#!/bin/bash
# Vexor: report days until a local X.509 certificate file expires.
# Useful for client certificates and any cert file stored on the monitored host.
# Usage: vexor_check_cert_file <path> [warn_days] [crit_days]
CERT="$1"
WARN="${2:-30}"; [ -z "$WARN" ] && WARN=30
CRIT="${3:-7}";  [ -z "$CRIT" ] && CRIT=7

if [ -z "$CERT" ]; then
  echo "UNKNOWN: usage: vexor_check_cert_file <path> [warn_days] [crit_days]"; exit 3
fi
if [ ! -r "$CERT" ]; then
  echo "UNKNOWN: cert file '$CERT' not readable by the nrpe user"; exit 3
fi

# PEM first, fall back to DER.
END=$(openssl x509 -enddate -noout -in "$CERT" 2>/dev/null | cut -d= -f2)
if [ -z "$END" ]; then
  END=$(openssl x509 -inform DER -enddate -noout -in "$CERT" 2>/dev/null | cut -d= -f2)
  FORM="-inform DER"
fi
if [ -z "$END" ]; then
  echo "UNKNOWN: '$CERT' is not a parseable X.509 certificate"; exit 3
fi

END_TS=$(date -d "$END" +%s 2>/dev/null || echo 0)
if [ "$END_TS" -eq 0 ]; then
  echo "UNKNOWN: cannot parse expiry date of '$CERT'"; exit 3
fi
NOW=$(date +%s)
DAYS=$(( (END_TS - NOW) / 86400 ))
SUBJ=$(openssl x509 ${FORM:-} -subject -noout -in "$CERT" 2>/dev/null | sed 's/^subject= *//; s/^subject=//')
PERF="| days_left=${DAYS};${WARN};${CRIT};0;"

if [ "$DAYS" -lt 0 ]; then
  echo "CRITICAL: ${CERT} expired $(( -DAYS )) days ago - ${SUBJ} ${PERF}"; exit 2
elif [ "$DAYS" -le "$CRIT" ]; then
  echo "CRITICAL: ${CERT} expires in ${DAYS} days - ${SUBJ} ${PERF}"; exit 2
elif [ "$DAYS" -le "$WARN" ]; then
  echo "WARNING: ${CERT} expires in ${DAYS} days - ${SUBJ} ${PERF}"; exit 1
else
  echo "OK: ${CERT} valid for ${DAYS} more days - ${SUBJ} ${PERF}"; exit 0
fi
