SSL Certificate Expiry Check

Slug

KF34BPTJQ789

Fetches

23

Size

1858 B · 66 lines

Expires

never

Last fetch

2026-09-07 02:17:36.871

Created

2026-09-07 00:35:58.942

Description

Days left on a TLS certificate for host:port

#!/usr/bin/env bash
# SSL certificate expiry
# Read-only: prints notAfter for host:port args via openssl. Default example.com:443.
# Exit 0 if healthy, 1 if any cert expires within 21 days, 2 if expired or unreachable.
# Hosted on Runny.sh. Review the script page before you run it.

set -u

status=0
note() { printf '%s\n' "$*"; }
bump() {
  case $1 in
    crit) status=2 ;;
    warn) [ "$status" -lt 1 ] && status=1 ;;
  esac
}

if [ "$#" -eq 0 ]; then
  set -- example.com:443
fi

note "=== SSL certificate expiry ==="
if ! command -v openssl >/dev/null 2>&1; then
  note "openssl:  not found in PATH"
  note "Result: CRITICAL"
  exit 2
fi

warn_secs=$((21 * 86400))
for spec in "$@"; do
  host=${spec%:*}
  port=${spec##*:}
  if [ "$host" = "$spec" ]; then
    port=443
  fi
  note "Target:   ${host}:${port}"
  pem=$(openssl s_client -servername "$host" -connect "${host}:${port}" </dev/null 2>/dev/null | openssl x509 2>/dev/null || true)
  if [ -z "${pem}" ]; then
    note "          CRITICAL: no certificate (handshake failed)"
    bump crit
    note ""
    continue
  fi
  subject=$(printf '%s\n' "$pem" | openssl x509 -noout -subject 2>/dev/null | sed 's/^subject= *//')
  enddate=$(printf '%s\n' "$pem" | openssl x509 -noout -enddate 2>/dev/null | sed 's/^notAfter=//')
  note "Subject:  ${subject:-unknown}"
  note "notAfter: ${enddate:-unknown}"
  if ! printf '%s\n' "$pem" | openssl x509 -noout -checkend 0 >/dev/null 2>&1; then
    note "          CRITICAL: certificate is expired"
    bump crit
  elif ! printf '%s\n' "$pem" | openssl x509 -noout -checkend "$warn_secs" >/dev/null 2>&1; then
    note "          WARNING: expires within 21 days"
    bump warn
  else
    note "          OK"
  fi
  note ""
done

case $status in
  0) note "Result: HEALTHY" ;;
  1) note "Result: WARNING" ;;
  *) note "Result: CRITICAL" ;;
esac
exit "$status"