main.go

package main

import (
	"crypto/tls"
	"flag"
	"fmt"
	"net"
	"os"
	"regexp"
	"strings"
	"sync"
	"time"

	"github.com/dustin/go-humanize"
)

func main() {

	warning_period := flag.Int("warn", 7, "warning period in days")
	timeout := flag.Duration("timeout", 2*time.Second, "timeout for connection")
	concurrency := flag.Int("c", 128, "number of concurrent checks")
	flag.Parse()

	// endpoints to check
	endpoints := flag.Args()

	dialer := &net.Dialer{
		Timeout: *timeout,
	}

	warn_if_expired_at := time.Now().AddDate(0, 0, *warning_period)

	checker := NewSimpleHostChecker(dialer, warn_if_expired_at)

	os.Exit(RunChecks(checker, endpoints, *concurrency))
}

type HostChecker interface {
	CheckHost(host string) (bool, error)
}

func RunChecks(
	checker HostChecker,
	endpoints []string,
	concurrency int,
) (exitcode int) {

	// semaphore to limit concurrency to a reasonable number
	semaphore := make(chan struct{}, concurrency)

	wg := new(sync.WaitGroup)
	wg.Add(len(endpoints))

	for _, i := range endpoints {

		// sleep 1ms to avoid hitting DNS resolver limits
		time.Sleep(time.Millisecond)

		// acquire semaphore
		semaphore <- struct{}{}

		go func(i string) {

			// mark as done when we're finished
			defer wg.Done()

			// release semaphore
			defer func() { <-semaphore }()

			expires_soon, err := checker.CheckHost(i)
			if err != nil {
				fmt.Printf("can't check %s: %s\n", i, err)
				exitcode = 1
			} else if expires_soon {
				exitcode = 1
			}

		}(i)
	}

	wg.Wait()

	return exitcode

}

var addrOverride = regexp.MustCompile(`^([^:]+):(((\[[0-9a-f:]+\])|([^:]+)):\d+)$`)

type SimpleHostChecker struct {
	dialer             *net.Dialer
	warn_if_expired_at time.Time
}

func NewSimpleHostChecker(
	dialer *net.Dialer,
	warn_if_expired_at time.Time,
) *SimpleHostChecker {
	return &SimpleHostChecker{
		dialer:             dialer,
		warn_if_expired_at: warn_if_expired_at,
	}
}

func expiresInOrExpired(t time.Time) string {
	if time.Now().After(t) {
		return "expired"
	} else {
		return "expires in"
	}
}

func (c *SimpleHostChecker) CheckHost(
	host string,
) (expires_soon bool, err error) {

	config := tls.Config{
		// we still want to get connection even if the cert is expired, or if
		// the hostname doesn't match
		InsecureSkipVerify: true,
	}

	// custom address parsing to allow default port and address override
	if !strings.Contains(host, ":") {
		host = host + ":443"
	} else if match := addrOverride.FindStringSubmatch(host); match != nil {
		config.ServerName = match[1]
		host = match[2]
	}

	// make a connection to get the certificate
	conn, err := tls.DialWithDialer(c.dialer, "tcp", host, &config)
	if err != nil {
		return
	}
	conn.Close()

	// check all certificates in the chain for expiration
	for _, cert := range conn.ConnectionState().PeerCertificates {
		if c.warn_if_expired_at.After(cert.NotAfter) {
			expires_soon = true
			fmt.Printf("Certificate for %s (%s) %s %s.\n",
				host, cert.Subject.CommonName,
				expiresInOrExpired(cert.NotAfter),
				humanize.Time(cert.NotAfter))
		}
	}

	// TODO: validate hostname and chain of trust

	return
}