#!/bin/bash


gracedays=7

if [ -z $SDDIR ]; then
    SDDIR=/etc/statusd
fi

if [ -z $SPOOLDIR ]; then
    SPOOLDIR=/var/spool/statusd
fi

STF=$SPOOLDIR/sslcerts.status


function check_expired()
{
	certs="$@"

	for cert in $certs; do
		if [ -n "$cert" -a -f "$cert" ]; then
			certdata=`openssl x509 -text -noout -in $cert 2>/dev/null`

			if [ -n "$certdata" ]; then
				enddate=`echo "$certdata" |grep "Not After :" |sed -e 's#^.*Not After : ##'`

				ssldate=`date -d "${enddate}" '+%s'`
				nowdate=`date '+%s'`
				datediff="$((${ssldate}-${nowdate}))"

				if test "${datediff}" -lt "$((1*24*3600))"; then
					echo "[$cert EXP]"
				elif test "${datediff}" -lt "$((${gracedays}*24*3600))"; then
					echo "[$cert SOON]"
#				else
#					echo "[$cert OK]"
				fi
			fi
		fi
	done
}



function get_certfile()
{
	if ! [ $# -eq 4 ]; then
		echo "Programming error"
		exit 44
	fi
	CHRDIR=$1
	CFGNAME=$2
	CFGSTR=$3
	SEPARATOR=$4

	if [ $CHRDIR == "/" ]; then
		CHRDIR=""
	fi

	#CFGFILE=${CHRDIR}${CFGNAME}
	CERTFILES=`grep -h ${CFGSTR} ${CHRDIR}${CFGNAME} -R 2>/dev/null |tr -d "\t " |grep -ve "^\[#;\]" |tr -d ";" | grep "^${CFGSTR}${SEPARATOR}/" |sed -e "s#${CFGSTR}${SEPARATOR}##"`
	CERTFILES_UNIQ=`echo "$CERTFILES" |sort |uniq`
	for CERTFILE in $CERTFILES_UNIQ; do
		if [ -n "$CERTFILE" -a -f "${CHRDIR}${CERTFILE}" ]; then
			echo ${CHRDIR}${CERTFILE}
		fi
	done
}

function ccheck()
{
	RES=""

	CRIT=0
	WARN=0

	dovecot_chroot_cert=`get_certfile /chroot/maild /etc/dovecot/conf.d/10-ssl.conf ssl_cert "=<"`
	postfix_chroot_cert=`get_certfile /chroot/maild /etc/postfix/main.cf smtpd_tls_cert_file "="`
	postfix_cert=`get_certfile / /etc/postfix/main.cf smtp_tls_cert_file "="`

	ares=`check_expired "$dovecot_chroot_cert $postfix_chroot_cert $postfix_cert /etc/ssl/private/pure-ftpd.pem"`
	RES="${RES} ${ares}"

	nginx_sys_certs=`get_certfile /chroot/proxyd /etc/nginx/vhost-sys.conf ssl_certificate ""`
	ares=`check_expired "$nginx_sys_certs"`
	RES="${RES} ${ares}"

	nginx_vhost_certs=`get_certfile /chroot/proxyd /etc/nginx/vhost.auto/ ssl_certificate ""`
	ares=`check_expired "$nginx_vhost_certs"`
	RES="${RES} ${ares}"

	nginx_mvhost_certs=`get_certfile /chroot/proxyd /etc/nginx/vhost.manual/ ssl_certificate ""`
	ares=`check_expired "$nginx_mvhost_certs"`
	RES="${RES} ${ares}"

	apache_admin_certs=`get_certfile /chroot/admin /etc/apache2/vhost-sys.conf SSLCertificateFile ""`
	ares=`check_expired "$apache_admin_certs"`
	RES="${RES} ${ares}"

	RES=`echo ${RES}`

	if [ -n "$RES" ]; then
		echo "$RES"
	else
		echo "OK"
	fi
}

if [ "$1" == "cron" ]; then
	RES=`ccheck`
	echo "$RES" >$STF
else
	if [ -f $STF ]; then
		RES=`cat $STF`
		echo "$RES"
		if [ "$RES" != "OK" ]; then
			if (grep "EXP" $STF >/dev/null); then
				exit 2
			else
				exit 1
			fi
		else
			exit 0
		fi
	else
		echo "OK"
		exit 0
	fi
fi