Golang实现检测SSL证书有效期

package main

import (
	"crypto/tls"
	"fmt"
)

func main() {
	conn, _ := tls.Dial("tcp", "www.baidu.com:443", nil)
	cert := conn.ConnectionState().PeerCertificates[0]

	// 时间信息
	fmt.Printf("NotBefore: %v\n", cert.NotBefore)
	// NotBefore: 2022-07-05 05:16:02 +0000 UTC

	fmt.Printf("NotAfter: %v\n", cert.NotAfter)
	// NotAfter: 2023-08-06 05:16:01 +0000 UTC

	// 其他信息
	fmt.Printf("IPAddresses: %v\n", cert.IPAddresses)
	// IPAddresses: []
	fmt.Printf("IPAddresses: %v\n", conn.RemoteAddr())
	// IPAddresses: 220.181.38.150:443
	fmt.Printf("Version: %v\n", cert.Version)
	fmt.Printf("SerialNumber: %v\n", cert.SerialNumber)
	fmt.Printf("Issuer: %v\n", cert.Issuer)
	fmt.Printf("Subject: %v\n", cert.Subject)
}

package main
import (
    "crypto/tls"
    "fmt"
    "net"
    "time"
)
// CheckSSLCertExpiry 检查给定域名的 SSL 证书有效期，返回剩余天数
func CheckSSLCertExpiry(domain string) (int, error) {
    // 1. 配置 tls.Config
    // InsecureSkipVerify: true 用来绕过证书本身的校验，否则证书过期或无效时连接会失败，我们反而拿不到证书信息。
    // ServerName: 显式设置 SNI，对于使用 CDN 的网站尤其重要，以防止获取到错误的默认证书。
    conf := &tls.Config{
        InsecureSkipVerify: true,
        ServerName:         domain,
    }
    // 2. 建立 TLS 连接
    // 设置一个连接超时，防止网络问题导致程序长时间阻塞。
    dialer := &net.Dialer{Timeout: 10 * time.Second}
    conn, err := tls.DialWithDialer(dialer, "tcp", fmt.Sprintf("%s:443", domain), conf)
    if err != nil {
        return 0, fmt.Errorf("failed to connect to %s: %w", domain, err)
    }
    defer conn.Close()
    // 3. 获取证书链
    // PeerCertificates 返回的是对端发送的证书链，第一个元素 (索引0) 通常是服务器本身的证书（叶子证书）。
    certs := conn.ConnectionState().PeerCertificates
    if len(certs) == 0 {
        return 0, fmt.Errorf("no certificates found for %s", domain)
    }
    leafCert := certs[0]
    // 4. 计算剩余天数
    // NotAfter 是 UTC 时间，time.Now() 返回的是本地时间，但 Go 的 time 包在比较时会自动转换到同一时区，所以直接相减是安全的。
    // 使用 math.Ceil 确保剩余天数向上取整，避免因精度问题将 "剩余0.9天" 显示为 "0天"。
    remaining := time.Until(leafCert.NotAfter)
    days := int(remaining.Hours() / 24)
    if remaining.Hours() > 0 && days == 0 {
        days = 1
    }
    return days, nil
}
func main() {
    // 示例：检查 example.com 的证书有效期
    domain := "www.baidu.com"
    days, err := CheckSSLCertExpiry(domain)
    if err != nil {
        fmt.Printf("Error: %v\n", err)
        return
    }
    fmt.Printf("SSL certificate for %s is valid for %d more days.\n", domain, days)
}

package main
import (
    "crypto/x509"
    "encoding/pem"
    "fmt"
    "io/ioutil"
    "time"
)
func main() {
    certPEM, err := ioutil.ReadFile("path/to/certificate.pem")
    if err != nil {
        fmt.Println("Error reading certificate file:", err)
        return
    }
    block, _ := pem.Decode(certPEM)
    if block == nil {
        fmt.Println("Failed to parse certificate PEM")
        return
    }
    cert, err := x509.ParseCertificate(block.Bytes)
    if err != nil {
        fmt.Println("Error parsing certificate:", err)
        return
    }
    fmt.Println("Certificate Expiry Date:", cert.NotAfter)
    now := time.Now()
    if now.Before(cert.NotBefore) {
        fmt.Println("Certificate is not yet valid")
    } else if now.After(cert.NotAfter) {
        fmt.Println("Certificate has expired")
    } else {
        fmt.Println("Certificate is valid")
    }
}

func GetDomainSslExpireDate(domain string) string {
	if !strings.HasPrefix(domain, "http") {
		domain = fmt.Sprint("https://", domain)
	}
	command := fmt.Sprint("curl -v -I -k ", domain)
	cmd := exec.Command("/bin/bash", "-c", command)
	output, err := cmd.CombinedOutput()
	if err != nil {
		return time.Time{}
	}
	outStr := string(output)
	outArr := strings.Split(outStr, "\n")
	for _, out := range outArr {
		if strings.Contains(out, "expire date") {
			return out[strings.Index(out, ":")+1:]
			return StrToDate(dateStr)
		}
	}
	return ""
}