To check Certificates in the Java Key Store:
#!/bin/bash
# Nagios plugin to check the expiration dates
# of Java Cert keystores
# Set up some variables
# Todays date expressed in Epoch time "seconds since 1970-01-01 00:00:00 UTC"
TODAY=`date +"%s"`
critical=$2
warning=$1
c_flag=0
w_flag=0
OK=0
WARNING=1
CRITICAL=2
UNKNOWN=3
count1=0
count2=0
diffdays_c="in"
diffdays_w="in"
# keytool location and command line
# keytool normally lives here - /opt/java/x64/jdk1.6.0_18/bin/keytool
KEYTOOL="/opt/java/x64/jdk1.6.0_18/bin/keytool"
# Keystore varies depending on application. The below example is from prod
# It can normally be found here /opt/apps/<APPLICATION>/conf/TrustStore_PROD.ks
KEYSTORE="/opt/apps/cmc-clientverification02/conf/TrustStore_PROD.ks"
# Keystore password
KEYPASS="changeit"
# So first we go and get the cert experation dates from the keystore using the
# keytool
`$KEYTOOL -list -v -storepass $KEYPASS -keystore $KEYSTORE | grep Valid | awk '{print $10,$11,$12,$13,$15}' > /tmp/cert.txt`
if [ -s /tmp/cert.txt ];then
lastrun=`echo $?`
if [ $lastrun -eq 0 ]; then
while read line
do
certepoch=`date --date="$line" "+%s"`
diff=$(($certepoch - $TODAY))
diff_days=$(($diff / 86400))
if [ $diff_days -le $critical ];then
#echo "CRITICAL:Certificate will expire in $diff_days days"
c_flag=2
count2=$((count2 + 1))
diffdays_c="$diffdays_c $diff_days"
#exit $CRITICAL
fi
if [ $diff_days -ge $critical ] && [ $diff_days -le $warning ];then
#echo "WARNING:Certificate will expire in $diff_days"
w_flag=1
count1=$((count1 + 1))
diffdays_w="$diffdays_w $diff_days"
#exit $WARNING
fi
done < /tmp/cert.txt
else
echo "UNKNOWN: check the command executing manually"
exit $UNKNOWN
fi
if [ $c_flag -eq $CRITICAL ] && [ $w_flag -eq $WARNING ];then
echo "CRITICAL:There are $count2 certificates getting expired $diffdays_c days"
echo "and certificate in WARNING:There are $count1 certificates getting expired $diffdays_w days"
exit $CRITICAL
fi
if [ $c_flag -eq $CRITICAL ];then
echo "CRITICAL:There are $count2 certificates getting expired $diffdays_c days"
exit $CRITICAL
fi
if [ $w_flag -eq $WARNING ];then
echo "WARNING:There are $count1 certificates getting expired $diffdays_w days"
exit $WARNING
fi
if [ $c_flag -eq $OK ] && [ $w_flag -eq $OK ];then
echo "OK:There are no certificates getting expired."
exit $OK
fi
else
echo "Try running the Keytool command manually, ther might be a chance that there are no certificates"
exit $CRITICAL
fi
