Check TLS certificate expiry for a list of hosts (Bash)

The script

#!/usr/bin/env bash
# check-cert-expiry.sh: report how many days are left on TLS certificates.
#
# Usage: check-cert-expiry.sh [-w DAYS] HOST[:PORT]...
#   -w DAYS   warn when a certificate expires within DAYS (default 30)
#   HOST      a host name; the port defaults to 443
#
# Exit codes: 0 all fine, 1 a certificate is expiring or could not be read,
# 2 bad usage. Read-only: it only opens a TLS connection.
set -euo pipefail

usage() { sed -n '4,6p' "$0" | sed 's/^# \{0,1\}//'; }

warn_days=30
while getopts ':w:h' opt; do
  case "$opt" in
    w) warn_days="$OPTARG" ;;
    h) usage; exit 0 ;;
    *) usage >&2; exit 2 ;;
  esac
done
shift $((OPTIND - 1))

[[ "$warn_days" =~ ^[0-9]+$ ]] || { echo "Error: -w must be a whole number" >&2; exit 2; }
[[ $# -gt 0 ]] || { usage >&2; exit 2; }

status=0
now=$(date +%s)
for target in "$@"; do
  host="${target%%:*}"
  port="${target##*:}"
  [[ "$target" == *:* ]] || port=443

  end_date=$(timeout 15 openssl s_client -connect "$host:$port" -servername "$host" \
      </dev/null 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2) || true

  if [[ -z "$end_date" ]]; then
    echo "ERROR    $host:$port  could not read a certificate"
    status=1
    continue
  fi

  days_left=$(( ($(date -d "$end_date" +%s) - now) / 86400 ))
  if (( days_left < 0 )); then
    echo "EXPIRED  $host:$port  expired $(( -days_left )) days ago ($end_date)"
    status=1
  elif (( days_left < warn_days )); then
    echo "WARN     $host:$port  expires in $days_left days ($end_date)"
    status=1
  else
    echo "OK       $host:$port  expires in $days_left days ($end_date)"
  fi
done
exit "$status"

Run it

./check-cert-expiry.sh example.com mail.example.com:993
./check-cert-expiry.sh -w 14 $(cat hosts.txt)

How it works