Reverse proxy Certificate Checking

Hi Florian,

Thanks for your reply. I'm actually running a Linux Debian environment, so my use case is a little different, however I've written an "SSH Script Advanced" That will do the job. Hopefully this will help anyone looking for a solution too.

The output should be:

• Security Rating
• Certificate Expiry in Days
• Each protocol set in the variable.

Alternatively to the URL, unhash #URL=($@) and this will let you set the parameters in PRTG.

#!/bin/bash
# Script for Monitoring SSL Certificates using PRTG openssl

# Define URL's for SSL Testing. Array to keep it neat in the output stage.
URL=(www.example.com www.example2.com)
#URL=($@)

# Define TLS Level
Protocol="ssl3 tls1 tls1_1 tls1_2"

# Define URL Port
URLPort=443

# Set Warning & Error for Days before Certificate Expiry
LimitMinDaysWarning=30
LimitMinDaysError=5

# Set Warning & Error for Certificate Strength
RatingWarning="2"
RatingError="1"

# Set Warning & Error for Certificate Availability
AvailWarning="1"
AvailError="2"

# Open PRTG XML Tag
echo "<PRTG>"

# Create Associative Array for output order
declare -A OutputArray=()

# Function for PRTG Expiry result
XMLExpiryOutput() {
cat << XML
<result>
<channel>${URL[$key]} Days to Cert Expiry</channel>
<value>${DaysToExpiry}</value>
<CustomUnit>days</CustomUnit>
<LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning>
<LimitMinError>$LimitMinDaysError</LimitMinError>
</result>
XML
}

# Function for PRTG Security Rating Result
XMLSecurityRating() {
cat << XML
<result>
<channel>${URL[$key]} Security Rating</channel>
<value>${CryptValue}</value>
<ValueLookup>prtg.standardlookups.sslsensor.security</ValueLookup>
<Unit>Custom</Unit>
<LimitMinWarning>${RatingWarning}</LimitMinWarning>
<LimitMinError>${RatingError}</LimitMinError>
</result>
XML
}

XMLProtocolPermissionTLS() {
cat << XML
<result>
<channel>${URL[$key]} ${crypt} ${CryptStrength}</channel>
<value>${Permission}</value>
<ValueLookup>prtg.standardlookups.sslsensor.tls</ValueLookup>
<Unit>Custom</Unit>
<LimitMinWarning>${AvailWarning}</LimitMinWarning>
<LimitMinError>${AvailError}</LimitMinError>
</result>
XML
}

XMLOutput(){

### Finalise Output ###
# Change Order here to adapt output and primary Channel
for item in SecurityRating CertificateExpiry $Protocol
do
	IFS=''
	echo ${OutputArray[$item$key]}
	echo $item $key
done
}

# Test each URL
for key in ${!URL[@]}
do
	# Test Protocol for each URL
	for crypt in ${Protocol}
	do
		### SSL EXPIRY ###
		# Get Expiry Date of Protocol in Seconds
		ExpiryDate=$(date +%s -d "$(echo q | openssl s_client -connect ${URL[$key]}:${URLPort} -${crypt} 2>/dev/null | openssl x509 -noout -enddate | cut -d'=' -f2)")
		# Get Current Date in Seconds
		NowDate=$(date +%s)

		# Calculate Days to Expiry in Seconds, then convert back to days
		SecondsToExpiry=$((${ExpiryDate} - ${NowDate}))
		DaysToExpiry=$((${SecondsToExpiry} / 86400))
		#################

		### SSL Permission ###
		# Test Connection with Protocol
		if `echo q | openssl s_client -connect ${URL[$key]}:${URLPort} -${crypt} 2>/dev/null | grep -q "Server certificate"`
		then
			#Permission=Accepted
			Permission=1
		else
			#Permission=Denied
			Permission=0
			# Continue to next protocol if invalid Protocol
			#continue
		fi

		###########################

		### Set Protocol Strength ###
		case $crypt in
			ssl3) CryptValue='1'; CryptStrength='(Weak)'; OutputArray[$crypt$key]+="$(XMLProtocolPermissionTLS)"
				;;
			tls1) CryptValue='2'; CryptStrength='(Weak)'; OutputArray[$crypt$key]+="$(XMLProtocolPermissionTLS)"
			        ;;
			tls1_1) CryptValue='3'; CryptStrength='(Strong)'; OutputArray[$crypt$key]+="$(XMLProtocolPermissionTLS)"
			        ;;
			tls1_2) CryptValue='3'; CryptStrength='(Perfect)'; OutputArray[$crypt$key]+="$(XMLProtocolPermissionTLS)"
			        ;;
		esac
		#############################

		### SSL SECURITY RATING ###
		# Return First Protocol that matches Permission=1 and its CryptValue.
		# Super Important to keep the Certs in Strength order
		# Adding here so that Security Rating becomes the Primary Channel
		if [[ -z $SecurityRating && $Permission -eq 1 ]];
		then
			OutputArray[SecurityRating$key]+="$(XMLSecurityRating)"
		        SecurityRating=SET
		fi
		###########################
		
	done

# Output the expiry results in PRTG Friendly Format
OutputArray[CertificateExpiry$key]+="$(XMLExpiryOutput)"

# Output to Results for URL
XMLOutput

# Reset Security Rating to Process Another URL
SecurityRating=
#Permission=
#CryptValue=

# Reset IFS to Space
IFS=' '

done

# Close PRTG XML Tag
echo "</PRTG>"
#######################