Add a cron job to check SSL certificate validity

diff --git a/cookbooks/letsencrypt/files/default/bin/check-certificate b/cookbooks/letsencrypt/files/default/bin/check-certificate
new file mode 100755 (executable)
index 0000000..46ca8e8
--- /dev/null
+++ b/cookbooks/letsencrypt/files/default/bin/check-certificate
@@ -0,0 +1,36 @@
+#!/usr/bin/ruby
+
+require "net/http"
+
+domain = ARGV.first
+
+begin
+  connection = Net::HTTP.start(domain, :use_ssl => true)
+  certificate = connection.peer_cert
+
+  if Time.now < certificate.not_before
+    puts "Certificate #{domain} not valid until #{certificate.not_before}"
+  elsif certificate.not_after - Time.now < 14 * 86400
+    puts "Certificate #{domain} expires at #{certificate.not_after}"
+  else
+    subject_alt_name = certificate.extensions.find { |e| e.oid == "subjectAltName" }
+
+    if subject_alt_name.nil?
+      puts "Certificate #{domain} has no subject_alt_name"
+    else
+      alt_names = subject_alt_name.value.split(/\s*,\s*/).sort
+
+      ARGV.sort.each do |expected|
+        puts "Certificate #{domain} is missing subject_alt_name #{expected}" unless alt_names.shift == "DNS:#{expected}"
+      end
+
+      alt_names.each do |name|
+        puts "Certificate #{domain} has unexpected altName #{name}"
+      end
+    end
+  end
+
+  connection.finish
+rescue OpenSSL::SSL::SSLError => error
+  puts "Error connecting to #{domain}: #{error.message}"
+end

diff --git a/cookbooks/letsencrypt/recipes/default.rb b/cookbooks/letsencrypt/recipes/default.rb
index 8f9564457835e4857aa6e265c545ddcd37e27bbf..a2c42e1c5cfe1f18dbdb684e227be8c4c1586c85 100644 (file)
--- a/cookbooks/letsencrypt/recipes/default.rb
+++ b/cookbooks/letsencrypt/recipes/default.rb
@@ -143,6 +143,14 @@ certificates.each do |name, details|
   end
 end
 
+template "/srv/acme.openstreetmap.org/bin/check-certificates" do
+  source "check-certificates.erb"
+  owner "root"
+  group "root"
+  mode 0o755
+  variables :certificates => certificates
+end
+
 template "/etc/cron.d/letsencrypt" do
   source "cron.erb"
   owner "root"

diff --git a/cookbooks/letsencrypt/templates/default/check-certificates.erb b/cookbooks/letsencrypt/templates/default/check-certificates.erb
new file mode 100644 (file)
index 0000000..d03e98a
--- /dev/null
+++ b/cookbooks/letsencrypt/templates/default/check-certificates.erb
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+<% @certificates.each_value do |certificate| -%>
+/srv/acme.openstreetmap.org/bin/check-certificate <%= certificate[:domains].join(" ") %>
+<% end -%>

diff --git a/cookbooks/letsencrypt/templates/default/cron.erb b/cookbooks/letsencrypt/templates/default/cron.erb
index fa89edaeaf1ed418cddb17fc9abcf7e91421b277..74a8ee0a252855813f2219f8f3a918ceec1748c9 100644 (file)
--- a/cookbooks/letsencrypt/templates/default/cron.erb
+++ b/cookbooks/letsencrypt/templates/default/cron.erb
@@ -2,4 +2,5 @@
 
 MAILTO=admins@openstreetmap.org
 
-0 */12 * * * letsencrypt /srv/acme.openstreetmap.org/bin/renew
+00 */12 * * * letsencrypt /srv/acme.openstreetmap.org/bin/renew
+30 */12 * * * letsencrypt /srv/acme.openstreetmap.org/bin/check-certificates