#!/bin/bash
# Reads a PEM cert file and reports days until expiry.
CERT="${1:-/etc/vexor/tls/vexor.crt}"
if [ ! -r "$CERT" ]; then echo "CRITICAL: cert file $CERT unreadable"; exit 2; fi
END_TS=$(date -d "$(openssl x509 -in "$CERT" -enddate -noout 2>/dev/null | cut -d= -f2)" +%s 2>/dev/null || echo 0)
NOW=$(date +%s)
if [ "$END_TS" -eq 0 ]; then echo "CRITICAL: cannot parse cert expiry"; exit 2; fi
DAYS=$(( (END_TS - NOW) / 86400 ))
PERF="| days_left=$DAYS;30;7;0;"
if [ "$DAYS" -lt 0 ]; then echo "CRITICAL: TLS cert expired $((-DAYS)) days ago $PERF"; exit 2
elif [ "$DAYS" -lt 7 ]; then echo "CRITICAL: TLS cert expires in $DAYS days $PERF"; exit 2
elif [ "$DAYS" -lt 30 ]; then echo "WARNING: TLS cert expires in $DAYS days $PERF"; exit 1
else echo "OK: TLS cert valid for $DAYS more days $PERF"; exit 0
fi
