【SSL】用shell腳本監(jiān)控https證書(shū)到期時(shí)間

一、腳本思路


1.openssl s_client? 獲取證書(shū)有效期

2.將相關(guān)時(shí)間做時(shí)間戳轉(zhuǎn)換,轉(zhuǎn)換成天數(shù)

3. 調(diào)用釘釘群組機(jī)器人做證書(shū)有效期預(yù)警


# cat? ssl_validity_alarm.sh

#############################################################

#!/bin/bash

# 加載環(huán)境變量

. /etc/profile

. ~/.bash_profile

. /etc/bashrc

# 被檢測(cè)的域名和端口

domain_name="www.example.com"

domain_port="443"

advance_warning_days="300"

# 獲取腳本所在目錄、腳本名稱(chēng)

script_dir=$( cd "$( dirname "$0"? )" && pwd )

script_name=$(basename ${0})

# 釘釘群組機(jī)器人地址

robot_webhook_url="https://oapi.dingtalk.com/robot/send?access_token=xxxxxxxxxx"

# 創(chuàng)建釘釘機(jī)器人告警函數(shù)

send_robot_warning() {

? curl -X POST "${robot_webhook_url}" \

? ? -H 'Content-Type: application/json' \

? ? -d ' {"msgtype": "text", "text": {"content": "'"$1"'"}}'

}

# 用openssl獲取域名的證書(shū)到期日期

cert_end_time=$(echo | openssl s_client -servername ${domain_name} -connect ${domain_name}:${domain_port} 2>/dev/null | openssl x509 -noout -dates |grep 'After'| awk -F '=' '{print $2}'| awk -F ' +' '{print $1,$2,$4 }' )

# 將證書(shū)到期日期轉(zhuǎn)化為時(shí)間戳

cert_end_timestamp=$(date +%s -d "$cert_end_time")

# 將當(dāng)前日期轉(zhuǎn)化為時(shí)間戳

now_timestamp=$(date +%s -d "$(date "+%Y-%m-%d %H:%M:%S")")

# 到期時(shí)間減去目前時(shí)間,再轉(zhuǎn)化為天數(shù)

rest_time=$(($(($cert_end_timestamp - $now_timestamp))/(60*60*24)))

echo "證書(shū)有效天數(shù)剩余:${rest_time}"

if [ "${rest_time}" -lt "${advance_warning_days}" ];then

? send_robot_warning "${domain_name} SSL證書(shū)有效期少于${advance_warning_days}天,存在過(guò)期風(fēng)險(xiǎn),請(qǐng)關(guān)注!"

fi

#############################################################



二、釘釘群組機(jī)器人創(chuàng)建注意事項(xiàng)


1. 開(kāi)啟消息推送

2. 設(shè)置自定義關(guān)鍵字,而且發(fā)送消息中必須包含自定義關(guān)鍵字

3.不要設(shè)置加簽



三、腳本測(cè)試


# sh? ssl_validity_alarm.sh



四、參考


OpenSSL s_client 獲取keytool證書(shū)和openSSLl證書(shū)

http://www.lxweimin.com/p/09773dc15cbc


OpenSSL Command-Line

https://www.madboa.com/geek/openssl/#cert-retrieve


用shell腳本監(jiān)控https證書(shū)到期時(shí)間

https://blog.slogra.com/post-772.html

https://www.dgstack.cn/archives/3227.html

https://blog.csdn.net/weixin_43876317/article/details/109044133


釘釘開(kāi)放平臺(tái)文檔

https://open.dingtalk.com

https://www.alibabacloud.com/help/zh/doc-detail/108367.htm

https://developers.dingtalk.com/document/app/document-upgrade-notice#/serverapi2/qf2nxq


云之家群組機(jī)器人開(kāi)發(fā)者文檔

https://open.yunzhijia.com/gitbook-wiki/server-api/im-robot.html


使用certbot-auto申請(qǐng)Let’s Encrypt Wildcard證書(shū)

https://blog.slogra.com/post-746.html


PythonN實(shí)現(xiàn)釘釘發(fā)送報(bào)警消息

https://www.freesion.com/article/5057722191


使用python檢查SSL證書(shū)到期情況

https://python.01314.cn/201812519.html

最后編輯于
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
平臺(tái)聲明:文章內(nèi)容(如有圖片或視頻亦包括在內(nèi))由作者上傳并發(fā)布,文章內(nèi)容僅代表作者本人觀點(diǎn),簡(jiǎn)書(shū)系信息發(fā)布平臺(tái),僅提供信息存儲(chǔ)服務(wù)。

推薦閱讀更多精彩內(nèi)容