Checker SSL multi-domaines

Vérifie la date d'expiration des certificats SSL sur une liste de domaines et génère un rapport.

Fonctionnalités

• Vérification en parallèle (configurable)
• Seuil d'alerte configurable (défaut 30 jours)
• Rapport coloré dans le terminal
• Export CSV optionnel
• Notification par email

Script

#!/bin/bash
cert-checker.sh — Vérification SSL multi-domaines
Usage : ./cert-checker.sh [fichier_domaines] [--warn-days 30] [--csv rapport.csv]

set -uo pipefail

── Configuration ─────────────────────────────────────────────
WARN_DAYS=30
CRIT_DAYS=7
PARALLEL=10
CSV_FILE=""
DOMAINS_FILE="${1:-/etc/ssl-checker/domains.txt}"

── Couleurs ──────────────────────────────────────────────────
RED='\033[0;31m'; YEL='\033[0;33m'; GRN='\033[0;32m'
BLD='\033[1m'; RST='\033[0m'

── Fonctions ─────────────────────────────────────────────────
check_cert() {
  local DOMAIN="$1"
  local PORT="${2:-443}"

  # Récupérer la date d'expiration
  local EXPIRY
  EXPIRY=$(echo | timeout 10 openssl s_client \
    -servername "$DOMAIN" -connect "${DOMAIN}:${PORT}" 2>/dev/null | \
    openssl x509 -noout -enddate 2>/dev/null | \
    sed 's/notAfter=//')

  if [[ -z "$EXPIRY" ]]; then
    echo "ERROR|$DOMAIN|$PORT|0|Connexion impossible"
    return
  fi

  local EXPIRY_TS NOW_TS DAYS_LEFT
  EXPIRY_TS=$(date -d "$EXPIRY" +%s 2>/dev/null || \
              date -j -f "%b %d %T %Y %Z" "$EXPIRY" +%s 2>/dev/null)
  NOW_TS=$(date +%s)
  DAYS_LEFT=$(( (EXPIRY_TS - NOW_TS) / 86400 ))

  local STATUS="OK"
  [[ $DAYS_LEFT -le $WARN_DAYS ]] && STATUS="WARN"
  [[ $DAYS_LEFT -le $CRIT_DAYS ]] && STATUS="CRIT"
  [[ $DAYS_LEFT -lt 0 ]]         && STATUS="EXPIRED"

  echo "${STATUS}|${DOMAIN}|${PORT}|${DAYS_LEFT}|${EXPIRY}"
}

export -f check_cert
export WARN_DAYS CRIT_DAYS

── Lecture des domaines ───────────────────────────────────────
if [[ ! -f "$DOMAINS_FILE" ]]; then
  # Mode interactif — lire depuis stdin ou arguments
  if [[ $# -gt 0 ]]; then
    DOMAINS=("$@")
  else
    echo "Usage: $0 <domaine1> [domaine2...] ou créer $DOMAINS_FILE"
    echo "Exemple domains.txt:"
    echo "  example.com"
    echo "  sub.example.com:8443"
    exit 1
  fi
else
  mapfile -t DOMAINS < <(grep -v '^#' "$DOMAINS_FILE" | grep -v '^$')
fi

── Vérification en parallèle ─────────────────────────────────
echo ""
echo -e "${BLD}🔐 Vérification SSL — $(date '+%Y-%m-%d %H:%M')${RST}"
echo -e "   Domaines : ${#DOMAINS[@]} | Seuil alerte : ${WARN_DAYS}j | Critique : ${CRIT_DAYS}j"
echo ""
printf "%-40s %-6s %-8s %s\n" "DOMAINE" "PORT" "JOURS" "EXPIRATION"
echo "$(printf '%0.s-' {1..80})"

OK=0; WARN=0; CRIT=0; ERROR=0

[[ -n "$CSV_FILE" ]] && echo "status,domain,port,days_left,expiry" > "$CSV_FILE"

while IFS= read -r RESULT; do
  IFS='|' read -r STATUS DOMAIN PORT DAYS EXPIRY <<< "$RESULT"
  [[ -n "$CSV_FILE" ]] && echo "$STATUS,$DOMAIN,$PORT,$DAYS,$EXPIRY" >> "$CSV_FILE"

  case "$STATUS" in
    OK)      COLOR=$GRN; ICON="✓"; ((OK++)) ;;
    WARN)    COLOR=$YEL; ICON="⚠"; ((WARN++)) ;;
    CRIT)    COLOR=$RED; ICON="!"; ((CRIT++)) ;;
    EXPIRED) COLOR=$RED; ICON="✗"; ((CRIT++)) ;;
    ERROR)   COLOR=$RED; ICON="✗"; ((ERROR++)) ;;
  esac

  printf "${COLOR}%-40s %-6s %-8s %s${RST}\n" \
    "${ICON} ${DOMAIN}" "$PORT" "${DAYS}j" "$EXPIRY"

done < <(printf '%s\n' "${DOMAINS[@]}" | \
         sed 's|https://||' | \
         awk -F: '{print $1, ($2 ? $2 : "443")}' | \
         xargs -P"$PARALLEL" -n2 bash -c 'check_cert "$@"' _)

echo "$(printf '%0.s-' {1..80})"
echo -e "  ${GRN}✓ OK: $OK${RST}  ${YEL}⚠ Alerte: $WARN${RST}  ${RED}✗ Critique: $CRIT${RST}  Erreur: $ERROR"
echo ""
[[ -n "$CSV_FILE" ]] && echo "📄 Rapport CSV : $CSV_FILE"

[[ $((CRIT + ERROR)) -gt 0 ]] && exit 2
[[ $WARN -gt 0 ]] && exit 1
exit 0

Fichier de domaines (/etc/ssl-checker/domains.txt)

# Format : domaine[:port]
Lignes commençant par # ignorées

example.com
www.example.com
api.example.com:8443
mail.example.com

Installation cron

chmod +x /opt/scripts/cert-checker.sh

Vérification hebdomadaire, alerte si code retour != 0
cat > /etc/cron.d/cert-checker << 'CRON'
0 8   1 root /opt/scripts/cert-checker.sh /etc/ssl-checker/domains.txt \
  --csv /var/log/ssl-report.csv | mail -s "[SSL] Rapport hebdo $(hostname)" [email protected]
CRON