TLS Handshake Check

Slug

67XEG8SK9KGF

Fetches

0

Size

2641 B · 89 lines

Expires

never

Last fetch

—

Created

2026-09-07 00:36:01.194

Description

Certificate notAfter from an SSL handshake

#!/usr/bin/env python3
# TLS handshake check
# Read-only: ssl.get_server_certificate plus a wrapped socket; prints notAfter.
# Exit 0 if healthy, 1 if the cert expires within 21 days, 2 if expired or handshake fails.
# Hosted on Runny.sh. Review the script page before you run it.

from __future__ import annotations

import socket
import ssl
import sys
import time


def parse_target(spec: str) -> tuple[str, int]:
    if ":" in spec and not spec.startswith("["):
        host, port_s = spec.rsplit(":", 1)
        return host, int(port_s)
    return spec, 443


def check(host: str, port: int) -> int:
    print(f"Target:   {host}:{port}")
    try:
        pem = ssl.get_server_certificate((host, port))
    except Exception as exc:
        print(f"          CRITICAL: get_server_certificate failed ({exc})")
        return 2
    print(f"PEM:      {len(pem)} bytes")

    ctx = ssl.create_default_context()
    try:
        with socket.create_connection((host, port), timeout=15) as raw:
            with ctx.wrap_socket(raw, server_hostname=host) as sock:
                cert = sock.getpeercert()
                version = sock.version()
    except Exception as exc:
        print(f"          CRITICAL: wrap_socket handshake failed ({exc})")
        return 2

    not_after = ""
    if cert:
        not_after = str(cert.get("notAfter") or "")
    subject = ""
    if cert and cert.get("subject"):
        parts = [value for rdn in cert["subject"] for _key, value in rdn]
        subject = ", ".join(parts)
    print(f"TLS:      {version}")
    print(f"Subject:  {subject or 'unknown'}")
    print(f"notAfter: {not_after or 'unknown'}")
    if not not_after:
        print("          WARNING: peer cert had no notAfter")
        return 1
    remaining = ssl.cert_time_to_seconds(not_after) - time.time()
    days = remaining / 86400
    print(f"Days:     {days:.1f}")
    if remaining <= 0:
        print("          CRITICAL: certificate is expired")
        return 2
    if remaining < 21 * 86400:
        print("          WARNING: expires within 21 days")
        return 1
    print("          OK")
    return 0


def main() -> int:
    specs = sys.argv[1:] or ["example.com:443"]
    print("=== TLS handshake / certificate dates ===")
    print()
    worst = 0
    for spec in specs:
        host, port = parse_target(spec)
        rc = check(host, port)
        if rc > worst:
            worst = rc
        print()
    if worst == 0:
        print("Result: HEALTHY")
    elif worst == 1:
        print("Result: WARNING")
    else:
        print("Result: CRITICAL")
    return worst


if __name__ == "__main__":
    sys.exit(main())