【Shell】利用 OpenSSL 脚本自动化检测 HTTPS 域名证书过期时间与告警实战

echo | openssl s_client -servername <域名> -connect <域名>:443 2>/dev/null | openssl x509 -noout -enddate

DOMAIN="www.baidu.com"

# 1. 抓取截止时间字符串 (格式: notAfter=May 17 06:48:47 2026 GMT)
END_DATE=$(echo | timeout 5 openssl s_client -servername "$DOMAIN" -connect "$DOMAIN":443 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d '=' -f 2)

# 2. 将截止时间与当前时间转换为秒级时间戳并计算天数
END_TIMESTAMP=$(date +%s -d "$END_DATE")
NOW_TIMESTAMP=$(date +%s)
DAYS_LEFT=$(( (END_TIMESTAMP - NOW_TIMESTAMP) / 86400 ))

echo "域名 $DOMAIN 证书剩余天数: $DAYS_LEFT 天"

# macOS 兼容提取时间戳
END_TIMESTAMP=$(date -j -f "%b %d %T %Y %Z" "$END_DATE" +%s)

www.baidu.com
www.github.com
api.x7lab.cn:443

#!/usr/bin/env bash
# check_ssl_expire.sh - 批量检测 SSL 证书过期剩余天数

DOMAINS_FILE="${1:-domain_list.txt}"
WARN_DAYS=30

if [ ! -f "$DOMAINS_FILE" ]; then
    echo "错误: 域名清单文件 $DOMAINS_FILE 不存在！"
    exit 1
fi

echo "==================== SSL 证书有效期巡检报告 ===================="
printf "%-30s | %-12s | %-10s\n" "域名" "剩余天数" "状态"
echo "----------------------------------------------------------------"

while IFS= read -r line || [ -n "$line" ]; do
    # 过滤注释与空行
    [[ "$line" =~ ^#.*$ || -z "$line" ]] && continue

    # 拆分域名与端口 (默认 443)
    DOMAIN=$(echo "$line" | cut -d ':' -f 1 | xargs)
    PORT=$(echo "$line" | cut -s -d ':' -f 2 | xargs)
    PORT="${PORT:-443}"

    # 抓取证书过期截止时间
    RAW_DATE=$(echo | timeout 5 openssl s_client -servername "$DOMAIN" -connect "$DOMAIN:$PORT" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d '=' -f 2)

    if [ -z "$RAW_DATE" ]; then
        printf "%-30s | %-12s | %-10s\n" "$DOMAIN:$PORT" "探测失败" "ERROR"
        continue
    fi

    # 计算剩余天数
    END_TS=$(date +%s -d "$RAW_DATE")
    NOW_TS=$(date +%s)
    DAYS=$(( (END_TS - NOW_TS) / 86400 ))

    if [ "$DAYS" -le "$WARN_DAYS" ]; then
        STATUS="⚠️ 紧急临期"
    else
        STATUS="✅ 正常"
    fi

    printf "%-30s | %-12s | %-10s\n" "$DOMAIN:$PORT" "${DAYS} 天" "$STATUS"
done < "$DOMAINS_FILE"

#!/usr/bin/env bash
# check_ssl_concurrent.sh - 多并发高性能证书过期巡检

DOMAINS_FILE="${1:-domain_list.txt}"
TEMP_RESULT=$(mktemp /tmp/ssl_check_XXXXXX.txt)
WARN_DAYS=30

# 单域名检测函数
check_domain() {
    local domain=$1
    local port=${2:-443}

    local raw_date
    raw_date=$(echo | timeout 3 openssl s_client -servername "$domain" -connect "$domain:$port" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d '=' -f 2)

    if [ -z "$raw_date" ]; then
        echo "$domain:$port|FAILED|0" >> "$TEMP_RESULT"
        return
    fi

    local end_ts now_ts days
    end_ts=$(date +%s -d "$raw_date")
    now_ts=$(date +%s)
    days=$(( (end_ts - now_ts) / 86400 ))

    echo "$domain:$port|SUCCESS|$days" >> "$TEMP_RESULT"
}

# 并发拉起巡检进程
while IFS= read -r line || [ -n "$line" ]; do
    [[ "$line" =~ ^#.*$ || -z "$line" ]] && continue
    domain=$(echo "$line" | cut -d ':' -f 1 | xargs)
    port=$(echo "$line" | cut -s -d ':' -f 2 | xargs)
    port="${port:-443}"

    check_domain "$domain" "$port" &
done < "$DOMAINS_FILE"

# 优雅等待所有后台并发子任务完成
wait

# 格式化输出汇总
echo "==================== 并发巡检汇总结果 ===================="
while IFS='|' read -r target status days; do
    if [ "$status" = "SUCCESS" ]; then
        if [ "$days" -le "$WARN_DAYS" ]; then
            echo -e "[\033[31m告警\033[0m] $target 仅剩 $days 天，请立即续签！"
        else
            echo -e "[\033[32m正常\033[0m] $target 剩余 $days 天"
        fi
    else
        echo -e "[\033[33m失败\033[0m] $target 证书探测失败，请检查网络或端口"
    fi
done < "$TEMP_RESULT"

# 清理临时文件
rm -f "$TEMP_RESULT"