, $min, $sec, $year, $tz) = split(/[\s+|:]/, $date);
|
||||
print "m=$month, d=$day, h=$hour, m=$min, s=$sec, y=$year, z=$tz\n";
|
||||
|
||||
my $daysLeft = int((timegm($sec, $min, $hour, $day, $months{$month}, $year - 1900) - time()) / 86400);
|
||||
|
||||
my $cn="this certificate";
|
||||
if ($verbose) {
|
||||
|
||||
open(OPENSSL, "$openssl s_client -connect $host:$port $additional < /dev/null 2>&1 |") ||
|
||||
die "unable to open $openssl: $!";
|
||||
|
||||
while (<OPENSSL>) {
|
||||
next unless $_ =~ /Certificate chain/;
|
||||
|
||||
while (<OPENSSL>) {
|
||||
next unless $_ =~ /CN=(.*)/;
|
||||
($cn) = split(/\//, $1);
|
||||
$cn .= "[$host]" if ($cn ne $host);
|
||||
last;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ($daysLeft < 0) {
|
||||
print "$PROGNAME: CRITICAL - $cn expired " . abs($daysLeft) . " day(s) ago.\n";
|
||||
} elsif ($daysLeft <= $critical) {
|
||||
print "$PROGNAME: CRITICAL - only $daysLeft day(s) left for $cn.\n";
|
||||
exit $ERRORS{'CRITICAL'};
|
||||
} elsif ($daysLeft <= $warning) {
|
||||
print "$PROGNAME: WARNING - only $daysLeft day(s) left for $cn.\n";
|
||||
exit $ERRORS{'WARNING'};
|
||||
} elsif ($verbose) {
|
||||
print "$PROGNAME: $daysLeft day(s) left for $cn.\n";
|
||||
}
|
||||
|
||||
exit $ERRORS{'OK'};
|
||||
|
||||
sub print_help {
|
||||
print_revision($PROGNAME, "\$Revision: $REVISION \$");
|
||||
print "Copyright (c) 2006 David Alden
|
||||
|
||||
Check if an SSL certificate is close to expiring
|
||||
|
||||
";
|
||||
|
||||
print_usage();
|
||||
|
||||
print "
|
||||
-a <add> add the text to the openssl line, used for checking the smtp ssl
|
||||
certificate with starttls (\"-a '-starttls smtp'\")
|
||||
-c <num> exit with CRITICAL status if number of days left is less than <num>
|
||||
-h show this help script
|
||||
-H <host> check the certificate on the indicated host
|
||||
-o <path> path to openssl binary
|
||||
-p <port> check the certificate on the specified port
|
||||
-w <num> exit with WARNING status if number of days left is less than <num>
|
||||
-v show the number of days left
|
||||
-V show version and license information
|
||||
";
|
||||
|
||||
support();
|
||||
}
|
||||
|
||||
|
||||
sub print_usage {
|
||||
print "Usage: $PROGNAME -H <host> [-p <port>] [-c <low>:<high>] [-w <low>:<high>]\n";
|
||||
return();
|
||||
}
|
||||
Loading…
Reference in New Issue