Add script for listing expiring certificates

.github/workflows/master.yml

@@ -93,6 +93,17 @@ jobs:
  codesign_p12pass
  EOF
 
+ - name: List expired certs
+ working-directory: test-root-ca
+ run: ./bin/list-expiring-certs
+
+ - name: Check that all certs (including the root ca) expire within 5 years
+ working-directory: test-root-ca
+ run: |
+ ./bin/list-expiring-certs -t '5 years' | tee exp.tmp
+ grep -q 'Found 4 expiring' exp.tmp
+ rm -f exp.tmp
+
  - name: Revoke server certificate
  working-directory: test-root-ca
  run: |
@@ -111,6 +122,25 @@ jobs:
  rootCA_password
  EOF
 
+ - name: Check that we only see the root ca and client certs expiring within 5 years
+ working-directory: test-root-ca
+ run: |
+ ./bin/list-expiring-certs -t '5 years' | tee exp.tmp
+ grep -q 'CN=Bogus Inc. Certificate Authority' exp.tmp
+ grep -q 'CN=test-client' exp.tmp
+ rm -f exp.tmp
+
+ - name: Check that we see all certificates again when using -a
+ working-directory: test-root-ca
+ run: |
+ ./bin/list-expiring-certs -t '5 years' -a | tee exp.tmp
+ grep -q 'Found 4 expiring' exp.tmp
+ rm -f exp.tmp
+
+ - name: Check that the exit code for expiring certificates work
+ working-directory: test-root-ca
+ run: ( set +e ; ./bin/list-expiring-certs -t '5 years' -x ; test $? == 5 )
+
  - name: Create signing CA
  working-directory: test-root-ca
  run: |
@@ -271,6 +301,10 @@ jobs:
  signCA_password
  EOF
 
+ - name: List expired certs
+ working-directory: test-signing-ca
+ run: ./bin/list-expiring-certs
+
  - name: Show status of CA
  working-directory: test-signing-ca
  run: ./bin/show-status

functions

@@ -23,6 +23,7 @@ show-status
 gen-html
 update-crl
 make-client-ovpn
+list-expiring-certs
 "
 
 export TEMPLATES_ROOT="
@@ -49,6 +50,7 @@ show-status
 gen-html
 update-crl
 make-client-ovpn
+list-expiring-certs
 "
 
 export TEMPLATES_SIGN="

list-expiring-certs

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Jonas Eriksson <[email protected]>
+
+set -eu
+set -o pipefail
+
+umask 0077
+
+BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+source "${BIN_DIR}/functions"
+source "${BIN_DIR}/defaults.conf"
+
+usage() {
+ echo "Usage: $0 [-t TIME_DELTA] [-x] [-s] [-a]"
+ echo "Lists certificates expiring within TIME_DELTA"
+ echo
+ echo "Options:"
+ echo " -t TIME_DELTA Time delta in a format parseable by date --date"
+ echo " Default: 1 month"
+ echo " -x Exit with status 5 if expiring certs was found"
+ echo " -c Clean mode; only output expiring certs and expire"
+ echo " date without colors for e.g. crontab emails"
+ echo " -a Show all certificates; default: only valid"
+ echo
+}
+
+if [ ! -f ca/db/certificate.db ]; then
+ echo -e "$ERR Must be run inside a CA directory!"
+ exit 2
+fi
+
+TIME_DELTA="1 month"
+FOUND_EXPIRES_EXIT_STATUS=0
+CLEAN_MODE=
+SHOW_ALL=
+
+while getopts t:xcha FLAG; do
+ case $FLAG in
+ h) echo -e -n "$SUCC " && usage && exit 0
+ ;;
+ t) TIME_DELTA="${OPTARG}"
+ ;;
+ x) FOUND_EXPIRES_EXIT_STATUS=5
+ ;;
+ c) CLEAN_MODE=1
+ ;;
+ a) SHOW_ALL=1
+ ;;
+ *) echo -e -n "$ERR " && usage && exit 2
+ ;;
+ esac
+done
+
+if [ $OPTIND -le $# ]; then
+ echo -e -n "$ERR " && usage && exit 2
+fi
+
+EXPIRY_MATCH_DATE="$(date --date="$TIME_DELTA" +%y%m%d%H%M%S)"
+
+# Set the internal field separator to tab
+IFS=' '
+COUNT=0
+while read status expiry serial filename dn; do
+ if ! [ "$SHOW_ALL" ] && ! [ "$status" = V ]; then
+ continue
+ fi
+ if [ "$EXPIRY_MATCH_DATE" -ge "${expiry%Z}" ]; then
+ COUNT=$(( COUNT + 1))
+ # No year 2100 support at this time
+ HUMAN_EXPIRY="20${expiry:0:2}-${expiry:2:2}-${expiry:4:2} ${expiry:6:2}:${expiry:8:2}:${expiry:10:2} UTC"
+ MESSAGE="Certificate with serial $serial ($dn) will expire on $HUMAN_EXPIRY"
+ if [ "$CLEAN_MODE" ]; then
+ echo "$MESSAGE"
+ else
+ echo -e "$NOTE $MESSAGE"
+ fi
+ fi
+done < ca/db/certificate.db
+
+if ! [ "$CLEAN_MODE" ]; then
+ echo -e "$SUCC Found $COUNT expiring certificates"
+fi
+
+if [ $COUNT -gt 0 ]; then
+ exit $FOUND_EXPIRES_EXIT_STATUS
+fi