11-23 10 views
在https逐步成为网站标配时，做为运维人员日常工作中也就多了一项要重要的工作，就是证书的有效期。
虽然签发中心也会提前有邮件告警，但是在IT行业流动性这么大的环境下，很多时候这个消息是到不到运维人员这边的。这也就需要运维人员想办法去解决这个问题，不再依赖签发中心的通知。
在线解析
其实要解析证书中的详细内容还是比较简单的，就拿shell来说，openssl这个工具就已经足够了，打印证书详细信息，如下所示：
|
1 |
openssl s_client -host www.itnotebooks.com -port 443 -showcerts </dev/null 2>/dev/null|sed -n '/BEGIN CERTIFICATE/,/END CERT/p'|openssl x509 -noout -text |
如果要打印我们非常关心的有效期：
|
1 |
openssl s_client -host www.itnotebooks.com -port 443 -showcerts </dev/null 2>/dev/null|sed -n '/BEGIN CERTIFICATE/,/END CERT/p'|openssl x509 -noout -dates |
或只打印我们截至日期：
|
1 |
openssl s_client -host www.itnotebooks.com -port 443 -showcerts </dev/null 2>/dev/null|sed -n '/BEGIN CERTIFICATE/,/END CERT/p'|openssl x509 -noout -enddate |
离线解析
也可以直接拿本地的pem来解析：
|
1 |
openssl x509 -in /etc/letsencrypt/live/www.itnotebooks.com/cert.pem -noout -enddate |
详细的参数列表如下,可以根据自己的需求去灵活调整：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
usage: x509 args -inform arg - input format - default PEM (one of DER, NET or PEM) -outform arg - output format - default PEM (one of DER, NET or PEM) -keyform arg - private key format - default PEM -CAform arg - CA format - default PEM -CAkeyform arg - CA key format - default PEM -in arg - input file - default stdin -out arg - output file - default stdout -passin arg - private key password source -serial - print serial number value -subject_hash - print subject hash value -subject_hash_old - print old-style (MD5) subject hash value -issuer_hash - print issuer hash value -issuer_hash_old - print old-style (MD5) issuer hash value -hash - synonym for -subject_hash -subject - print subject DN -issuer - print issuer DN -email - print email address(es) -startdate - notBefore field -enddate - notAfter field -purpose - print out certificate purposes -dates - both Before and After dates -modulus - print the RSA key modulus -pubkey - output the public key -fingerprint - print the certificate fingerprint -alias - output certificate alias -noout - no certificate output -ocspid - print OCSP hash values for the subject name and public key -ocsp_uri - print OCSP Responder URL(s) -trustout - output a "trusted" certificate -clrtrust - clear all trusted purposes -clrreject - clear all rejected purposes -addtrust arg - trust certificate for a given purpose -addreject arg - reject certificate for a given purpose -setalias arg - set certificate alias -days arg - How long till expiry of a signed certificate - def 30 days -checkend arg - check whether the cert expires in the next arg seconds exit 1 if so, 0 if not -signkey arg - self sign cert with arg -x509toreq - output a certification request object -req - input is a certificate request, sign and output. -CA arg - set the CA certificate, must be PEM format. -CAkey arg - set the CA key, must be PEM format missing, it is assumed to be in the CA file. -CAcreateserial - create serial number file if it does not exist -CAserial arg - serial file -set_serial - serial number to use -text - print the certificate in text form -C - print out C code forms -<dgst> - digest to use, see openssl dgst -h output for list -extfile - configuration file with X509V3 extensions to add -extensions - section from config file with X509V3 extensions to add -clrext - delete extensions before signing and input certificate -nameopt arg - various certificate name options -engine e - use engine e, possibly a hardware device. -certopt arg - various certificate text options -checkhost host - check certificate matches "host" -checkemail email - check certificate matches "email" -checkip ipaddr - check certificate matches "ipaddr" |
自定义报警
有了上面的信息后，就可以拿这个来自定义报警规则，如提前个90天、60天、45天这样
例如获取到还有多少天会到期，如果到了指定日期就发邮件这样
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
#拿到的是"Dec 7 06:46:43 2018 GMT" end_date=`openssl x509 -in /etc/letsencrypt/live/www.itnotebooks.com/cert.pem -noout -enddate |awk -F'=' '{print $2}'` #转换成时间戳 end_date_seconds=`date '+%s' --date "$end_date"` #获取当前的时间戳 now_seconds=`date '+%s'` #计算到期天数 days_remaining=$((($end_date_seconds-$now_seconds)/24/3600)) if [ ${result} -eq 90 ]; then result="将于${result}日后到期" elif [ ${result} -eq 60 ]; then result="将于${result}日后到期" elif [ ${result} -eq 45 ]; then result="将于${result}日后到期" elif [ ${result} -eq 30 ]; then result="将于${result}日后到期" |
这样你也可以在拿到以上的信息后发邮件提醒
Python版: https://www.itnotebooks.com/?p=768
如果想赏钱，可以用微信扫描下面的二维码，一来能刺激我写博客的欲望，二来好维护云主机的费用； 另外再次标注博客原地址 itnotebooks.com 感谢！
