cert_status

#!/bin/bash

# Given name of a certificate, report on:
#  DN
#  Serial
#  Date created
#  Date of expiration
#  Days to expiration
#  Revocation status
#  Author
#


VERSION="1.3.0"
APPNAME=$(basename ${0})
APPDIR=$(pwd)

PROD_INT_FOLDER="${APPDIR}/DataONEProdIntCA"
PROD_CAROOTCERT="${APPDIR}/DataONEProdRootCA/certs/DataONEProdRootCA.pem"
PROD_CACERT="${PROD_INT_FOLDER}/certs/DataONEProdIntCA.pem"

TEST_INT_FOLDER="${APPDIR}/DataONETestIntCA"
TEST_CAROOTCERT="${APPDIR}/DataONETestRootCA/certs/DataONETestRootCA.pem"
TEST_CACERT="${TEST_INT_FOLDER}/certs/DataONETestIntCA.pem"

#Default to use the TEST environment
CERT_ENVIRONMENT="Test"
CERT_FOLDER="${TEST_INT_FOLDER}"
CAROOTCERT=${TEST_CAROOTCERT}
CACERT=${TEST_CACERT}

VERBOSE=""
CERTIFICATE=""
CACHAINFILE=""
DUMPCERT=""
CSVOUTPUT=""
DLMT=','
OUTFORMAT="JSON"
getAuthor=""
GENERATE_REPORT=""
GENERATE_CALENDAR=""
c_DN=""
c_create_date=""
c_expire_date=""
c_revoked=""
c_serial=""
c_author=""
c_valid=""
expire_within=99999 #Only show certs that expire within this number of days +-

XML=xml
SVN=svn
TMPDIR="/tmp"
TMPFILE=${TMPDIR}/${APPNAME}.$$.out
dateformat_out="%Y-%m-%dT%H:%M:%S.000+00:00"
TNOW=$(date -u +%s)

function usage() {
cat << EOF
${APPNAME} version ${VERSION}

usage: ${APPNAME} OPTIONS TARGET 

Report on the status of a PEM format certificate(s)

OPTIONS:
  -h  Show this message
  -d  Text dump the certificate to STDOUT and exit
  -v  Show version and exit
  -V  Verbose output to STDERR
  -s  Output pipe delimited rows instead of JSON
  -n  Output human readable text instead of JSON
  -a  The CACERT.pem file (${CACERT})
  -c  The CAROOTCERT.pem file (${CAROOTCERT})
  -C  CA Chain file, containing CACERT and CAROOT
  -S  Generate CSV header and exit
  -A  Lookup author from subversion (default: No)
  -P  Use default production certificate authority
  -L  Generate .ics file for the certificate authority

TARGET:
  A single .pem certificate or folder containing .pem certificates

EOF
}


function usageExamples() {
	usage
cat << EOF

Example - Show status of a single certificate in test environment:

  ./${APPNAME} -A DataONETestIntCA/certs/urn\:node\:mnTestGulfWatch.pem  

Example - Show status of a single certificate in production environment, 
using the default locations for certificates:

  ./${APPNAME} -A -P DataONEProdIntCA/certs/urn\:node\:GULFWATCH.pem
 
Example - Show status of a single certificate in production environment, 
explicitly indicating which certificates to use:

  ./${APPNAME} -A \\
    -a DataONEProdIntCA/certs/DataONEProdIntCA.pem \\
    -c DataONEProdRootCA/certs/DataONEProdRootCA.pem \\
    DataONEProdIntCA/certs/urn\\:node\\:GULFWATCH.pem

Example - Generate a pipe delimited text file reporting on all the 
test certificates:

  ./${APPNAME} -S > testcerts.csv; \\
  for f in \$(find DataONETestIntCA/certs -name *.pem); \\
    do ./${APPNAME} -A -s \$f >> testcerts.csv; done
  
OR:

   ./${APPNAME} -s -A DataONETestIntCA/certs

Example - Generate a pipe delimited text file reporting on all the 
production certificates:

  ./${APPNAME} -H > testcerts.csv; \\
  for f in \$(find DataONETestIntCA/certs -name *.pem); \\
  do ./${APPNAME} -A -s \\
   -a DataONEProdIntCA/certs/DataONEProdIntCA.pem \\
   -c DataONEProdRootCA/certs/DataONEProdRootCA.pem \\
  \$f >> prodcerts.csv; done
 
OR:

  ./${APPNAME} -s -A -P DataONEProdIntCA/certs

Example - Generate a calendar of events in .ics format for production 
environment certificate expirations. Output is to the file "Prod_events.ics" for the production
environment or "Test_events.ics" for the test environment. The 
calendar can be subscribed to using the respective SVN URL.

  ./${APPNAME} -P -L


Example - Check the client certificate installed on a CN, performed when
logged on to a CN.

  
EOF
}


function showVersion() {
	echo ${VERSION}
}


function log() {
	if [[ ! -z ${VERBOSE} ]]; then
		echo "LOG: $@" 1>&2;
	fi
}


function lwarn() {
	echo "WARN: $@" 1>&2;
}


function lerror() {
	echo "ERROR: $@" 1>&2;
}


function dumpCertificate() {
	openssl x509 -noout -text -in ${CERTIFICATE}
}


# Convert an OpenSSL date to a serial date (seconds from epoch)
function toSerialDate() {
    if [[ $(uname) == "Darwin" ]]; then
        date -junf "%b %e %H:%M:%S %Y %Z" "$@" +%s
    else
        date --date "${@}" +%s
    fi
}

function joinBy { 
  local IFS="$1"; 
  shift; 
  echo "$*"; 
}

function splitBy() {
  local IFS="$1";
  read -r -a split_by <<< "${2}"
}

# Convert a serial date to a standard date format.
# input: serial_date [date_format]
function fromSerialDate() {
    local date_format="${dateformat_out}"
    if [[ ! -z ${2} ]]; then
        date_format=${2}
    fi
    if [[ $(uname) == "Darwin" ]]; then
        date -junf "%s" "${1}" "+${date_format}"
    else
        date --date "@${1}" "+${date_format}"
    fi
}


reversea() {
    # first argument is the array to reverse
    # second is the output array
    declare -a arr="$1" rev="$2"
    for i in "${arr[@]}"
    do
        rev=("$i" "${rev[@]}")
    done
}


function getCertificateInfo() {
	local _TMP=$(openssl x509 -subject -noout -in ${CERTIFICATE})
	old_IFS=$IFS
	IFS=$'/' _TMP=(${_TMP#*/})
	IFS=${old_IFS}
	_TMP=$(printf ",%s" "${_TMP[@]}")
	#echo ${_TMP}
  reversea _TMP _TMP2
  #echo "${_TMP[@]}"
  #echo "${_TMP2[@]}\n"
  #echo "==="
  #eval eval echo "'\"\${_TMP['{$((${#_TMP[@]}-1))..0}']}\"'"
  #echo
	c_DN=${_TMP:1}
	c_DN=$(echo ${c_DN//[[:blank:]]/} | tr -d \")
  splitBy "," ${c_DN};
  #_TMP
	_TMP=$(openssl x509 -enddate -noout -in ${CERTIFICATE} \
		        | awk -F= ' /notAfter/ { printf("%s\n",$NF); } ');
	c_expire_date=$(toSerialDate "${_TMP}")
	_TMP=$(openssl x509 -startdate -noout -in ${CERTIFICATE} \
		        | awk -F= ' /notBefore/ { printf("%s\n",$NF); } ');		
	c_create_date=$(toSerialDate "${_TMP}")
	_TMP=$(openssl x509 -serial -noout -in ${CERTIFICATE})
	c_serial=${_TMP##*=}
	cDaysToExpire=$(echo "(${c_expire_date}-${TNOW})/(60*60*24)" |bc);
	_TMP=""
	if [[ -z ${CACHAINFILE} ]]; then
	  	if [[ -f ${CAROOTCERT} ]]; then
			if [[ -f ${CACERT} ]]; then
        cat ${CAROOTCERT} > ${TMPFILE}
        cat ${CACERT} >> ${TMPFILE}
        CACHAINFILE=${TMPFILE}
			else
				log "CACERT file not found: ${CACERT}"
			fi
		else
			log "CAROOTCERT file not found: ${CAROOTCERT}"
		fi
	fi
	if [[ -f ${CACHAINFILE} ]]; then
		c_revoked="Not_Revoked"
		c_valid="Valid"
		log "CACHAINFILE = ${CACHAINFILE}"
		old_IFS=$IFS
		IFS=$'\n' _TMP=($(openssl verify -CAfile ${CACHAINFILE} ${CERTIFICATE}))
		IFS=${old_IFS}
		for sslError in "${_TMP[@]}"; do
			if [[ $sslError == 'error'* ]]; then
				lwarn $sslError
				if [[ $sslError == 'error 23'* ]]; then
					c_revoked="Revoked"
				fi
				if [[ $sslError == 'error 20'* ]]; then
					c_valid="Invalid"
				fi
			fi
		done
	else
		log "CACHAINFILE file not found: ${CACHAINFILE}"
	fi
	if [[ ! -z ${getAuthor} ]]; then
		c_author=$(${SVN} blame --xml ${CERTIFICATE} | ${XML} sel -t -m "//entry[1]/commit" -v "author" -n)
	fi
}


function showCertificateInfo() {
	local cdate=$(fromSerialDate ${c_create_date})
	local edate=$(fromSerialDate ${c_expire_date})
	if [[ ${OUTFORMAT} == "CSV" ]]; then
		echo -e "\"${CERTIFICATE}\"${DLMT}${c_serial}${DLMT}\"${c_DN}\"${DLMT}${c_revoked}${DLMT}${c_valid}${DLMT}${cDaysToExpire}${DLMT}${edate}${DLMT}${cdate}"
	elif [[ ${OUTFORMAT} == "JSON" ]]; then
		echo "{"
		echo " \"File_name\"   : \"${CERTIFICATE}\","
		echo " \"Author\"      : \"${c_author}\","
		echo " \"Serial\"      : \"${c_serial}\","
		echo " \"DN\"          : \"${c_DN}\","
		echo " \"Created\"     : \"${cdate}\","
		echo " \"Expires\"     : \"${edate}\","
		echo " \"Expires_days\": ${cDaysToExpire},"
		echo " \"Revocation\"  : \"${c_revoked}\","
		echo " \"Validity\"    : \"${c_valid}\""
		echo "}"
	else
		echo "Certificate : $(basename ${CERTIFICATE})"
		echo "Author      : ${c_author}"
		echo "Serial      : ${c_serial}"
		echo "DN          : ${c_DN}"
		echo "Created     : ${cdate}"
		echo "Expires     : ${edate}"
		echo "Expires_days: ${cDaysToExpire}"
		echo "Revocation  : ${c_revoked}"
		echo "Validity    : ${c_valid}"
	fi
}


function showHeader() {
	if [[  ${OUTFORMAT} == "JSON" ]]; then
		echo "{\"what\":\"Certificate Status\","
		echo " \"Generated\":\"$(date +${dateformat_out})\","
		echo " \"content\":["
	else
		echo -e "File${DLMT}Serial${DLMT}DN${DLMT}Revoked${DLMT}Validity${DLMT}Expire_days${DLMT}Expires${DLMT}Created"
	fi
}


function showFooter() {
	if [[ ${OUTFORMAT} == "JSON" ]]; then
		echo "]}"
	fi
}

# Create an event for a .ics file
# input: serial_date, description
function serialDateToVCalendar() {
    cat << EOF
BEGIN:VEVENT
DTSTAMP:$(date -u "+%Y%m%dT%H%M%SZ")
DTSTART;VALUE=DATE:$(fromSerialDate ${1} "%Y%m%d")
SUMMARY:${2}
UID:$(uuidgen)@dataone.org
END:VEVENT
EOF
}


function generateEventCalendar() {
	# Create calendar with events:
	# - Certificate revocation update date
	# - Expiration dates for certificates
	local c_file="${APPDIR}/${CERT_ENVIRONMENT}_events.ics"
	log "Generating calendar file ${c_file}"
    printf "BEGIN:VCALENDAR\n" > ${c_file}
    printf "VERSION:2.0\n" >> ${c_file}
    printf "PRODID:-//DataONE.org//${APPNAME} v${VERSION}//${CERT_ENVIRONMENT}//EN\n" >> ${c_file}

    #Each certificate
    CERTIFICATES=$(find -L "${CERT_FOLDER}/certs" -name "*.pem")
    for CERTIFICATE in ${CERTIFICATES}; do
    	#get certificate info and generate event
    	getCertificateInfo
    	if [[ ${c_revoked} == "Not_Revoked" ]]; then
    		log "${c_DN} expires $(fromSerialDate ${c_expire_date})"
			ICAL_EVENT=$(serialDateToVCalendar "${c_expire_date}" \
				"${CERT_ENVIRONMENT} Cert ${c_DN} expires.\nSerial:${c_serial}")
			printf "${ICAL_EVENT}\n" >> ${c_file}
		fi
    done

    #Close calendar
    printf "END:VCALENDAR" >> ${c_file}
}


#=== Main ===
while getopts "hHvdVsnSAPL:a:c:C:e:" OPTION
do
	case ${OPTION} in
		h) usage; exit 1;;
		H) usageExamples; exit 1;;
		v) showVersion; exit 1;;
		d) DUMPCERT=1;;
		V) VERBOSE=1;;
		a) CACERT=$OPTARG;;
		c) CAROOTCERT=$OPTARG;;
		C) CACHAINFILE=$OPTARG;;
		s) OUTFORMAT="CSV";;
		n) OUTFORMAT="HUMAN";;
		S) showHeader; exit 1;;
		A) getAuthor=1;;
    e) expire_within=$OPTARG;;
		P) CERT_ENVIRONMENT="Prod";
		   CERT_FOLDER="${PROD_INT_FOLDER}";
		   CAROOTCERT="${PROD_CAROOTCERT}";
		   CACERT="${PROD_CACERT}";;
		L) GENERATE_CALENDAR=1;;
		\?) usage; exit 1;;
	esac
done

shift $(($OPTIND - 1))
if [[ -z ${1} ]]; then
	lwarn "Certificate file name or folder is required"
	lwarn "Defaulting to the ${CERT_ENVIRONMENT} environment."
	TARGET="${CERT_FOLDER}/certs"
else
	TARGET=${1}
fi
if [[ ! -z ${GENERATE_CALENDAR} ]]; then
	generateEventCalendar
	exit 0;
fi
if [[ -f ${TARGET} ]]; then
	# Report on single certificate
	CERTIFICATE=${TARGET}
	log "Certificate file: ${CERTIFICATE}"
	if [[ ! -z ${DUMPCERT} ]]; then
		DUMPCERTificate
		exit 0;
	fi
	getCertificateInfo
	showCertificateInfo
	exit 0;
else
	if [[ -d ${TARGET} ]]; then
		# Report on *.pem in folder
		_starter=""
		showHeader
		CERTIFICATES=$(find -L ${TARGET} -name "*.pem")
		for CERTIFICATE in ${CERTIFICATES}; do
			log "Certificate file: ${CERTIFICATE}"
			getCertificateInfo
      if [[ "${cDaysToExpire}" < "${expire_within}" ]] && [[ "${cDaysToExpire}" > "-${expire_within}" ]]; then
        if [[ -n ${_starter} ]]; then
          if [[ ${OUTFORMAT} == "JSON" ]]; then
            echo ","
          fi
        fi
  			showCertificateInfo
      fi
			_starter="1"
		done
		showFooter
	else
		lerror "Supplied target is not a file or folder"
		exit 1;
	fi
fi