Littlebighuman.com

#!/bin/bash
# By Seb
# Script reads in a two column file of SSL IP-addresses and host-names, then downloads and processes their certificates
# Output is in CSV
 
# CSV header ROW
echo  "IP-address, Reverse lookup DNS-name, Signing Algorithm, Subject, Issuer, Start-date, End-date, Serial, Return code of certificate check"
 
# Start of loop
processLine(){
  line="$@" # get all args
  IP=$(echo "$line" | cut -d" " -f1)
  DNSNAME=$(echo "$line" | cut -d" " -f2) 
  TARGETDOM=$(echo "$line" | cut -d" " -f2)
  HOST="$TARGETDOM:443"
 
  # The use of expect here is mainly to improve performance, by sending a quit (q) after the cert is downloaded
  # we avoid waiting for the openssl timeout, in any case, a 5 second timeout is set just to be sure (the default is much longer).
 
  RAWCERT=$(expect -  EOF 
  set timeout 5
 
  # Connect and download certificate 
 
  spawn openssl s_client -connect ${HOST}
  expect "Verify return code:"
  send "q"
  )
 
  CERTTEXT=$(echo "$RAWCERT" | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p')
  SIGALG=$(echo "$CERTTEXT" | openssl x509 -noout -text | grep -m 1 "Signature Algo" | cut -d: -f2)
  SUBJECT=$(echo "$CERTTEXT" |  openssl x509 -noout -subject | sed -e 's/subject= //')
  ISSUER=$(echo "$CERTTEXT" |   openssl x509 -noout -issuer | sed -e 's/issuer= //')
  START=$(echo "$CERTTEXT" |  openssl x509 -noout -startdate | cut -d= -f2)
  END=$(echo "$CERTTEXT" |  openssl x509 -noout -enddate | cut -d= -f2)
  SERIAL=$(echo "$CERTTEXT" |  openssl x509 -noout -serial | cut -d= -f2)
  RETURNCODE=$(echo "$RAWCERT" | grep "Verify return code:")
 
  # Output CSV
 
  echo $IP, $DNSNAME, $SIGALG, $SUBJECT, $ISSUER, $START, $END, $SERIAL, $RETURNCODE
}
 
### File line loop ###
# Store file name
FILE=""
 
# Make sure we get file name as command line argument
FILE=${1?"No file name specified"}
# Check that file exists and is readable
[ ! -f $FILE ]  { echo "$FILE: does not exist"; exit 1; }
[ ! -r $FILE ]  { echo "$FILE: cannot be read"; exit 2; }
 
#Open file for reading
exec 3 $FILE
 
#Process file line by line
while read -u 3 line
do
   # use $line variable to process line in processLine() function
   processLine $line
done
 
# Close file after reading
exec 3-
 
exit 0

#!/bin/bash
# Clean up OpenSSL dates output
 
processLine(){
  line="$@" # get all args
  line=$(echo "$line" | sed -e 's/GMT//')
  line=$(echo "$line" | cut -d" " -f1,2,4)
  DAY=$(echo "$line" | cut -d" " -f2)
  MONTH=$(echo "$line" | cut -d" " -f1)
  YEAR=$(echo "$line" | cut -d" " -f3)
  echo $DAY\/$MONTH\/$YEAR
}
 
### File line loop ###
# Store file name
FILE=""
 
# Make sure we get file name as command line argument
FILE=${1?"No file name specified"}
# Check that file exists and is readable
[ ! -f $FILE ]  { echo "$FILE: does not exist"; exit 1; }
[ ! -r $FILE ]  { echo "$FILE: cannot be read"; exit 2; }
 
#Open file for reading
exec 3 $FILE
 
#Process file line by line
while read -u 3 line
do
   # use $line variable to process line in processLine() function
   processLine $line
done
 
# Close file after reading
exec 3-