33 lines
941 B
Bash
33 lines
941 B
Bash
#!/usr/bin/env bash
|
|
#
|
|
# 检查证书剩余有效期，低于阈值时以非 0 退出，便于接入告警。
|
|
# 自动续签有可能静默失败，必须有一个独立的检查点。
|
|
#
|
|
set -euo pipefail
|
|
|
|
CERT_NAME="${CERT_NAME:-stonelan.cn}"
|
|
CERT="${CERT:-/etc/letsencrypt/live/$CERT_NAME/cert.pem}"
|
|
WARN_DAYS="${WARN_DAYS:-20}"
|
|
|
|
if [ ! -f "$CERT" ]; then
|
|
echo "证书不存在：$CERT" >&2
|
|
exit 1
|
|
fi
|
|
|
|
end="$(openssl x509 -enddate -noout -in "$CERT" | cut -d= -f2)"
|
|
end_ts="$(date -d "$end" +%s)"
|
|
days=$(( (end_ts - $(date +%s)) / 86400 ))
|
|
|
|
echo "证书文件：$CERT"
|
|
echo "到期时间：$end（剩余 $days 天）"
|
|
openssl x509 -subject -issuer -noout -in "$CERT" | sed 's/^/ /'
|
|
openssl x509 -text -noout -in "$CERT" \
|
|
| grep -A1 "Subject Alternative Name" | sed 's/^/ /'
|
|
|
|
if [ "$days" -lt "$WARN_DAYS" ]; then
|
|
echo "警告：剩余 $days 天，低于阈值 $WARN_DAYS 天" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "证书状态正常"
|