def update(self):
        """Fetch the certificate information."""
        try:
            ctx = ssl.create_default_context()
            sock = ctx.wrap_socket(
                socket.socket(), server_hostname=self.server_name)
            sock.settimeout(TIMEOUT)
            sock.connect((self.server_name, self.server_port))
        except socket.gaierror:
            _LOGGER.error("Cannot resolve hostname: %s", self.server_name)
            return
        except socket.timeout:
            _LOGGER.error(
                "Connection timeout with server: %s", self.server_name)
            return
        except OSError:
            _LOGGER.error("Cannot connect to %s", self.server_name)
            return

        try:
            cert = sock.getpeercert()
        except OSError:
            _LOGGER.error("Cannot fetch certificate from %s", self.server_name)
            return

        ts_seconds = ssl.cert_time_to_seconds(cert['notAfter'])
        timestamp = datetime.datetime.fromtimestamp(ts_seconds)
        expiry = timestamp - datetime.datetime.today()
        self._state = expiry.days

 def probe(self):
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.settimeout(self.timeout)
     ssl_sock = ssl.wrap_socket(s)
     try:
         ssl_sock.connect((self.domain, self.port))
         addr = ssl_sock.getpeername()
         certificate = ssl.get_server_certificate(addr=addr)
     except socket.timeout:
         raise IOError("timeout connecting to %s" % self.domain)
     except:
         # provide a nice error message to caller
         raise IOError("cannot connect to %s" % self.domain)
     finally:
         ssl_sock.close()
     p1 = subprocess.Popen(["openssl", "x509", "-noout", "-enddate"],
                           stdin=subprocess.PIPE,
                           stdout=subprocess.PIPE)
     stdout, _ = p1.communicate(certificate)
     _, expirydate = stdout.split("=")
     expiry_date_in_seconds = ssl.cert_time_to_seconds(expirydate.strip())
     expiry_in_seconds = timedelta_to_seconds(datetime.fromtimestamp(expiry_date_in_seconds) - datetime.now())
     return nagiosplugin.Metric("expiry",
                                value=expiry_in_seconds,
                                uom="s",
                                context="certificate_expiry")

 def check_ssl_valid_date(self, url_data, cert):
     """Check if the certificate is still valid, or if configured check
     if it's at least a number of days valid.
     """
     import ssl
     try:
         notAfter = ssl.cert_time_to_seconds(cert['notAfter'])
     except ValueError as msg:
         msg = _('Invalid SSL certficate "notAfter" value %r') % cert['notAfter']
         url_data.add_warning(msg)
         return
     curTime = time.time()
     # Calculate seconds until certifcate expires. Can be negative if
     # the certificate is already expired.
     secondsValid = notAfter - curTime
     args = dict(expire=cert['notAfter'])
     if secondsValid < 0:
         msg = _('SSL certficate is expired on %(expire)s.')
         url_data.add_warning(msg % args)
     else:
         args['valid'] = strformat.strduration_long(secondsValid)
         if secondsValid < self.warn_ssl_cert_secs_valid:
             msg = _('SSL certificate expires on %(expire)s and is only %(valid)s valid.')
             url_data.add_warning(msg % args)
         else:
             msg = _('SSL certificate expires on %(expire)s and is %(valid)s valid.')
             url_data.add_info(msg % args)

 def from_ssl_socket(cls, ssl_socket):
     """Load certificate data from an SSL socket.
     """
     cert = cls()
     try:
         data = ssl_socket.getpeercert()
     except AttributeError:
         # PyPy doesn't have .getppercert
         return cert
     logger.debug("Certificate data from ssl module: {0!r}".format(data))
     if not data:
         return cert
     cert.validated = True
     cert.subject_name = data.get("subject")
     cert.alt_names = defaultdict(list)
     if "subjectAltName" in data:
         for name, value in data["subjectAltName"]:
             cert.alt_names[name].append(value)
     if "notAfter" in data:
         tstamp = ssl.cert_time_to_seconds(data["notAfter"])
         cert.not_after = datetime.utcfromtimestamp(tstamp)
     if sys.version_info.major < 3:
         cert._decode_names()  # pylint: disable=W0212
     cert.common_names = []
     if cert.subject_name:
         for part in cert.subject_name:
             for name, value in part:
                 if name == "commonName":
                     cert.common_names.append(value)
     return cert

 def is_ssl_expiring(self, ip_address, port=443, ssl_expiration_days=0):
     # Check site's cert
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     ssl_sock = ssl.wrap_socket(s, ca_certs=get_certs_file(), cert_reqs=ssl.CERT_REQUIRED)
     try:
         ssl_sock.connect((ip_address, port))
         cert = ssl_sock.getpeercert()
         cert_expiration = ssl.cert_time_to_seconds(cert["notAfter"])
         exp = cert_expiration - time.time()
         if exp <= 0: return 1
         elif exp <= (ssl_expiration_days * 24 * 60 * 60): return 2
     except:
         return 3
     finally:
         ssl_sock.shutdown(socket.SHUT_RDWR)
         ssl_sock.close()
     return 0

def gen_gmtime_dates():
	""" Generate the dates used for this run.
	Creating openssl gmtime dates may be simpler than this.
	"""
	gmtfmt = "%b %d %H:%M:%S %Y GMT"

	ok_stamp = ssl.cert_time_to_seconds(
			time.strftime(gmtfmt, time.gmtime())) - (60*60*24)
	two_days_ago_stamp = ok_stamp - (60*60*48)
	two_days_ago_end_stamp = two_days_ago_stamp + (60*60*24)
	future_stamp = ok_stamp + (60*60*24*365*1)
	future_end_stamp = future_stamp + (60*60*24*365*1)

	return dict(OK_NOW=gmc(ok_stamp),
				OLD=gmc(two_days_ago_stamp),
				OLD_END=gmc(two_days_ago_end_stamp),
			    FUTURE=gmc(future_stamp),
				FUTURE_END=gmc(future_end_stamp))

 def _validate_certificate(self, cert):
     now = time.time()
     # Refuse to connect if there's no certificate.
     if cert is None:
         err = "no SSL certificate for %s" % (self.host,)
         raise socket.error(err)
     # Refuse to connect if the certificate has expired.
     if "notAfter" in cert:
         if ssl.cert_time_to_seconds(cert["notAfter"]) < now:
             err = "expired SSL certificate for %s" % (self.host,)
             raise socket.error(err)
     # Refuse to connect if the certificate is missing subject data.
     if "subject" not in cert:
         err = "malformed SSL certificate for %s" % (self.host,)
         raise socket.error(err)
     # Try to match the certificate to the requested host.
     if not self._validate_certificate_hostname(cert):
         err = "invalid SSL certificate for %s" % (self.host,)
         raise socket.error(err)

def gen_gmtime_dates():
	""" Generate the dates used for this run.
	Creating openssl gmtime dates may be simpler than this.
	"""
	gmtfmt = "%b %d %H:%M:%S %Y GMT"

	ok_stamp = ssl.cert_time_to_seconds(
			time.strftime(gmtfmt, time.gmtime())) - (60*60*24)
	two_days_ago_stamp = ok_stamp - (60*60*48)
	two_days_ago_end_stamp = two_days_ago_stamp + (60*60*24)
        # Make future certs only +300 days, so we have a time overlap
        # between currently valid certs (1 year) and these futuristic certs
	future_stamp = ok_stamp + (60*60*24*365*1)
	future_end_stamp = future_stamp + (60*60*24*365*2)

	return dict(OK_NOW=gmc(ok_stamp),
				OLD=gmc(two_days_ago_stamp),
				OLD_END=gmc(two_days_ago_end_stamp),
			    FUTURE=gmc(future_stamp),
				FUTURE_END=gmc(future_end_stamp))

def expiring_certificate(connection, expiry_days):
    '''
    Pass in the connection and number of days. Verify that the expiry date isn't
    within the specified number of days
    '''

    # Convert the presented certificate's expiry date into a datetime object.
    # This could be done in one line, but for readability, we'll do this over three

    expiry_date = connection.getpeercert()['notAfter']
    expiry_epoch = ssl.cert_time_to_seconds(expiry_date)
    expires = datetime.datetime.fromtimestamp(expiry_epoch)

    # Create a datetime object of the specified date
    now = datetime.datetime.now()
    specified_date = now + datetime.timedelta(days=expiry_days)

    # this evalutes to True if the certificate expires before the specified
    # expiry date.

    return expires < specified_date

 def check_ssl_valid_date(self, url_data, ssl_sock, cert):
     """Check if the certificate is still valid, or if configured check
     if it's at least a number of days valid.
     """
     import ssl
     try:
         notAfter = ssl.cert_time_to_seconds(cert['notAfter'])
     except ValueError as msg:
         msg = _('invalid certficate "notAfter" value %r') % cert['notAfter']
         self.add_ssl_warning(url_data, ssl_sock, msg)
         return
     curTime = time.time()
     # Calculate seconds until certifcate expires. Can be negative if
     # the certificate is already expired.
     secondsValid = notAfter - curTime
     if secondsValid < 0:
         msg = _('certficate is expired on %s') % cert['notAfter']
         self.add_ssl_warning(url_data, ssl_sock, msg)
     elif secondsValid < self.warn_ssl_cert_secs_valid:
         strSecondsValid = strformat.strduration_long(secondsValid)
         msg = _('certificate is only %s valid') % strSecondsValid
         self.add_ssl_warning(url_data, ssl_sock, msg)

    def __verifycert(self, cert, hostname):
        """Verify that cert (in socket.getpeercert() format) matches hostname.

        CRLs are not handled.
        Returns error message if any problems are found and None on success."""

        errstr = "CA Cert verifying failed: "
        if not cert:
            return ('%s no certificate received'% errstr)
        dnsname = hostname.lower()
        certnames = []

        # cert expired?
        notafter = cert.get('notAfter')
        if notafter:
            if time.time() >= cert_time_to_seconds(notafter):
                return '%s certificate expired %s'% (errstr, notafter)

        # First read commonName
        for s in cert.get('subject', []):
            key, value = s[0]
            if key == 'commonName':
                certnames.append(value.lower())
        if len(certnames) == 0:
            return ('%s no commonName found in certificate'% errstr)

        # Then read subjectAltName
        for key, value in cert.get('subjectAltName', []):
            if key == 'DNS':
                certnames.append(value.lower())

        # And finally try to match hostname with one of these names
        for certname in certnames:
            if (certname == dnsname or
                '.' in dnsname and certname == '*.' + dnsname.split('.', 1)[1]):
                return None

        return ('%s no matching domain name found in certificate'% errstr)

def check_validation(host):
	now = time.time()

	context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
	context.verify_mode = ssl.CERT_REQUIRED
	context.check_hostname = True
	context.load_default_certs()

	conn = context.wrap_socket(socket.socket(socket.AF_INET),server_hostname=host)
	conn.connect((host, 443))
	cert = conn.getpeercert()

	ttl = ssl.cert_time_to_seconds(cert['notAfter']) - now
	print(ttl)
	print(ttl/3600/24)

	k = host.split('.')[0]
	if ttl < 0:
		push_metrics("trapper.ssl-certificate.{0}.valid".format(k), 2)
	else:
		push_metrics("trapper.ssl-certificate.{0}.valid".format(k), 1)

	push_metrics("trapper.ssl-certificate.{0}.days".format(k), round(ttl/3600/24, 2))

    def _cert_expiration_analysis(self, url, domain):
        cert, cert_der, cipher = self._get_cert(url, domain)

        try:
            exp_date = gmtime(ssl.cert_time_to_seconds(cert['notAfter']))
        except ValueError:
            msg = 'Invalid SSL certificate date format.'
            om.out.debug(msg)
        except KeyError:
            msg = 'SSL certificate does not have notAfter field.'
            om.out.debug(msg)
        else:
        
            expire_days = (date(exp_date.tm_year, exp_date.tm_mon,
                           exp_date.tm_mday) - date.today()).days
            
            if expire_days < self._min_expire_days:
                desc = 'The certificate for "%s" will expire soon.' % domain
                
                i = Info('Soon to expire SSL certificate', desc, 1, self.get_name())
                i.set_url(url)
                
                self.kb_append(self, 'ssl_soon_expire', i)

    def _verifycert(self, cert, hostname):
        """Verify that cert (in socket.getpeercert() format) matches hostname.
        CRLs are not handled.
        
        Returns error message if any problems are found and None on success.
        """
        if not cert:
            return "no certificate received"
        dnsname = hostname.lower()
        certnames = []

        # cert expired?
        notafter = cert.get("notAfter")
        if notafter:
            if time.time() >= ssl.cert_time_to_seconds(notafter):
                return ("server certificate error: certificate expired %s") % notafter

        # First read commonName
        for s in cert.get("subject", []):
            key, value = s[0]
            if key == "commonName":
                certnames.append(value.lower())
        if len(certnames) == 0:
            return "no commonName found in certificate"

        # Then read subjectAltName
        for key, value in cert.get("subjectAltName", []):
            if key == "DNS":
                certnames.append(value.lower())

        # And finally try to match hostname with one of these names
        for certname in certnames:
            if certname == dnsname or "." in dnsname and certname == "*." + dnsname.split(".", 1)[1]:
                return None

        return "no matching domain name found in certificate"

            v.set_url(url)
            
            self.kb_append(self, tag, v)
            return

        except Exception, e:
            om.out.debug(str(e))
            return

        cert = ssl_sock.getpeercert()
        cert_der = ssl_sock.getpeercert(binary_form=True)
        cipher = ssl_sock.cipher()
        ssl_sock.close()

        exp_date = gmtime(ssl.cert_time_to_seconds(cert['notAfter']))
        expire_days = (date(exp_date.tm_year, exp_date.tm_mon,
                       exp_date.tm_mday) - date.today()).days
        if expire_days < self._min_expire_days:
            desc = 'The certificate for "%s" will expire soon.' % domain
            
            i = Info('Soon to expire SSL certificate', desc, 1, self.get_name())
            i.set_url(url)
            
            self.kb_append(self, 'ssl_soon_expire', i)

        # Print the SSL information to the log
        desc = 'This is the information about the SSL certificate used for'\
               ' %s site:\n%s' % (domain,
                                  self._dump_ssl_info(cert, cert_der, cipher))
        om.out.information(desc)

#   limitations under the License.

import argparse
import socket
import ssl
import time

if __name__ == '__main__':
  parser = argparse.ArgumentParser(description=('A script that checks certificate '
                                                'freshness'))
  parser.add_argument('hostname', type=str, help='hostname for a SSL server')
  parser.add_argument('--port', '-p', help='port', default='443')
  parser.add_argument('--original', '-o', help='show original longevity instead',
                      action='store_true')

  args = parser.parse_args()

  ssl_sock = ssl.wrap_socket(socket.socket(socket.AF_INET, socket.SOCK_STREAM),
                             ca_certs='/etc/ssl/certs/ca-certificates.crt',
                             cert_reqs=ssl.CERT_REQUIRED)
  ssl_sock.connect((args.hostname, int(args.port)))

  notAfter = ssl.cert_time_to_seconds(ssl_sock.getpeercert()['notAfter'])
  day = 60 * 60 * 24
  if args.original:
    notBefore = ssl.cert_time_to_seconds(ssl_sock.getpeercert()['notBefore'])
    print (int((notAfter - notBefore) / day))
  else:
    t = time.time()
    print(int((notAfter - t) / day))

#.........这里部分代码省略.........


        # Path validation that ran into errors
        for ((store_name, store_version), error_msg) in verify_dict_error.iteritems():
            verify_txt = 'ERROR: ' + error_msg
            text_output.append(self.FIELD_FORMAT(self.TRUST_FORMAT(store_name=store_name,
                                                                   store_version=store_version),
                                                 verify_txt))

        # Print the Common Names within the certificate chain
        cns_in_cert_chain = []
        for cert in x509_cert_chain:
            cert_identity = self._extract_subject_cn_or_oun(cert)
            cns_in_cert_chain.append(cert_identity)

        text_output.append(self.FIELD_FORMAT('Certificate Chain Received:', str(cns_in_cert_chain)))


        # Text output - OCSP stapling
        text_output.extend(['', self.PLUGIN_TITLE_FORMAT('Certificate - OCSP Stapling')])
        text_output.extend(self._get_ocsp_text(ocsp_response))


        # XML output
        xml_output = Element(command, argument=arg, title='Certificate Information')

        # XML output - certificate chain:  always return the full certificate for each cert in the chain
        cert_chain_xml = Element('certificateChain')

        # XML output - expiration date

        # em begin
        cert_dict = x509_cert.as_dict()
        expiration_date = gmtime(cert_time_to_seconds(cert_dict['validity']['notAfter']))
        expire_days = (date(expiration_date.tm_year, expiration_date.tm_mon, expiration_date.tm_mday) - date.today()).days
        expiration_date_xml = Element("expirationDate", notAfter=cert_dict['validity']['notAfter'],
                                      expiresDays=expire_days)
        xml_output.append(expiration_date_xml)
        # em end

        # First add the leaf certificate
        cert_chain_xml.append(self._format_cert_to_xml(x509_cert_chain[0], 'leaf', self._shared_settings['sni']))

        # Then add every other cert in the chain
        for cert in x509_cert_chain[1:]:
            cert_chain_xml.append(self._format_cert_to_xml(cert, 'intermediate', self._shared_settings['sni']))

        xml_output.append(cert_chain_xml)

        # XML output - trust
        trust_validation_xml = Element('certificateValidation')

        # Hostname validation
        is_hostname_valid = 'False' if (x509_cert.matches_hostname(host) == X509_NAME_MISMATCH) else 'True'
        host_validation_xml = Element('hostnameValidation', serverHostname=host,
                                      certificateMatchesServerHostname=is_hostname_valid)
        trust_validation_xml.append(host_validation_xml)

        # Path validation - OK
        for ((store_name, store_version), verify_str) in verify_dict.iteritems():
            path_attrib_xml = {
                'usingTrustStore': store_name,
                'trustStoreVersion': store_version,
                'validationResult': verify_str
            }

            v.setPluginName(self.getName())
            v.setURL(url)
            kb.kb.append(self, tag, v)
            om.out.vulnerability(v.getName() + ": " + v.getDesc())
            return

        except Exception, e:
            om.out.debug(str(e))
            return

        cert = ssl_sock.getpeercert()
        cert_der = ssl_sock.getpeercert(binary_form=True)
        cipher = ssl_sock.cipher()
        ssl_sock.close()

        exp_date = gmtime(ssl.cert_time_to_seconds(cert["notAfter"]))
        expire_days = (date(exp_date.tm_year, exp_date.tm_mon, exp_date.tm_mday) - date.today()).days
        if expire_days < self._min_expire_days:
            i = info.info()
            i.setURL(url)
            i.setPluginName(self.getName())
            i.setName("Soon expire SSL certificate")
            i.setDesc('The certificate for "%s" will expire soon.' % domain)
            kb.kb.append(self, "ssl_soon_expire", i)
            om.out.information(i.getDesc())

        # Print the SSL information to the log
        desc = "This is the information about the SSL certificate used in the target site:\n"
        desc += self._dump_ssl_info(cert, cert_der, cipher)
        om.out.information(desc)
        i = info.info()