Warning: chmod(): Operation not permitted in /var/www/hopeinstoughton_www/wp-content/plugins/simple-universal-google-analytics/main.php on line 8
[0] in function chmod in /var/www/hopeinstoughton_www/wp-content/plugins/simple-universal-google-analytics/main.php on line 8
[1] in function include_once in /var/www/hopeinstoughton_www/wp-settings.php on line 560
[2] in function require_once in /var/www/hopeinstoughton_www/wp-config.php on line 85
[3] in function require_once in /var/www/hopeinstoughton_www/wp-load.php on line 50
[4] in function require_once in /var/www/hopeinstoughton_www/wp-blog-header.php on line 13
[5] in function require in /var/www/hopeinstoughton_www/index.php on line 17

#!/usr/local/bin/php
<?php

/*
	uses certinfo from https://github.com/cloudflare/cfssl/releases/tag/v1.6.1

    can timeout after 10s 

	installation:
		sudo curl -L --create-dirs -o /usr/local/bin/certinfo https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl-certinfo_1.6.1_linux_amd64 && chmod 755 /usr/local/bin/certinfo

*/

	define('CERTINFO', '/usr/local/bin/certinfo');
	require_once __DIR__ . '/class_nagios.php';

// check_ssl_certificate -H stoughton.link -p 443 -w 30 -c 25

class Certificate_Plugin extends Nagios_Plugin {

	public function __Construct() {
		parent::__construct();
		$this->add_argument('host', [
			'short'    => '-H',
			'long'	   => '--host',
			'required' => TRUE,
			'help' 	   => 'check the certificate on the indicated host',
			'param'	   => '<host>',
		]);
		$this->add_argument('port', [
			'short'    => '-p',
			'long'	   => '--port',
			'required' => FALSE,
			'help' 	   => 'check the certificate on the specified port',
			'param'	   => '<port>',
			'default'  => '443',
		]);
		$this->add_argument('critical', [
			'short'    => '-c',
			'long'	   => '--critical',
			'required' => FALSE,
			'help' 	   => 'exit with CRITICAL status if number of days left is less than <days>',
			'param'	   => '<days>',
			'default'  => '7',
		]);
		$this->add_argument('warning', [
			'short'    => '-w',
			'long'	   => '--warning',
			'required' => FALSE,
			'help' 	   => 'exit with WARNING status if number of days left is less than <days>',
			'param'	   => '<days>',
			'default'  => '30',
		]);
	}
	
	private function _match(&$match, $needle, $haystack) {
		if ($match != '') return FALSE;
		if ($needle == $haystack) {
			$match = $haystack;
			return TRUE;
		}
		// wildcard match
		$elements = explode('.', $needle);
		$elements[0] = '*';
		$current = join('.', $elements);
		if ($current == $haystack) {
			$match = $haystack;
			return TRUE;
		}
		return FALSE;
	}
	
	public function Execute() {
		// parse parameters
		parent::Execute();
		// error if parameters missing
		if (empty($this->params['host'])) 
			return $this->Error("'host' is a required parameter");

		if (!file_exists(CERTINFO)) 
			return $this->Error("'certinfo' is not installed");

		$param = escapeshellarg("{$this->params['host']}:{$this->params['port']}");
		$command = CERTINFO . " -domain $param 2>&1";
		$output = trim(`$command`);
		if (substr($output, 0, 8) == 'dial tcp') {
			$p = strpos($output, ': ');
			$message = trim(substr($output, $p + 2));
			return $this->Error($message);
		}
		$json = json_decode($output, TRUE);
		
		// display the results
		$remaining = strtotime($json['not_after']) - time();
		$days = abs(intval($remaining / 86400));
		$remaining2 = $remaining % 86400;
		$hh = intval($remaining2 / 3600);
		$remaining2 = $remaining2 % 3600;
		
		$cn = $this->params['host'];
		$match = '';		// no matching SANS
		// get matching name	- name [matching name if different]
		
		if (!$this->_match($match, $cn, $json['subject']['common_name'])) {
			foreach($json['sans'] as $entry) {
				if (strpos($entry, '*') === FALSE) {
					if ($this->_match($match, $cn, $entry)) break;	// found
				}
			}
			foreach($json['sans'] as $entry) {
				if (strpos($entry, '*') !== FALSE) {
					if ($this->_match($match, $cn, $entry)) break;	// found
				}
			}
		}
		
		// error if no match (incorrect cert for domain)?
		if ($match == '')
			return $this->Error("Certificate name mismatch for $cn");
		
		// error missing intermediate certs?
		if ($match != $cn) {
			$cn .= " [$match]";
		}
		$daylabel = $days == 1 ? 'day' : 'days';
		
		if ($remaining < 0) {
			return $this->Status('CRITICAL')
				 ->ReturnCode(static::RC_CRITICAL)
				 ->Summary("$cn expired $days $daylabel ago.");
		} elseif ($days <= $this->params['critical']) {
			return $this->Status('CRITICAL')
				 ->ReturnCode(static::RC_CRITICAL)
				 ->Summary("only $days $daylabel left for $cn");
		} elseif ($days <= $this->params['warning']) {
			return $this->Status('WARNING')
				 ->ReturnCode(static::RC_WARNING)
				 ->Summary("only $days $daylabel left for $cn");
		} else {
			return $this->Status('OK')
				 ->ReturnCode(static::RC_OK)
				 ->Summary("$days $daylabel left for $cn");
		}
	}
	
}


header('Content-type: text/plain');
$plugin = new Certificate_Plugin;
$plugin->Execute();
echo $plugin;
die($plugin->ReturnCode());