#!/bin/bash
#=====================================================
# SSL 证书到期检查脚本
# 来源: 整合自 HariSekhon/DevOps-Bash-tools
# 用法: ./ssl-cert-check.sh <域名> [端口]
# 示例: ./ssl-cert-check.sh example.com 443
#=====================================================

DOMAIN=${1:-}
PORT=${2:-443}
WARN_DAYS=30

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

if [ -z "$DOMAIN" ]; then
    echo "用法: $0 <域名> [端口]"
    echo "示例: $0 example.com 443"
    exit 1
fi

echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN}  SSL 证书检查: ${DOMAIN}:${PORT}${NC}"
echo -e "${GREEN}========================================${NC}"

# 获取证书信息
CERT_INFO=$(echo | openssl s_client -servername "$DOMAIN" -connect "${DOMAIN}:${PORT}" 2>/dev/null | openssl x509 -noout -dates -subject -issuer 2>/dev/null)

if [ -z "$CERT_INFO" ]; then
    echo -e "${RED}无法获取证书信息${NC}"
    exit 1
fi

# 提取信息
SUBJECT=$(echo "$CERT_INFO" | grep "subject=" | sed 's/subject=//')
ISSUER=$(echo "$CERT_INFO" | grep "issuer=" | sed 's/issuer=//')
NOT_BEFORE=$(echo "$CERT_INFO" | grep "notBefore=" | sed 's/notBefore=//')
NOT_AFTER=$(echo "$CERT_INFO" | grep "notAfter=" | sed 's/notAfter=//')

echo "  颁发给:   $SUBJECT"
echo "  颁发者:   $ISSUER"
echo "  生效时间: $NOT_BEFORE"
echo "  到期时间: $NOT_AFTER"

# 计算剩余天数
if command -v python3 &>/dev/null; then
    END_DATE=$(echo "$NOT_AFTER" | sed 's/GMT//' | xargs)
    if [[ "$OSTYPE" == "darwin"* ]]; then
        END_TS=$(date -j -f "%b %d %T %Y" "$END_DATE" +%s 2>/dev/null)
    else
        END_TS=$(date -d "$END_DATE" +%s 2>/dev/null)
    fi
    NOW_TS=$(date +%s)
    DAYS_LEFT=$(( (END_TS - NOW_TS) / 86400 ))
else
    DAYS_LEFT="N/A"
fi

echo ""

if [ "$DAYS_LEFT" != "N/A" ]; then
    if [ "$DAYS_LEFT" -lt 0 ]; then
        echo -e "${RED}⚠ 证书已过期 ${DAYS_LEFT#-} 天！${NC}"
    elif [ "$DAYS_LEFT" -lt "$WARN_DAYS" ]; then
        echo -e "${RED}⚠ 证书将在 ${DAYS_LEFT} 天后过期！请尽快续期！${NC}"
    elif [ "$DAYS_LEFT" -lt 60 ]; then
        echo -e "${YELLOW}⚠ 证书剩余 ${DAYS_LEFT} 天，建议提前续期${NC}"
    else
        echo -e "${GREEN}✓ 证书剩余 ${DAYS_LEFT} 天，状态正常${NC}"
    fi
fi

# 检查证书链
echo ""
echo -e "${YELLOW}[ 证书链 ]${NC}"
CERT_CHAIN=$(echo | openssl s_client -servername "$DOMAIN" -connect "${DOMAIN}:${PORT}" -showcerts 2>/dev/null | grep -c "BEGIN CERTIFICATE")
echo "  证书链深度: ${CERT_CHAIN}"

# TLS版本
echo ""
echo -e "${YELLOW}[ TLS 版本 ]${NC}"
TLS_VER=$(echo | openssl s_client -servername "$DOMAIN" -connect "${DOMAIN}:${PORT}" 2>/dev/null | grep "Protocol" | awk '{print $2}')
echo "  协议版本: ${TLS_VER:-N/A}"

echo ""
echo -e "${GREEN}========================================${NC}"