*** nagios-plugins-1.4.15/plugins/sslutils.c    2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/sslutils.c 2011-12-29 15:57:25.000000000 -0800
***************
*** 94,100 ****
    return SSL_read(s, buf, num);
  }
  
! int np_net_ssl_check_cert(int days_till_exp){
  #  ifdef USE_OPENSSL
    X509 *certificate=NULL;
    ASN1_STRING *tm;
--- 94,100 ----
    return SSL_read(s, buf, num);
  }
  
! int np_net_ssl_check_cert(int days_till_exp, int days_till_exp_crit){
  #  ifdef USE_OPENSSL
    X509 *certificate=NULL;
    ASN1_STRING *tm;
***************
*** 154,171 ****
         stamp.tm_mon + 1,
         stamp.tm_mday, stamp.tm_year + 1900, stamp.tm_hour, stamp.tm_min);
  
!       if (days_left > 0 && days_left <= days_till_exp) {
!               printf (_("WARNING - Certificate expires in %d day(s) (%s).\n"), days_left, timestamp);
!               return STATE_WARNING;
!       } else if (time_left < 0) {
        printf (_("CRITICAL - Certificate expired on %s.\n"), timestamp);
        return STATE_CRITICAL;
    } else if (days_left == 0) {
        printf (_("WARNING - Certificate expires today (%s).\n"), timestamp);
        return STATE_WARNING;
    }
  
    printf (_("OK - Certificate will expire on %s.\n"), timestamp);
    X509_free (certificate);
    return STATE_OK;
  #  else /* ifndef USE_OPENSSL */
--- 154,175 ----
         stamp.tm_mon + 1,
         stamp.tm_mday, stamp.tm_year + 1900, stamp.tm_hour, stamp.tm_min);
  
!       if (time_left < 0) {
        printf (_("CRITICAL - Certificate expired on %s.\n"), timestamp);
        return STATE_CRITICAL;
+       } else if (days_till_exp_crit > 0 && days_left <= days_till_exp_crit) {
+               printf (_("CRITICAL - Certificate expires in %d day(s) (%s).\n"), days_left, timestamp);
+               return STATE_CRITICAL;
+       } else if (days_left > 0 && days_left <= days_till_exp) {
+               printf (_("WARNING - Certificate expires in %d day(s) (%s).\n"), days_left, timestamp);
+               return STATE_WARNING;
    } else if (days_left == 0) {
        printf (_("WARNING - Certificate expires today (%s).\n"), timestamp);
        return STATE_WARNING;
    }
  
    printf (_("OK - Certificate will expire on %s.\n"), timestamp);
+         printf (_("Days_left: %i; Days_till_exp_crit: %i\n"), days_left, days_till_exp_crit);
    X509_free (certificate);
    return STATE_OK;
  #  else /* ifndef USE_OPENSSL */
*** nagios-plugins-1.4.15/plugins/check_http.c  2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/check_http.c       2011-12-29 15:51:33.000000000 -0800
***************
*** 58,64 ****
  
  #ifdef HAVE_SSL
  int check_cert = FALSE;
! int days_till_exp;
  char *randbuff;
  X509 *server_cert;
  #  define my_recv(buf, len) ((use_ssl) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
--- 58,65 ----
  
  #ifdef HAVE_SSL
  int check_cert = FALSE;
! int days_till_exp = 0;
! int days_till_exp_crit = 0;
  char *randbuff;
  X509 *server_cert;
  #  define my_recv(buf, len) ((use_ssl) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
***************
*** 206,211 ****
--- 207,213 ----
      {"linespan", no_argument, 0, 'l'},
      {"onredirect", required_argument, 0, 'f'},
      {"certificate", required_argument, 0, 'C'},
+     {"certificatecrit", required_argument, 0, 'X'},
      {"useragent", required_argument, 0, 'A'},
      {"header", required_argument, 0, 'k'},
      {"no-body", no_argument, 0, 'N'},
***************
*** 235,241 ****
    }
  
    while (1) {
!     c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:e:p:s:R:r:u:f:C:nlLSm:M:N", longopts, &option);
      if (c == -1 || c == EOF)
        break;
  
--- 237,243 ----
    }
  
    while (1) {
!     c = getopt_long (argc, argv, "Vvh46t:c:w:A:k:H:P:j:T:I:a:b:e:p:s:R:r:u:f:C:X:nlLSm:M:N", longopts, &option);
      if (c == -1 || c == EOF)
        break;
  
***************
*** 291,305 ****
        display_html = FALSE;
        break;
      case 'C': /* Check SSL cert validity */
! #ifdef HAVE_SSL
        if (!is_intnonneg (optarg))
          usage2 (_("Invalid certificate expiration period"), optarg);
        else {
          days_till_exp = atoi (optarg);
          check_cert = TRUE;
        }
!      /* Fall through to -S option */
  #endif
      case 'S': /* use SSL */
  #ifndef HAVE_SSL
        usage4 (_("Invalid option - SSL is not available"));
--- 293,325 ----
        display_html = FALSE;
        break;
      case 'C': /* Check SSL cert validity */
! #ifndef HAVE_SSL
!       usage4 (_("Invalid option - SSL is not available"));
! #endif
        if (!is_intnonneg (optarg))
          usage2 (_("Invalid certificate expiration period"), optarg);
        else {
          days_till_exp = atoi (optarg);
          check_cert = TRUE;
        }
!       use_ssl = TRUE;
!       if (specify_port == FALSE)
!         server_port = HTTPS_PORT;
!       break;
!     case 'X': /* Check SSL cert validity and throw Critical */
! #ifndef HAVE_SSL
!       usage4 (_("Invalid option - SSL is not available"));
  #endif
+       if (!is_intnonneg (optarg))
+         usage2 (_("Invalid critical certificate expiration period"), optarg);
+       else {
+         days_till_exp_crit = atoi (optarg);
+         check_cert = TRUE;
+       }
+       use_ssl = TRUE;
+       if (specify_port == FALSE)
+         server_port = HTTPS_PORT;
+       break;
      case 'S': /* use SSL */
  #ifndef HAVE_SSL
        usage4 (_("Invalid option - SSL is not available"));
***************
*** 809,815 ****
    if (use_ssl == TRUE) {
      np_net_ssl_init_with_hostname(sd, (use_sni ? host_name : NULL));
      if (check_cert == TRUE) {
!       result = np_net_ssl_check_cert(days_till_exp);
        np_net_ssl_cleanup();
        if (sd) close(sd);
        return result;
--- 829,835 ----
    if (use_ssl == TRUE) {
      np_net_ssl_init_with_hostname(sd, (use_sni ? host_name : NULL));
      if (check_cert == TRUE) {
!       result = np_net_ssl_check_cert(days_till_exp, days_till_exp_crit);
        np_net_ssl_cleanup();
        if (sd) close(sd);
        return result;
***************
*** 1342,1347 ****
--- 1362,1371 ----
    printf (" %s\n", "-C, --certificate=INTEGER");
    printf ("   %s\n", _("Minimum number of days a certificate has to be valid. Port defaults to 443"));
    printf ("   %s\n", _("(when this option is used the URL is not checked.)\n"));
+   printf (" %s\n", "-X, --certificatecrit=INTEGER");
+   printf ("   %s\n", _("Minimum number of days a certificate has to be valid. Returns Critical."));
+   printf ("   %s\n", _("Port defaults to 443"));
+   printf ("   %s\n", _("(when this option is used the URL is not checked.)\n"));
  #endif
  
    printf (" %s\n", "-e, --expect=STRING");
***************
*** 1419,1429 ****
    printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
    printf (" %s\n\n", _("a STATE_CRITICAL will be returned."));
  
!   printf (" %s\n\n", "CHECK CERTIFICATE: check_http -H www.verisign.com -C 14");
    printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
    printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
    printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
!   printf (" %s\n", _("the certificate is expired."));
  #endif
  
    printf (UT_SUPPORT);
--- 1443,1453 ----
    printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
    printf (" %s\n\n", _("a STATE_CRITICAL will be returned."));
  
!   printf (" %s\n\n", "CHECK CERTIFICATE: check_http -H www.verisign.com -C 14 -X 7");
    printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
    printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
    printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
!   printf (" %s\n", _("the certificate is expired (if -X is not passed) or valid for fewer than 7 days."));
  #endif
  
    printf (UT_SUPPORT);
***************
*** 1441,1446 ****
    printf ("       [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport>]\n");
    printf ("       [-e <expect>] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]\n");
    printf ("       [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]\n");
!   printf ("       [-A string] [-k string] [-S] [--sni] [-C <age>] [-T <content-type>]\n");
!   printf ("       [-j method]\n");
  }
--- 1465,1470 ----
    printf ("       [-b proxy_auth] [-f <ok|warning|critcal|follow|sticky|stickyport>]\n");
    printf ("       [-e <expect>] [-s string] [-l] [-r <regex> | -R <case-insensitive regex>]\n");
    printf ("       [-P string] [-m <min_pg_size>:<max_pg_size>] [-4|-6] [-N] [-M <age>]\n");
!   printf ("       [-A string] [-k string] [-S] [--sni] [-C <age>] [-X <age>]\n");
!   printf ("       [-T <content-type>] [-j method]\n");
  }
*** nagios-plugins-1.4.15/plugins/check_smtp.c  2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/check_smtp.c       2011-12-29 16:03:04.000000000 -0800
***************
*** 41,47 ****
  
  #ifdef HAVE_SSL
  int check_cert = FALSE;
! int days_till_exp;
  #  define my_recv(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
  #  define my_send(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
  #else /* ifndef HAVE_SSL */
--- 41,48 ----
  
  #ifdef HAVE_SSL
  int check_cert = FALSE;
! int days_till_exp = 0;
! int days_till_exp_crit = 0;
  #  define my_recv(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
  #  define my_send(buf, len) ((use_ssl && ssl_established) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
  #else /* ifndef HAVE_SSL */
***************
*** 271,277 ****
  
  #  ifdef USE_OPENSSL
          if ( check_cert ) {
!                   result = np_net_ssl_check_cert(days_till_exp);
            if(result != STATE_OK){
              printf ("%s\n", _("CRITICAL - Cannot retrieve server certificate."));
            }
--- 272,278 ----
  
  #  ifdef USE_OPENSSL
          if ( check_cert ) {
!                   result = np_net_ssl_check_cert(days_till_exp, days_till_exp_crit);
            if(result != STATE_OK){
              printf ("%s\n", _("CRITICAL - Cannot retrieve server certificate."));
            }
***************
*** 476,481 ****
--- 477,483 ----
        {"help", no_argument, 0, 'h'},
        {"starttls",no_argument,0,'S'},
        {"certificate",required_argument,0,'D'},
+               {"certificatecrit",required_argument,0,'X'},
        {0, 0, 0, 0}
    };
  
***************
*** 492,498 ****
    }
  
    while (1) {
!               c = getopt_long (argc, argv, "+hVv46t:p:f:e:c:w:H:C:R:SD:F:A:U:P:",
                         longopts, &option);
  
        if (c == -1 || c == EOF)
--- 494,500 ----
    }
  
    while (1) {
!               c = getopt_long (argc, argv, "+hVv46t:p:f:e:c:w:H:C:X:R:SD:F:A:U:P:",
                         longopts, &option);
  
        if (c == -1 || c == EOF)
***************
*** 603,608 ****
--- 605,621 ----
                usage (_("SSL support not available - install OpenSSL and recompile"));
  #endif
            break;
+               case 'X':
+               /* Check SSL cert validity, return Critical */
+ #ifdef USE_OPENSSL
+                       if (!is_intnonneg (optarg))
+                               usage2 ("Invalid certificate expiration period",optarg);
+                               days_till_exp_crit = atoi (optarg);
+                               check_cert = TRUE;
+ #else
+                               usage (_("SSL support not available - install OpenSSL and recompile"));
+ #endif
+                       break;
        case '4':
            address_family = AF_INET;
            break;
***************
*** 787,792 ****
--- 800,807 ----
  #ifdef HAVE_SSL
    printf (" %s\n", "-D, --certificate=INTEGER");
    printf ("    %s\n", _("Minimum number of days a certificate has to be valid."));
+   printf (" %s\n", "-X, --certificatecrit=INTEGER");
+   printf ("    %s\n", _("Minimum number of days a certificate has to be valid before Critical."));
    printf (" %s\n", "-S, --starttls");
    printf ("    %s\n", _("Use STARTTLS for the connection."));
  #endif
***************
*** 821,826 ****
    printf ("%s\n", _("Usage:"));
    printf ("%s -H host [-p port] [-e expect] [-C command] [-f from addr]", progname);
    printf ("[-A authtype -U authuser -P authpass] [-w warn] [-c crit] [-t timeout]\n");
!   printf ("[-F fqdn] [-S] [-D days] [-v] [-4|-6]\n");
  }
  
--- 836,841 ----
    printf ("%s\n", _("Usage:"));
    printf ("%s -H host [-p port] [-e expect] [-C command] [-f from addr]", progname);
    printf ("[-A authtype -U authuser -P authpass] [-w warn] [-c crit] [-t timeout]\n");
!   printf ("[-F fqdn] [-S] [-D days] [-X critdays] [-v] [-4|-6]\n");
  }
  
*** nagios-plugins-1.4.15/plugins/check_tcp.c   2010-07-27 13:47:16.000000000 -0700
--- nagios-plugins-1.4.15new/plugins/check_tcp.c        2011-12-29 16:03:29.000000000 -0800
***************
*** 39,45 ****
  
  #ifdef HAVE_SSL
  static int check_cert = FALSE;
! static int days_till_exp;
  # define my_recv(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
  # define my_send(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
  #else
--- 39,46 ----
  
  #ifdef HAVE_SSL
  static int check_cert = FALSE;
! static int days_till_exp = 0;
! static int days_till_exp_crit = 0;
  # define my_recv(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_read(buf, len) : read(sd, buf, len))
  # define my_send(buf, len) ((flags & FLAG_SSL) ? np_net_ssl_write(buf, len) : send(sd, buf, len, 0))
  #else
***************
*** 235,241 ****
    if (flags & FLAG_SSL){
        result = np_net_ssl_init(sd);
        if (result == STATE_OK && check_cert == TRUE) {
!                       result = np_net_ssl_check_cert(days_till_exp);
            if(result != STATE_OK) {
                printf(_("CRITICAL - Cannot retrieve server certificate.\n"));
            }
--- 236,242 ----
    if (flags & FLAG_SSL){
        result = np_net_ssl_init(sd);
        if (result == STATE_OK && check_cert == TRUE) {
!                       result = np_net_ssl_check_cert(days_till_exp, days_till_exp_crit);
            if(result != STATE_OK) {
                printf(_("CRITICAL - Cannot retrieve server certificate.\n"));
            }
***************
*** 411,416 ****
--- 412,418 ----
        {"help", no_argument, 0, 'h'},
        {"ssl", no_argument, 0, 'S'},
        {"certificate", required_argument, 0, 'D'},
+               {"certificatecrit", required_argument, 0, 'X'},
        {0, 0, 0, 0}
    };
  
***************
*** 435,441 ****
    }
  
    while (1) {
!               c = getopt_long (argc, argv, "+hVv46EAH:s:e:q:m:c:w:t:p:C:W:d:Sr:jD:M:",
                         longopts, &option);
  
        if (c == -1 || c == EOF || c == 1)
--- 437,443 ----
    }
  
    while (1) {
!               c = getopt_long (argc, argv, "+hVv46EAH:s:e:q:m:c:w:t:p:C:X:W:d:Sr:jD:M:",
                         longopts, &option);
  
        if (c == -1 || c == EOF || c == 1)
***************
*** 563,568 ****
--- 565,582 ----
            break;
  #  endif /* USE_OPENSSL */
  #endif
+               case 'X': /* Check SSL cert validity - days 'til certificate expiration,
+                             return Critical */
+ #ifdef HAVE_SSL
+ #  ifdef USE_OPENSSL /* XXX */
+                       if (!is_intnonneg (optarg))
+                               usage2 (_("Invalid certificate expiration period"), optarg);
+                       days_till_exp_crit = atoi (optarg);
+                       check_cert = TRUE;
+                       flags |= FLAG_SSL;
+                       break;
+ #  endif /* USE_OPENSSL */
+ #endif
            /* fallthrough if we don't have ssl */
        case 'S':
  #ifdef HAVE_SSL
***************
*** 629,636 ****
    printf ("    %s\n", _("Seconds to wait between sending string and polling for response"));
  
  #ifdef HAVE_SSL
!       printf (" %s\n", "-D, --certificate=INTEGER");
    printf ("    %s\n", _("Minimum number of days a certificate has to be valid."));
    printf (" %s\n", "-S, --ssl");
    printf ("    %s\n", _("Use SSL for the connection."));
  #endif
--- 643,652 ----
    printf ("    %s\n", _("Seconds to wait between sending string and polling for response"));
  
  #ifdef HAVE_SSL
!   printf (" %s\n", "-D, --certificate=INTEGER");
    printf ("    %s\n", _("Minimum number of days a certificate has to be valid."));
+   printf (" %s\n", "-X, --certificatecrit=INTEGER");
+   printf ("    %s\n", _("Minimum number of days a certificate has to be valid before Critical."));
    printf (" %s\n", "-S, --ssl");
    printf ("    %s\n", _("Use SSL for the connection."));
  #endif
***************
*** 652,657 ****
    printf ("%s -H host -p port [-w <warning time>] [-c <critical time>] [-s <send string>]\n",progname);
    printf ("[-e <expect string>] [-q <quit string>][-m <maximum bytes>] [-d <delay>]\n");
    printf ("[-t <timeout seconds>] [-r <refuse state>] [-M <mismatch state>] [-v] [-4|-6] [-j]\n");
!   printf ("[-D <days to cert expiry>] [-S <use SSL>] [-E]\n");
  }
  
--- 668,673 ----
    printf ("%s -H host -p port [-w <warning time>] [-c <critical time>] [-s <send string>]\n",progname);
    printf ("[-e <expect string>] [-q <quit string>][-m <maximum bytes>] [-d <delay>]\n");
    printf ("[-t <timeout seconds>] [-r <refuse state>] [-M <mismatch state>] [-v] [-4|-6] [-j]\n");
!   printf ("[-D <days to cert expiry>] [-X <days to critical cert expiry>] [-S <use SSL>] [-E]\n");
  }

