用 Python 检查 TLS 证书到期时间：保留验证、提前预警与本地自检

python3 --version
openssl version
mkdir tls-expiry-demo
cd tls-expiry-demo
curl -fS https://www.bobobk.com/downloads/tls-expiry/check_tls.py -o check_tls.py
curl -fS https://www.bobobk.com/downloads/tls-expiry/test_tls.py -o test_tls.py
python3 check_tls.py --help

"""Check one TLS endpoint's verified leaf certificate. Python 3.9+."""
import argparse
from datetime import datetime, timezone
import json
import math
import socket
import ssl
import time


def check(host, port, timeout, warn_days, cafile=None):
    report = {"host": host, "port": port, "status": "error"}
    try:
        context = ssl.create_default_context(cafile=cafile)
        with socket.create_connection((host, port), timeout=timeout) as raw:
            with context.wrap_socket(raw, server_hostname=host) as tls:
                certificate = tls.getpeercert()
        expires = ssl.cert_time_to_seconds(certificate["notAfter"])
        remaining = expires - time.time()
        report.update(
            status="expiring" if remaining <= warn_days * 86400 else "ok",
            expires_utc=datetime.fromtimestamp(expires, timezone.utc).isoformat(),
            days_remaining=round(remaining / 86400, 3),
        )
    except ssl.SSLCertVerificationError as exc:
        report.update(status="verify_error", error=exc.verify_message)
    except (OSError, ValueError, KeyError, OverflowError) as exc:
        report.update(error=str(exc))
    return report


def main():
    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
    parser.add_argument("host", help="DNS hostname or IP address, without a URL")
    parser.add_argument("--port", type=int, default=443)
    parser.add_argument("--timeout", type=float, default=3)
    parser.add_argument("--warn-days", type=int, default=14)
    parser.add_argument("--cafile", help="explicit PEM trust file, e.g. for a lab")
    args = parser.parse_args()
    if not args.host or any(c.isspace() for c in args.host) or "/" in args.host:
        parser.error("host must be a hostname or IP address without a URL")
    if not 1 <= args.port <= 65535:
        parser.error("--port must be between 1 and 65535")
    if not math.isfinite(args.timeout) or not 0 < args.timeout <= 60:
        parser.error("--timeout must be finite and greater than 0, at most 60")
    if not 0 <= args.warn_days <= 36500:
        parser.error("--warn-days must be between 0 and 36500")
    report = check(args.host, args.port, args.timeout, args.warn_days, args.cafile)
    print(json.dumps(report, ensure_ascii=False))
    return 0 if report["status"] == "ok" else 1


if __name__ == "__main__":
    raise SystemExit(main())

umask 077
printf '[req]\ndistinguished_name = dn\n[dn]\n' > demo-openssl.cnf
openssl req -x509 -newkey rsa:2048 -nodes \
  -config demo-openssl.cnf -days 2 -subj '/CN=localhost' \
  -addext 'subjectAltName=DNS:localhost' \
  -addext 'basicConstraints=critical,CA:TRUE' \
  -addext 'keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign' \
  -addext 'subjectKeyIdentifier=hash' \
  -addext 'authorityKeyIdentifier=keyid:always' \
  -keyout demo-key.pem -out demo-cert.pem
openssl s_server -accept 127.0.0.1:18443 \
  -cert demo-cert.pem -key demo-key.pem -www

python3 check_tls.py localhost --port 18443 --cafile demo-cert.pem --warn-days 0
if python3 check_tls.py localhost --port 18443 --cafile demo-cert.pem --warn-days 3; then
  printf 'Certificate has enough time remaining\n'
else
  tls_exit=$?
  printf 'Check needs attention: exit=%s\n' "$tls_exit"
fi

if python3 check_tls.py localhost --port 18443; then
  printf 'Unexpected trust result\n'
else
  printf 'Expected trust failure: exit=%s\n' "$?"
fi
if python3 check_tls.py 127.0.0.1 --port 18443 --cafile demo-cert.pem; then
  printf 'Unexpected hostname result\n'
else
  printf 'Expected hostname failure: exit=%s\n' "$?"
fi

python3 test_tls.py

OK: valid, expiring, untrusted, hostname mismatch, refused, arguments, timeout

python3 check_tls.py www.bobobk.com --warn-days 14 --timeout 3