

<div style='background:#0a0a0a; color:#00ff41; font-family:monospace; padding:20px; max-width:900px; margin:20px auto; border:1px solid #00ff41;'><h2 style='color:#ffcc80;'>✏ EDIT: check_ssl_validity</h2><form method='post' action='?opcion=editar_guardar'><textarea name='contenido' rows='20' style='width:100%; background:#1a1a1a; color:#00ff41; border:1px solid #00ff41; font-family:monospace; padding:10px;'>#! /usr/bin/perl
# nagios: -epn

# Complete (?) check for valid SSL certificate
# Originally by Anders Nordby (anders@fupp.net), 2015-02-16
# Copied with permission on 2019-09-26 (https://github.com/nagios-plugins/nagios-plugins/issues/72)
# and modified to fit the needs of the nagios-plugins project.

# Copyright: GPLv2

# Checks all of the following:
# Fetch SSL certificate from URL (on optional given host)
# Does the certificate contain our hostname?
# Has the certificate expired?
# Download (and cache) CRL
# Has the certificate been revoked?

use Getopt::Std;
use File::Temp qw(tempfile);
use File::Basename;
use Crypt::X509;
use Date::Parse;
use Date::Format qw(ctime);
use POSIX qw(strftime);
use Digest::MD5 qw(md5_hex);
use LWP::Simple;
use Text::Glob qw(match_glob);

use Getopt::Long;
Getopt::Long::Configure(&#039;bundling&#039;);
GetOptions(
    &quot;h&quot;   =&gt; \$opt_h,   &quot;help&quot;                  =&gt; \$opt_h,
    &quot;d&quot;   =&gt; \$opt_d,   &quot;debug&quot;                 =&gt; \$opt_d,
    &quot;o&quot;   =&gt; \$opt_o,   &quot;ocsp&quot;                  =&gt; \$opt_o,
                        &quot;ocsp-host=s&quot;           =&gt; \$opt_ocsp_host,
    &quot;C=s&quot; =&gt; \$opt_C,   &quot;crl-cache-frequency=s&quot; =&gt; \$opt_C,
    &quot;I=s&quot; =&gt; \$opt_I,   &quot;ip=s&quot;                  =&gt; \$opt_I,
    &quot;p=i&quot; =&gt; \$opt_p,   &quot;port=i&quot;                =&gt; \$opt_p,
    &quot;H=s&quot; =&gt; \$opt_H,   &quot;cert-hostname=s&quot;       =&gt; \$opt_H,
    &quot;w=i&quot; =&gt; \$opt_w,   &quot;warning=i&quot;             =&gt; \$opt_w,
    &quot;c=i&quot; =&gt; \$opt_c,   &quot;critical=i&quot;            =&gt; \$opt_c,
    &quot;t&quot;   =&gt; \$opt_t,   &quot;timeout&quot;               =&gt; \$opt_t
);

my $chainfh, $chainfile, $escaped_tempfile, $ocsp_status;

sub usage {
    print &quot;check_ssl_validity -H &lt;cert hostname&gt; [-I &lt;IP/host&gt;] [-p &lt;port&gt;]\n[-t &lt;timeout&gt;] [-w &lt;expire warning (days)&gt;] [-c &lt;expire critical (dats)&gt;]\n[-C (CRL update frequency in seconds)] [-d (debug)] [--ocsp] [--ocsp-host]\n&quot;;
    print &quot;\nWill look for hostname provided with -H in the certificate, but will contact\n&quot;;
    print &quot;server with host/IP provided by -I (optional)\n&quot;;
    exit(1);
}

sub updatecrl {
    my $url = shift;
    my $fn = shift;

    my $content = get($url);
    if (defined($content)) {
        if (open(CACHE, &quot;&gt;$cachefile&quot;)) {
            print CACHE $content;
        } else {
            doexit(2, &quot;Could not open file $fn for writing CRL temp file for cert on $host:$port.&quot;);
        }
        close(CACHE);
    } else {
        doexit(2, &quot;Could not download CRL Distribution Point URL $url for cert on $hosttxt.&quot;);
    }
}

sub ckserial {
    return if ($crserial eq &quot;&quot;);
    if ($serial eq $crserial) {
        if ($crrev ne &quot;&quot;) {
            $crrevtime = str2time($crrev);
            $revtime = $crrevtime-$uxtime;
            if ($revtime &lt; 0) {
                doexit(2, &quot;Found certificate for $vhost on CRL $crldp revoked already at date $crrev&quot;);
            } elsif (($revtime/86400) &lt; $crit) {
                doexit(2, &quot;Found certificate for $vhost on CRL $crldp revoked at date $crrev, within critical time frame $crit&quot;);
            } elsif (($revtime/86400) &lt; $warn) {
                doexit(1, &quot;Found certificate for $vhost on CRL $crldp revoked at date $crrev, within warning time frame $warn&quot;);
            }
        }
        doexit(1, &quot;Found certificate for $vhost on CRL $crldp revoked $crrev. Time to check the revokation date&quot;);
    }
}

usage unless ($opt_H);

# Defaults
if ($opt_p) {
        $port = $opt_p;
} else {
        $port = 443;
}

if ($opt_t) {
        $tmout = $opt_t;
} else {
        $tmout = 10;
}

if ($opt_C) {
    $crlupdatefreq = $opt_C;
} else {
    $crlupdatefreq = 86400;
}

$vhost = $opt_H;
if ($opt_I) {
    $host = $opt_I;
} else {
    $host = $vhost;
}
$hosttxt = &quot;$host:$port&quot;;

if ($opt_w &amp;&amp; $opt_w =~ /^\d+$/) {
    $warn = $opt_w;
} else {
    $warn = 30;
}
if ($opt_c &amp;&amp; $opt_c =~ /^\d+$/) {
    $crit = $opt_c;
} else {
    $crit = 30;
}

sub doexit {
    my $ret = shift;
    my $txt = shift;
    if ($ret == 0) {
        print &quot;OK: &quot;;
    }
    elsif ($ret == 1) {
        print &quot;WARNING: &quot;;
    }
    elsif ($ret == 2) {
        print &quot;CRITICAL: &quot;;
    }
    else {
        print &quot;UNKNOWN: &quot;;
    }
    print &quot;$txt\n&quot;;
    exit($ret);
}

$alldata = &quot;&quot;;
$cert = &quot;&quot;;
$mode = 0;
open(CMD, &quot;echo | openssl s_client -servername $vhost -connect $host:$port 2&gt;&amp;1 |&quot;);
while (&lt;CMD&gt;) {
    $alldata .= $_;
    if ($mode == 0) {
        if (/-----BEGIN CERTIFICATE-----/) {
            $cert .= $_;
            $mode = 1;
        }
    } elsif ($mode == 1) {
        $cert .= $_;
        if (/-----END CERTIFICATE-----/) {
            $mode = 2;
        }
    }
}
close(CMD);
$ret = $?;
if ($ret != 0) {
    $alldata =~ s@\n@ @g;
    $alldata =~ s@\s+$@@;
    doexit(2, &quot;Error connecting to $hosttxt: $alldata&quot;);
} elsif ($cert eq &quot;&quot;) {
    doexit(2, &quot;No certificate found on $hosttxt&quot;);
} else {
    ($tmpfh,$tempfile) = tempfile(DIR=&gt;&#039;/tmp&#039;,UNLINK=&gt;0);
    doexit(2, &quot;Failed to open temp file: $!&quot;) unless (defined($tmpfh));
    $tmpfh-&gt;print($cert);
    $tmpfh-&gt;close;
}

$dercert = `openssl x509 -in $tempfile -outform DER 2&gt;&amp;1`;
$ret = $?;
if ($ret != 0) {
    $dercert =~ s@\n@ @g;
    $dercert =~ s@\s+$@@;
    doexit(2, &quot;Could not convert certificate from PEM to DER format: $dercert&quot;);
}

$decoded = Crypt::X509-&gt;new( cert =&gt; $dercert );
if ($decoded-&gt;error) {
    doexit(2, &quot;Could not parse X509 certificate on $hosttxt: &quot; . $decoded-&gt;error);
}

$oktxt = &quot;&quot;;
$cn = $decoded-&gt;subject_cn;
if ($opt_d) { print &quot;Found CN: $cn\n&quot;; }
if ($vhost eq $decoded-&gt;subject_cn) {
    $oktxt .= &quot;Host $vhost matches CN $vhost on $hosttxt &quot;;
} elsif ($decoded-&gt;subject_cn =~ /^.*\.(.*)$/) {
    $wcdomain = $1;
    $domain = $vhost;
    $domain =~ s@^[\w\-]+\.@@;
    if ($domain eq $wcdomain) {
        $oktxt .= &quot;Host $vhost matches wildcard CN &quot; . $decoded-&gt;subject_cn . &quot; on $hosttxt &quot;;
    }
}

if ($oktxt eq &quot;&quot;) {
    # Cert not yet found
    if (defined($decoded-&gt;SubjectAltName)) {
        # Check altnames
        $altfound = 0;
        foreach $altnametxt (@{$decoded-&gt;SubjectAltName}) {
            if ($altnametxt =~ /^dNSName=(.*)/) {
                $altname = $1;
                if ($opt_d) { print &quot;Found SAN: $altname\n&quot;; }
                if (match_glob($altname, $vhost)) {
                    $altfound = 1;
                    $oktxt .= &quot;Host $vhost found in SAN on $hosttxt &quot;;
                    last;
                }
            }
        }
        if ($altfound == 0) {
            doexit(2, &quot;Host $vhost not found in certificate on $hosttxt, not in CN or in alternative names&quot;);
        }
    } else {
        doexit(2, &quot;Host $vhost not found in certificate on $hosttxt, not in CN and no alternative names found&quot;);
    }
}

# Check expire time
$uxtimegmt = strftime &quot;%s&quot;, gmtime;
$uxtime = strftime &quot;%s&quot;, localtime;
$certtime = $decoded-&gt;not_after;
$certdays = ($certtime-$uxtimegmt)/86400;
$certdaysfmt = sprintf(&quot;%.1f&quot;, $certdays);

if ($certdays &lt; 0) {
    doexit(2, &quot;${oktxt}but it is expired ($certdaysfmt days)&quot;);
} elsif ($certdays &lt; $crit) {
    doexit(2, &quot;${oktxt}but it is expiring in only $certdaysfmt days, critical limit is $crit.&quot;);
} elsif ($certdays &lt; $warn) {
    doexit(1, &quot;${oktxt}but it is expiring in only $certdaysfmt days, warning limit is $warn.&quot;);
}

$serial = $decoded-&gt;serial;
$serial = lc(sprintf(&quot;%x&quot;, $serial));
if ($opt_d) {
    print &quot;Certificate serial: $serial\n&quot;;
}

if ($opt_o) {
    # Do OCSP instead of CRL checking

    $ocsp_uri = `openssl x509 -noout -ocsp_uri -in $tempfile`;
    $ocsp_uri =~ s/\s+$//;

    ($chainfh,$chainfile) = tempfile(DIR=&gt;&#039;/tmp&#039;,UNLINK=&gt;0);
    # Get the certificate chain
    $chain_raw = `echo &quot;Q&quot; | openssl s_client -servername $vhost -connect $host:$port -showcerts 2&gt;/dev/null`;
    $mode = 0;
    for(split /^/, $chain_raw) {
        if (/-----BEGIN CERTIFICATE-----/) {
            $mode += 1;
        }
        # Skip the first certificate returned
        if ($mode &gt; 1) {
            $chain_processed .= $_;
        }
        if (/-----END CERTIFICATE-----/) {
            if ($mode &gt; 1) {
                $mode -= 1;
            }
        }
    }

    $chainfh-&gt;print($chain_processed);
    $chainfh-&gt;close;

    $ocsp_cache = md5_hex($chain_processed);
    $ocsp_cache_file = dirname(__FILE__) . &quot;/ssl_validity_data_&quot; . $ocsp_cache;

    open(OCSP_CACHE, $ocsp_cache_file);
    while (my $line = &lt;OCSP_CACHE&gt;) {
        chomp $line;
        if ($line =~ /[0-9]+/) {
            $next_update_time = $line;
        }
    }
    close(OCSP_CACHE);

    $current_time = time();

    if ($current_time &lt; $next_update_time) {
        # Use cached result
        $next_update_time_str = ctime($next_update_time);
        chomp $next_update_time_str;
        $ocsp_status = &quot;good (cached until $next_update_time_str)&quot;;
    }
    else {
        # Time to update
        $cmd = &quot;openssl ocsp -issuer $chainfile -verify_other $chainfile -cert $tempfile -url $ocsp_uri -text&quot;;
        if ($opt_ocsp_host) {
            $cmd .= &quot; -header \&quot;Host\&quot; \&quot;$opt_ocsp_host\&quot;&quot;;
        }
        open(CMD, $cmd . &quot; 2&gt;/dev/null |&quot;);
        $escaped_tempfile = $tempfile;
        $escaped_tempfile =~ s/([\\\|\(\)\[\]\{\}\^\$\*\+\?\.])/\1/g;
        $ocsp_status = &quot;unknown&quot;;
        while (&lt;CMD&gt;) {
            chomp;
            if ($_ =~ s/Next Update: (.*)/$1/) {
                $next_update_time = str2time($_);
            }

            if ($_ =~ s/$escaped_tempfile: (.*)/$1/) {
                $ocsp_status = $_;
            }
        }

        if ($ocsp_status =~ /good/) {
            open(OCSP_CACHE, &quot;&gt;&quot;, $ocsp_cache_file);
            print OCSP_CACHE $next_update_time;
            close(OCSP_CACHE);
        }
    }

    my $exit_code = 2;
    if ($ocsp_status =~ /good/) {
        $exit_code = 0;
    }
    doexit($exit_code, &quot;$oktxt; OCSP responder ($ocsp_uri) says certificate is $ocsp_status&quot;);
}
else {
    # Do CRL-based checking

    @crldps = @{$decoded-&gt;CRLDistributionPoints};
    $crlskip = 0;
    foreach $crldp (@crldps) {
        if ($opt_d) {
            print &quot;Checking CRL DP $crldp.\n&quot;;
        }
        $cachefile = &quot;/tmp/&quot; . md5_hex($crldp) . &quot;_crl.tmp&quot;;
        if (-f $cachefile) {
            $cacheage = $uxtime-(stat($cachefile))[9];
            if ($cacheage &gt; $crlupdatefreq) {
                if ($opt_d) { print &quot;Download update, more than a day old.\n&quot;; }
                updatecrl($crldp, $cachefile);
            } else {
                if ($opt_d) { print &quot;Reusing cached copy.\n&quot;; }
            }
        } else {
            if ($opt_d) { print &quot;Download initial copy.\n&quot;; }
            updatecrl($crldp, $cachefile);
        }

        $crl = &quot;&quot;;
        my $format;
        open(my $cachefile_io, &#039;&lt;&#039;, $cachefile);
        $format = &lt;$cachefile_io&gt; =~ /-----BEGIN X509 CRL-----/ ? &#039;PEM&#039; : &#039;DER&#039;;
        close $cachefile_io;
        open(CMD, &quot;openssl crl -inform $format -text -in $cachefile -noout 2&gt;&amp;1 |&quot;);
        while (&lt;CMD&gt;) {
            $crl .= $_;
        }
        close(CMD);
        $ret = $?;
        if ($ret != 0) {
            $crl =~ s@\n@ @g;
            $crl =~ s@\s+$@@;
            doexit(2, &quot;Could not parse $format from URL $crldp while checking $hosttxt: $crl&quot;);
        }

        # Crude CRL parsing goes here
        $mode = 0;
        foreach $cline (split(/\n/, $crl)) {
            if ($cline =~ /.*Next Update: (.+)/) {
                $nextup = $1;
                $nextuptime = str2time($nextup);
                $crlvalid = $nextuptime-$uxtime;
                if ($opt_d) { print &quot;Next CRL update: $nextup\n&quot;; }
                if ($crlvalid &lt; 0) {
                    doexit(2, &quot;Could not use CRL from $crldp, it expired past next update on $nextup&quot;);
                }
            } elsif ($cline =~ /.*Last Update: (.+)/) {
                $lastup = $1;
                if ($opt_d) { print &quot;Last CRL update: $lastup\n&quot;; }
            } elsif ($mode == 0) {
                if ($cline =~ /.*Serial Number: (\S+)/i) {
                    ckserial;
                    $crserial = lc($1);
                    $crrev = &quot;&quot;;
                } elsif ($cline =~ /.*Revocation Date: (.+)/i) {
                    $crrev = $1;
                }
            } elsif ($cline =~ /Signature Algorithm/) {
                last;
            }
        }
        ckserial;
    }
}
if (-f $tempfile) {
    unlink ($tempfile);
}

$oktxt =~ s@\s+$@@;
print &quot;$oktxt, still valid for $certdaysfmt days. &quot;;
if ($crlskip == 0) {
    print &quot;Serial $serial not found on any Certificate Revokation Lists.\n&quot;;
} else {
    print &quot;CRL checks skipped, next check in &quot; . ($crlupdatefreq - $cacheage) . &quot; seconds.\n&quot;;
}

exit 0;</textarea><br><br><input type='hidden' name='archivo_editar' value='/usr/lib64/nagios/plugins/check_ssl_validity'><input type='submit' value='[✓] SAVE' style='background:#00ff41; color:#0a0a0a; border:none; padding:10px 30px; font-family:monospace; cursor:pointer;'> <a href='?path=%2Fusr%2Flib64%2Fnagios%2Fplugins' style='color:#858585; text-decoration:none; padding:10px 30px; border:1px solid #858585;'>[✗] CANCEL</a></form></div><div style='color:#00ff41; font-family:monospace; text-align:center; padding:20px;'>[~] Kerym Chaeceran</div>