420 kx #!/bin/sh
420 kx #
420 kx # Will check all certificates stored in $CERTDIR for their expiration date,
420 kx # and will display (if optional "stdout" argument is given), or mail a warning
420 kx # message to $MAILADDR (if script is executed without any parameter
420 kx # - unattended mode suitable for cron execution) for each particular certificate
420 kx # that is about to expire in time less to, or equal to $DAYS after this script
420 kx # has been executed, or if it has already expired.
420 kx # This stupid script (C) 2006,2007 Jan Rafaj
420 kx
420 kx ########################## CONFIGURATION SECTION BEGIN #########################
420 kx # Note: all settings are mandatory
420 kx # Warning will be sent if a certificate expires in time <= days given here
420 kx DAYS=7
420 kx # E-mail address where to send warnings
420 kx MAILADDR=root
420 kx # Directory with certificates to check
420 kx CERTDIR=/etc/ssl/certs
420 kx # Directory where to keep state files if this script isnt executed with "stdout"
420 kx STATEDIR=/var/run
420 kx ########################### CONFIGURATION SECTION END ##########################
420 kx
420 kx PATH=/bin:/usr/bin:/sbin:/usr/sbin
420 kx DAY_IN_SECS=$((60*60*24))
420 kx DATE_CURRENT=$(date '+%s')
420 kx
420 kx usage()
420 kx {
420 kx echo "Usage: $0 [stdout]"
420 kx echo
420 kx echo "Detailed description and configuration is embedded within the script."
420 kx exit 0
420 kx }
420 kx
420 kx message()
420 kx {
420 kx cat << EOF
420 kx WARNING: certificate $certfile
420 kx is about to expire in time equal to or less than $DAYS days from now on,
420 kx or has already expired - it might be a good idea to obtain/create new one.
420 kx
420 kx EOF
420 kx }
420 kx
420 kx message_mail()
420 kx {
420 kx message
420 kx cat << EOF
420 kx NOTE: This message is being sent only once.
420 kx
420 kx A lock-file
420 kx $STATEDIR/certwatch-mailwarning-sent-$certfilebase
420 kx has been created, which will prevent this script from mailing you again
420 kx upon its subsequent executions by crond. You dont need to care about it;
420 kx the file will be auto-deleted as soon as you'll prolong your certificate.
420 kx EOF
420 kx }
420 kx
420 kx unset stdout
420 kx case $# in
420 kx 0) ;;
420 kx 1) if [ "$1" = "-h" -o "$1" == "--help" ]; then
420 kx usage
420 kx elif [ "$1" = "stdout" ]; then
420 kx stdout=1
420 kx else
420 kx usage
420 kx fi
420 kx ;;
420 kx *) usage ;;
420 kx esac
420 kx
420 kx for dir in $STATEDIR $CERTDIR ; do
420 kx if [ ! -d $dir ]; then
420 kx echo "ERROR: directory $dir does not exist"
420 kx exit 1
420 kx fi
420 kx done
420 kx for binary in basename date find grep mail openssl touch ; do
420 kx if [ ! \( -x /usr/bin/$binary -o -x /bin/$binary \) ]; then
420 kx echo "ERROR: /usr/bin/$binary not found"
420 kx exit 1
420 kx fi
420 kx done
420 kx
420 kx find $CERTDIR -type f -maxdepth 1 | while read certfile ; do
420 kx if [ "$certfile" != "/etc/ssl/certs/ca-certificates.crt" ]; then
420 kx certfilebase="$(basename "$certfile")"
420 kx inform=PEM
420 kx echo "$certfile" | grep -q -i '\.net$'
420 kx if [ $? -eq 0 ]; then
420 kx # This is based purely on filename extension, so may give false results.
420 kx # But lets assume noone uses NET format certs today, ok?
420 kx continue
420 kx fi
420 kx echo "$certfile" | grep -q -i '\.der$'
420 kx if [ $? -eq 0 -o "$(file "$certfile" | egrep '(ASCII|PEM)')" == "" ]; then
420 kx inform=DER
420 kx fi
420 kx # We wont use '-checkend' since it is not properly documented (as of
420 kx # OpenSSL 0.9.8e).
420 kx DATE_CERT_EXPIRES=$(openssl x509 -in "$certfile" -inform $inform -noout -enddate | sed 's/^notAfter=//')
420 kx DATE_CERT_EXPIRES=$(date -d"$DATE_CERT_EXPIRES" +%s)
420 kx if [ $(($DATE_CERT_EXPIRES - $DATE_CURRENT)) -le $(($DAYS * $DAY_IN_SECS)) ]
420 kx then
420 kx if [ $stdout ]; then
420 kx message
420 kx else
420 kx if [ ! -f $STATEDIR/certwatch-mailwarning-sent-"$certfilebase" ]; then
420 kx subject="$0: certificate $certfile expiration warning"
420 kx message_mail | mail -r "certwatch@$HOSTNAME" \
420 kx -s "$subject" \
420 kx $MAILADDR 2>/dev/null
420 kx # echo "Mail about expiring certificate $certfile sent to $MAILADDR."
420 kx # echo "If you need to send it again, please remove lock-file"
420 kx # echo "$STATEDIR/certwatch-mailwarning-sent-$certfilebase ."
420 kx # echo
420 kx fi
420 kx touch $STATEDIR/certwatch-mailwarning-sent-"$certfilebase"
420 kx fi
420 kx else
420 kx if [ ! $stdout ]; then
420 kx if [ -f $STATEDIR/certwatch-mailwarning-sent-"$certfilebase" ]; then
420 kx rm $STATEDIR/certwatch-mailwarning-sent-"$certfilebase"
420 kx fi
420 kx fi
420 kx fi
420 kx fi
420 kx done
Radix cross Linux
The main Radix cross Linux repository contains the build scripts of packages, which have the most complete and common functionality for desktop machines
452 Commits
2 Branches
1 Tag