65 files changed, 276 insertions, 622 deletions

diff --git a/.travis.yml b/.travis.yml
index 11cc061..6af1fee 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,8 +11,10 @@ install:
   - sudo apt-get install -qq --no-install-recommends perl autotools-dev libdbi-dev libldap2-dev libpq-dev libmysqlclient-dev libfreeradius-client-dev libkrb5-dev libnet-snmp-perl procps
   - sudo apt-get install -qq --no-install-recommends libdbi0-dev libdbd-sqlite3 libssl-dev dnsutils snmp-mibs-downloader libsnmp-perl snmpd
   - sudo apt-get install -qq --no-install-recommends fping snmp netcat smbclient fping pure-ftpd apache2 postfix libhttp-daemon-ssl-perl
+  - sudo apt-get install -qq --no-install-recommends libdbd-sybase-perl libnet-dns-perl
   - sudo apt-get install -qq --no-install-recommends slapd ldap-utils
   - sudo apt-get install -qq --no-install-recommends autoconf automake
+  - sudo apt-get install -qq --no-install-recommends faketime
 
 before_script:
   - tools/setup
diff --git a/NEWS b/NEWS
index 4adc8f8..a489ee2 100644
--- a/NEWS
+++ b/NEWS
@@ -22,7 +22,11 @@ This file documents the major additions and syntax changes between releases.
         WARNINGS
         The format of the performance data emitted by check_mrtgtraf has been
           changed to comply with the development guidelines
-        check_ssh not returns CRITICAL for protocal/version errors
+        check_ssh now returns CRITICAL for protocol/version errors
+        If a plugin is invoked with -h/--help or -V/--version, the exit status
+          is now UNKNOWN
+        The superseded check_ntp.pl was removed, please use check_ntp_peer or
+          check_ntp_time instead
 
 2.1.1 2nd December 2014
         FIXES
diff --git a/THANKS.in b/THANKS.in
index 9a9ca3f..59c90fe 100644
--- a/THANKS.in
+++ b/THANKS.in
@@ -335,3 +335,4 @@ Jonas Genannt
 Nick Peelman
 Sebastian Herbszt
 Christopher Schultz
+Matthias Hähnel
diff --git a/doc/developer-guidelines.sgml b/doc/developer-guidelines.sgml
index d934028..228d3fa 100644
--- a/doc/developer-guidelines.sgml
+++ b/doc/developer-guidelines.sgml
@@ -194,13 +194,15 @@
                                         <row>
                                                 <entry align="center"><para>3</para></entry>
                                                 <entry valign="middle"><para>Unknown</para></entry>
-                                                <entry><para>Invalid command line arguments were supplied to the 
+                                                <entry><para>Invalid command line arguments were supplied to the
                                                 plugin or low-level failures internal to the plugin (such as unable to fork,
                                                 or open a tcp socket) that prevent it from performing the specified
                                                 operation. Higher-level errors (such as name resolution errors,
                                                 socket timeouts, etc) are outside of the control of plugins and should
                                                 generally NOT be reported as UNKNOWN states.
-                                                </para></entry>
+                                                </para>
+                                                <para>The --help or --version output should also result in Unknown state.</para>
+                                                </entry>
                                         </row>
                                 </tbody>
                         </tgroup>
@@ -610,6 +612,9 @@
                 <para>The option -v or --verbose should be present in all plugins.
                 The user should be allowed to specify -v multiple times to increase
                 the verbosity level, as described in <xref linkend="verboselevels">.</para>
+
+                The exit code for version information or help should be UNKNOWN
+                (3).</para>
     </section>
 
     <section>
diff --git a/plugins-root/check_dhcp.c b/plugins-root/check_dhcp.c
index b874c55..3723e61 100644
--- a/plugins-root/check_dhcp.c
+++ b/plugins-root/check_dhcp.c
@@ -1163,11 +1163,11 @@ int call_getopt(int argc, char **argv){
 
                 case 'V': /* version */
                         print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
 
                 case 'h': /* help */
                         print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
 
                 case 'v': /* verbose */
                         verbose=1;
diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index f420837..9ed12ba 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -526,10 +526,10 @@ main(int argc, char **argv)
                                 break;
                         case 'V': /* version */
                                 print_revision (progname, NP_VERSION);
-                                exit (STATE_OK);
+                                exit (STATE_UNKNOWN);
                         case 'h': /* help */
                                 print_help ();
-                                exit (STATE_OK);
+                                exit (STATE_UNKNOWN);
                         }
                 }
         }
diff --git a/plugins-scripts/Makefile.am b/plugins-scripts/Makefile.am
index 794a34f..ea65aed 100644
--- a/plugins-scripts/Makefile.am
+++ b/plugins-scripts/Makefile.am
@@ -36,6 +36,8 @@ TESTS = @SCRIPT_TEST@
 test:
         perl -I $(top_builddir) -I $(top_srcdir) ../test.pl
         perl -I $(top_builddir) -I $(top_srcdir) ../test.pl t/utils.t   # utils.t is excluded from above, so manually ask to test
+        for SCRIPT in *.pl; do perl -wc $$SCRIPT || exit 1; done
+        set -e; for SCRIPT in *.sh; do sh -n $$SCRIPT || exit 1; done
 
 test-debug:
         NPTEST_DEBUG=1 HARNESS_VERBOSE=1 perl -I $(top_builddir) -I $(top_srcdir) ../test.pl
diff --git a/plugins-scripts/check_breeze.pl b/plugins-scripts/check_breeze.pl
index 12a60ee..05b9920 100755
--- a/plugins-scripts/check_breeze.pl
+++ b/plugins-scripts/check_breeze.pl
@@ -28,10 +28,10 @@ GetOptions
 
 if ($opt_V) {
         print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
-if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
 
 ($opt_H) || usage("Host name/address not specified\n");
 my $host = $1 if ($opt_H =~ /([-.A-Za-z0-9]+)/);
diff --git a/plugins-scripts/check_disk_smb.pl b/plugins-scripts/check_disk_smb.pl
index 99948a4..9899226 100755
--- a/plugins-scripts/check_disk_smb.pl
+++ b/plugins-scripts/check_disk_smb.pl
@@ -54,10 +54,10 @@ GetOptions
 
 if ($opt_V) {
         print_revision($PROGNAME,'@NP_VERSION@'); #'
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
-if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
 
 my $smbclient = $utils::PATH_TO_SMBCLIENT;
 $smbclient    || usage("check requires smbclient, smbclient not set\n");
diff --git a/plugins-scripts/check_file_age.pl b/plugins-scripts/check_file_age.pl
index 15330f7..56b8e97 100755
--- a/plugins-scripts/check_file_age.pl
+++ b/plugins-scripts/check_file_age.pl
@@ -60,12 +60,12 @@ GetOptions(
 
 if ($opt_V) {
         print_revision($PROGNAME, '@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
 if ($opt_h) {
         print_help();
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
 $opt_f = shift unless ($opt_f);
diff --git a/plugins-scripts/check_flexlm.pl b/plugins-scripts/check_flexlm.pl
index 49d674d..e3fe296 100755
--- a/plugins-scripts/check_flexlm.pl
+++ b/plugins-scripts/check_flexlm.pl
@@ -58,7 +58,7 @@ GetOptions
 
 if ($opt_V) {
         print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
 unless (defined $opt_t) {
@@ -66,7 +66,7 @@ unless (defined $opt_t) {
 }
 
 
-if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
 
 unless (defined $opt_F) {
         print "Missing license.dat file\n";
diff --git a/plugins-scripts/check_ifoperstatus.pl b/plugins-scripts/check_ifoperstatus.pl
index 1a7fbba..3eed4bc 100755
--- a/plugins-scripts/check_ifoperstatus.pl
+++ b/plugins-scripts/check_ifoperstatus.pl
@@ -367,17 +367,17 @@ sub process_arguments() {
 
         if ($status == 0){
                 print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         if ($opt_V) {
                 print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         if ($opt_h) {
                 print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         if (! utils::is_hostname($hostname)){
diff --git a/plugins-scripts/check_ifstatus.pl b/plugins-scripts/check_ifstatus.pl
index 2c76d0c..9f2f7c3 100755
--- a/plugins-scripts/check_ifstatus.pl
+++ b/plugins-scripts/check_ifstatus.pl
@@ -119,7 +119,7 @@ $status = process_arguments();
 if ($status != 0)
 {
         print_help() ;
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
 
@@ -313,17 +313,17 @@ sub process_arguments() {
                 
         if ($status == 0){
                 print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         if ($opt_V) {
                 print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         if ($opt_h) {
                 print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         unless (defined $timeout) {
diff --git a/plugins-scripts/check_ircd.pl b/plugins-scripts/check_ircd.pl
index afedfb9..22d21c2 100755
--- a/plugins-scripts/check_ircd.pl
+++ b/plugins-scripts/check_ircd.pl
@@ -181,10 +181,10 @@ MAIN:
 
         if ($opt_V) {
                 print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
-        if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+        if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
 
         ($opt_H) || ($opt_H = shift @ARGV) || usage("Host name/address not specified\n");
         my $remotehost = $1 if ($opt_H =~ /([-.A-Za-z0-9]+)/);
diff --git a/plugins-scripts/check_mailq.pl b/plugins-scripts/check_mailq.pl
index 3086e94..32f498d 100755
--- a/plugins-scripts/check_mailq.pl
+++ b/plugins-scripts/check_mailq.pl
@@ -573,12 +573,12 @@ sub process_arguments(){
 
         if ($opt_V) {
                 print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         if ($opt_h) {
                 print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         if (defined $opt_v ){
diff --git a/plugins-scripts/check_mssql.pl b/plugins-scripts/check_mssql.pl
index a436a8f..fb3952d 100755
--- a/plugins-scripts/check_mssql.pl
+++ b/plugins-scripts/check_mssql.pl
@@ -130,7 +130,7 @@ sub process_arguments {
 
         if (defined $opt_V) {
                 print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
         }
 
         syntax("Help:") if ($help);
diff --git a/plugins-scripts/check_netdns.pl b/plugins-scripts/check_netdns.pl
index af1456b..38538e5 100755
--- a/plugins-scripts/check_netdns.pl
+++ b/plugins-scripts/check_netdns.pl
@@ -32,6 +32,9 @@ use lib "$FindBin::Bin";
 use utils;
 
 my $PROGNAME = "check_netdns";
+sub print_help ();
+sub print_version();
+sub print_usage ();
 
 $ENV{'PATH'}='@TRUSTED_PATH@';
 $ENV{'BASH_ENV'}=''; 
@@ -43,12 +46,12 @@ GetOptions("V" => $opt_V,         "version" => $opt_V,
                                          "t=i" => $opt_t,       "timeout=i" => $opt_t,
                                          "s=s" => $opt_s,       "server=s" => $opt_s,
                                          "H=s" => $opt_H,       "hostname=s" => $opt_H);
-                           
+
 # -h means display verbose help screen
-if($opt_h){ print_help(); exit 0; }
+if($opt_h){ print_help(); exit 3; }
 
 # -V means display version number
-if ($opt_V) { print_version(); exit 0; }
+if ($opt_V) { print_version(); exit 3; }
 
 # -H means host name
 $opt_H = shift unless ($opt_H);
@@ -70,7 +73,7 @@ if ($opt_s) {
                 $server = $1;
         } else {
                 print "$opt_s is not a valid host name";
-                exit -1;
+                exit 3;
         }
 }
 
diff --git a/plugins-scripts/check_ntp.pl b/plugins-scripts/check_ntp.pl
deleted file mode 100755
index 13da939..0000000
--- a/plugins-scripts/check_ntp.pl
+++ /dev/null
@@ -1,471 +0,0 @@
-#!@PERL@ -w
-#
-# (c)1999 Ian Cass, Knowledge Matters Ltd.
-# Read the GNU copyright stuff for all the legalese
-#
-# Check NTP time servers plugin. This plugin requires the ntpdate utility to
-# be installed on the system, however since it's part of the ntp suite, you 
-# should already have it installed.
-#
-#
-# Nothing clever done in this program - its a very simple bare basics hack to
-# get the job done.
-#
-# Things to do...
-# check @words[9] for time differences greater than +/- x secs & return a
-# warning.
-#
-# (c) 1999 Mark Jewiss, Knowledge Matters Limited
-# 22-9-1999, 12:45
-#
-# Modified script to accept 2 parameters or set defaults.
-# Now issues warning or critical alert is time difference is greater than the 
-# time passed.
-#
-# These changes have not been tested completely due to the unavailability of a
-# server with the incorrect time.
-#
-# (c) 1999 Bo Kersey, VirCIO - Managed Server Solutions <bo@vircio.com>
-# 22-10-99, 12:17
-#
-# Modified the script to give useage if no parameters are input.
-#
-# Modified the script to check for negative as well as positive 
-# time differences.
-#
-# Modified the script to work with ntpdate 3-5.93e Wed Apr 14 20:23:03 EDT 1999
-#
-# Modified the script to work with ntpdate's that return adjust or offset...
-#
-#
-# Script modified 2000 June 01 by William Pietri <william@bianca.com>
-#
-# Modified script to handle weird cases:
-#     o NTP server doesn't respond (e.g., has died)
-#     o Server has correct time but isn't suitable synchronization
-#           source. This happens while starting up and if contact
-#           with master has been lost.
-#
-# Modifed to run under Embedded Perl  (sghosh@users.sf.net)
-#   - combined logic some blocks together..
-# 
-# Added ntpdate check for stratum 16 desynch peer (James Fidell) Feb 03, 2003
-#
-# ntpdate - offset is in seconds
-# changed ntpdc to ntpq - jitter/dispersion is in milliseconds
-#
-# Patch for for regex for stratum1 refid.
-
-require 5.004;
-use POSIX;
-use strict;
-use Getopt::Long;
-use vars qw($opt_V $opt_h $opt_H $opt_t $opt_w $opt_c $opt_O $opt_j $opt_k $verbose $PROGNAME $def_jitter $ipv4 $ipv6);
-use lib utils.pm;
-use utils qw($TIMEOUT %ERRORS &print_revision &support);
-
-$PROGNAME="check_ntp";
-
-sub print_help ();
-sub print_usage ();
-
-$ENV{'PATH'}='@TRUSTED_PATH@';
-$ENV{'BASH_ENV'}='';
-$ENV{'ENV'}='';
-
-# defaults in sec
-my $DEFAULT_OFFSET_WARN =  60;  # 1 minute
-my $DEFAULT_OFFSET_CRIT = 120;  # 2 minutes
-# default in millisec
-my $DEFAULT_JITTER_WARN =   5000; # 5 sec
-my $DEFAULT_JITTER_CRIT =  10000; # 10 sec
-
-Getopt::Long::Configure('bundling');
-GetOptions
-        ("V"   => \$opt_V, "version"    => \$opt_V,
-         "h"   => \$opt_h, "help"       => \$opt_h,
-         "v"   => \$verbose, "verbose"  => \$verbose,
-         "4"   => \$ipv4, "use-ipv4"    => \$ipv4,
-         "6"   => \$ipv6, "use-ipv6"    => \$ipv6,
-         "w=f" => \$opt_w, "warning=f"  => \$opt_w,   # offset|adjust warning if above this number
-         "c=f" => \$opt_c, "critical=f" => \$opt_c,   # offset|adjust critical if above this number
-         "O"   => \$opt_O, "zero-offset" => \$opt_O,  # zero-offset  bad
-         "j=s" => \$opt_j, "jwarn=i"    => \$opt_j,   # jitter warning if above this number
-         "k=s" => \$opt_k, "jcrit=i"    => \$opt_k,   # jitter critical if above this number
-         "t=s" => \$opt_t, "timeout=i"  => \$opt_t,
-         "H=s" => \$opt_H, "hostname=s" => \$opt_H);
-
-if ($opt_V) {
-        print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
-}
-
-if ($opt_h) {
-        print_help();
-        exit $ERRORS{'OK'};
-}
-
-# jitter test params specified
-if (defined $opt_j || defined $opt_k ) {
-        $def_jitter = 1;
-}
-
-$opt_H = shift unless ($opt_H);
-my $host = $1 if ($opt_H && $opt_H =~ m/^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[a-zA-Z][-a-zA-Z0-9]+(\.[a-zA-Z][-a-zA-Z0-9]+)*)$/);
-unless ($host) {
-        print "No target host specified\n";
-        print_usage();
-        exit $ERRORS{'UNKNOWN'};
-}
-
-my ($timeout, $owarn, $ocrit, $jwarn, $jcrit);
-
-$timeout = $TIMEOUT;
-($opt_t) && ($opt_t =~ /^([0-9]+)$/) && ($timeout = $1);
-
-$owarn = $DEFAULT_OFFSET_WARN;
-($opt_w) && ($opt_w =~ /^([0-9.]+)$/) && ($owarn = $1);
-
-$ocrit = $DEFAULT_OFFSET_CRIT;
-($opt_c) && ($opt_c =~ /^([0-9.]+)$/) && ($ocrit = $1);
-
-$jwarn = $DEFAULT_JITTER_WARN;
-($opt_j) && ($opt_j =~ /^([0-9]+)$/) && ($jwarn = $1);
-
-$jcrit = $DEFAULT_JITTER_CRIT;
-($opt_k) && ($opt_k =~ /^([0-9]+)$/) && ($jcrit = $1);
-
-if ($ocrit < $owarn ) {
-        print "Critical offset should be larger than warning offset\n";
-        print_usage();
-        exit $ERRORS{"UNKNOWN"};
-}
-
-if ($def_jitter) {
-        if ($opt_k < $opt_j) {
-                print "Critical jitter should be larger than warning jitter\n";
-                print_usage();
-                exit $ERRORS{'UNKNOWN'};
-        }
-}
-
-
-my $stratum = -1;
-my $ignoreret = 0;
-my $answer = undef;
-my $offset = undef;
-my $jitter = undef;
-my $syspeer = undef;
-my $candidate = 0;
-my @candidates;
-my $msg; # first line of output to print if format is invalid
-
-my $state = $ERRORS{'UNKNOWN'};
-my $ntpdate_error = $ERRORS{'UNKNOWN'};
-my $jitter_error = $ERRORS{'UNKNOWN'};
-
-# some systems don't have a proper ntpq  (migrated from ntpdc)
-my $have_ntpq = undef;
-if ($utils::PATH_TO_NTPQ && -x $utils::PATH_TO_NTPQ ) {
-        $have_ntpq = 1;  
-}else{
-        $have_ntpq = 0;
-}
-
-# Just in case of problems, let's not hang Nagios
-$SIG{'ALRM'} = sub {
-        print ("ERROR: No response from ntp server (alarm)\n");
-        exit $ERRORS{"UNKNOWN"};
-};
-alarm($timeout);
-
-# Determine protocol to be used for ntpdate and ntpq
-my $ntpdate = $utils::PATH_TO_NTPDATE;
-my $ntpq    = $utils::PATH_TO_NTPQ;
-if ($ipv4) {
-        $ntpdate .= " -4";
-        $ntpq .= " -4";
-}
-elsif ($ipv6) {
-        $ntpdate .= " -6";
-        $ntpq .= " -6";
-}
-# else don't use any flags
-
-###
-###
-### First, check ntpdate
-###
-###
-
-if (!open (NTPDATE, $ntpdate . " -q $host 2>&1 |")) {
-        print "Could not open $ntpdate: $!\n";
-        exit $ERRORS{"UNKNOWN"};
-}
-
-my $out;
-while (<NTPDATE>) {
-        #print if ($verbose);  # noop
-        $msg = $_ unless ($msg);
-        $out .= "$_ ";
-        
-        if (/stratum\s(\d+)/) {
-                $stratum = $1;
-        }
-        
-        if (/(offset|adjust)\s+([-.\d]+)/i) {
-                $offset = $2;
-
-                # An offset of 0.000000 with an error is probably bogus. Actually,
-                # it's probably always bogus, but let's be paranoid here.
-                # Has been reported that 0.0000 happens in a production environment
-                # on Solaris 8 so this check should be taken out - SF tracker 1150777
-                if (defined $opt_O ) {
-                        if ($offset == 0) { undef $offset;}
-                }
-
-                $ntpdate_error = defined ($offset) ? $ERRORS{"OK"} : $ERRORS{"CRITICAL"};
-                print "ntperr = $ntpdate_error \n" if $verbose;
-        
-        }
-
-        if (/no server suitable for synchronization found/) {
-                if ($stratum == 16) {
-                        $ntpdate_error = $ERRORS{"WARNING"};
-                        $msg = "Desynchronized peer server found";
-                        $ignoreret=1;
-                }
-                else {
-                        $ntpdate_error = $ERRORS{"CRITICAL"};
-                        $msg = "No suitable peer server found - ";
-                }
-        }
-
-}
-$out =~ s/\n//g;
-close (NTPDATE) || 
-    die $! ? "$out - Error closing $ntpdate pipe: $!"
-           : "$out - Exit status: $? from $ntpdate\n";
-
-# declare an error if we also get a non-zero return code from ntpdate
-# unless already set to critical
-if ( $? && !$ignoreret ) {
-        print "stderr = $? : $! \n" if $verbose;
-        $ntpdate_error = $ntpdate_error == $ERRORS{"CRITICAL"} ? $ERRORS{"CRITICAL"} : $ERRORS{"UNKNOWN"}  ;
-        print "ntperr = $ntpdate_error : $!\n" if $verbose;
-}
-
-###
-###
-### Then scan xntpq/ntpq if it exists
-### and look in the 11th column for jitter 
-###
-# Field 1: Tally Code ( Space, 'x','.','-','+','#','*','o')
-#           Only match for '*' which implies sys.peer 
-#           or 'o' which implies pps.peer
-#           If both exist, the last one is picked. 
-# Field 2: address of the remote peer
-# Field 3: Refid of the clock (0.0.0.0 if unknown, WWWV/PPS/GPS/ACTS/USNO/PCS/... if Stratum1)
-# Field 4: stratum (0-15)
-# Field 5: Type of the peer: local (l), unicast (u), multicast (m) 
-#          broadcast (b); not sure about multicast/broadcast
-# Field 6: last packet receive (in seconds)
-# Field 7: polling interval
-# Field 8: reachability resgister (octal) 
-# Field 9: delay
-# Field 10: offset
-# Field 11: dispersion/jitter
-# 
-# According to bug 773588 Some solaris xntpd implementations seemto match on
-# "#" even though the docs say it exceeds maximum distance. Providing patch
-# here which will generate a warining.
-
-if ($have_ntpq) {
-
-        if ( open(NTPQ, $ntpq . " -np $host 2>&1 |") ) {
-                while (<NTPQ>) {
-                        print $_ if ($verbose);
-                        if ( /timed out/ ){
-                                $have_ntpq = 0 ;
-                                last ;
-                        }
-                        # number of candidates on <host> for sys.peer
-                        if (/^(\*|\+|\#|o])/) {
-                                ++$candidate;
-                                push (@candidates, $_);
-                                print "Candidate count= $candidate\n" if ($verbose);
-                        }
-                        
-                        # match sys.peer or pps.peer
-                        if (/^(\*|o)(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)/) {
-                                $syspeer = $2;
-                                $stratum = $4;
-                                $jitter = $11;
-                                print "match $_ \n" if $verbose;
-                                if ($jitter > $jcrit) {
-                                        print "Jitter_crit = $11 :$jcrit\n" if ($verbose);
-                                        $jitter_error = $ERRORS{'CRITICAL'};
-                                } elsif ($jitter > $jwarn ) {
-                                        print "Jitter_warn = $11 :$jwarn\n" if ($verbose);
-                                        $jitter_error = $ERRORS{'WARNING'};
-                                } else {
-                                        $jitter_error = $ERRORS{'OK'};
-                                }
-                        } else {
-                                print "No match!\n" if $verbose;
-                                $jitter = '(not parsed)';
-                        }
-                        
-                }
-                close NTPQ ||
-            die $! ? "Error closing $ntpq pipe: $!"
-                   : "Exit status: $? from $ntpq\n";
-
-                # if we did not match sys.peer or pps.peer but matched # candidates only
-                # generate a warning 
-                # based on bug id 773588
-                unless (defined $syspeer) {
-                        if ($#candidates >=0) {
-                                foreach my $c (@candidates) {
-                                        $c =~ /^(#)([-0-9.\s]+)\s+([-0-9A-Za-z_().]+)\s+([-0-9.]+)\s+([lumb-]+)\s+([-0-9m.]+)\s+([-0-9.]+)\s+([-0-9.]+)\s+([-0-9.]+)\s+([-0-9.]+)\s+([-0-9.]+)/;
-                                        $syspeer = $2;
-                                        $stratum = $4;
-                                        $jitter = $11;
-                                        print "candidate match $c \n" if $verbose;
-                                        if ($jitter > $jcrit) {
-                                                print "Candidate match - Jitter_crit = $11 :$jcrit\n" if ($verbose);
-                                                $jitter_error = $ERRORS{'CRITICAL'};
-                                        }elsif ($jitter > $jwarn ) {
-                                                print "Candidate match - Jitter_warn = $11 :$jwarn \n" if ($verbose);
-                                                $jitter_error = $ERRORS{'WARNING'};
-                                        } else {
-                                                $jitter_error = $ERRORS{'WARNING'};
-                                        }
-                                }
-
-                        }
-                }
-        }
-}
-
-
-if ($ntpdate_error != $ERRORS{'OK'}) {
-        $state = $ntpdate_error;
-        if ($ntpdate_error == $ERRORS{'WARNING'} ) {
-                $answer = $msg;
-        }
-        else {
-                $answer = $msg . "Server for ntp probably down";
-        }
-
-        if (defined($offset) && abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Server Error and offset $offset sec > +/- $ocrit sec";
-        } elsif (defined($offset) && abs($offset) > $owarn) {
-                $answer = "Server error and offset $offset sec > +/- $owarn sec";
-        } elsif (defined($jitter) && abs($jitter) > $jcrit) {
-                $answer = "Server error and jitter $jitter msec > +/- $jcrit msec";
-        } elsif (defined($jitter) && abs($jitter) > $jwarn) {
-                $answer = "Server error and jitter $jitter msec > +/- $jwarn msec";
-        }
-
-} elsif ($have_ntpq && $jitter_error != $ERRORS{'OK'}) {
-        $state = $jitter_error;
-        $answer = "Jitter $jitter too high";
-        if (defined($offset) && abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Jitter error and offset $offset sec > +/- $ocrit sec";
-        } elsif (defined($offset) && abs($offset) > $owarn) {
-                $answer = "Jitter error and offset $offset sec > +/- $owarn sec";
-        } elsif (defined($jitter) && abs($jitter) > $jcrit) {
-                $answer = "Jitter error and jitter $jitter msec > +/- $jcrit msec";
-        } elsif (defined($jitter) && abs($jitter) > $jwarn) {
-                $answer = "Jitter error and jitter $jitter msec > +/- $jwarn msec";
-        }
-
-} elsif( !$have_ntpq ) { # no errors from ntpdate and no ntpq or ntpq timed out
-        if (abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Offset $offset sec > +/- $ocrit sec";
-        } elsif (abs($offset) > $owarn) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset sec > +/- $owarn sec";
-        } elsif (( abs($offset) > $owarn) && $def_jitter ) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset sec > +/- $owarn sec, ntpq timed out";
-        } elsif ( $def_jitter ) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset secs, ntpq timed out";
-        } else{
-                $state = $ERRORS{'OK'};
-                $answer = "Offset $offset secs";
-        }
-
-
-
-} else { # no errors from ntpdate or ntpq
-        if (abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Offset $offset sec > +/- $ocrit sec, jitter $jitter msec";
-        } elsif (abs($jitter) > $jcrit ) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Jitter $jitter msec> +/- $jcrit msec, offset $offset sec";
-        } elsif (abs($offset) > $owarn) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset sec > +/- $owarn sec, jitter $jitter msec";
-        } elsif (abs($jitter) > $jwarn ) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Jitter $jitter msec> +/- $jwarn msec, offset $offset sec";
-
-        } else {
-                $state = $ERRORS{'OK'};
-                $answer = "Offset $offset secs, jitter $jitter msec, peer is stratum $stratum";
-        }
-        
-}
-
-foreach my $key (keys %ERRORS) {
-        if ($state==$ERRORS{$key}) {
-#               print ("NTP $key: $answer");
-                print ("NTP $key: $answer|offset=$offset, jitter=" . $jitter/1000 .     ",peer_stratum=$stratum\n");
-                last;
-        }
-}
-exit $state;
-
-
-####
-#### subs
-
-sub print_usage () {
-        print "Usage: $PROGNAME -H <host> [-46] [-O] [-w <warn>] [-c <crit>] [-j <warn>] [-k <crit>] [-v verbose]\n";
-}
-
-sub print_help () {
-        print_revision($PROGNAME,'@NP_VERSION@');
-        print "Copyright (c) 2003 Bo Kersey/Karl DeBisschop\n";
-        print "\n";
-        print_usage();
-        print "
-Checks the local timestamp offset versus <host> with ntpdate
-Checks the jitter/dispersion of clock signal between <host> and its sys.peer with ntpq\n
--O (--zero-offset)
-     A zero offset on \"ntpdate\" will generate a CRITICAL.\n
--w (--warning)
-     Clock offset in seconds at which a warning message will be generated.\n    Defaults to $DEFAULT_OFFSET_WARN.
--c (--critical) 
-     Clock offset in seconds at which a critical message will be generated.\n   Defaults to $DEFAULT_OFFSET_CRIT.
--j (--jwarn)
-     Clock jitter in milliseconds at which a warning message will be generated.\n       Defaults to $DEFAULT_JITTER_WARN.
--k (--jcrit)
-    Clock jitter in milliseconds at which a critical message will be generated.\n       Defaults to $DEFAULT_JITTER_CRIT.
-    
-    If jitter/dispersion is specified with -j or -k and ntpq times out, then a
-    warning is returned.\n
--4 (--use-ipv4)
-    Use IPv4 connection
--6 (--use-ipv6)
-    Use IPv6 connection
-\n";    
-support();
-}
diff --git a/plugins-scripts/check_rpc.pl b/plugins-scripts/check_rpc.pl
index cbdeceb..47d6e49 100755
--- a/plugins-scripts/check_rpc.pl
+++ b/plugins-scripts/check_rpc.pl
@@ -63,12 +63,12 @@ GetOptions(
 );
 
 # -h means display verbose help screen
-if ($opt_h) { print_help(); exit $ERRORS{'OK'}; }
+if ($opt_h) { print_help(); exit $ERRORS{'UNKNOWN'}; }
 
 # -V means display version number
 if ($opt_V) {
         print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
 # Hash containing all RPC program names and numbers
diff --git a/plugins-scripts/check_wave.pl b/plugins-scripts/check_wave.pl
index 979416e..41e15f5 100755
--- a/plugins-scripts/check_wave.pl
+++ b/plugins-scripts/check_wave.pl
@@ -31,12 +31,12 @@ GetOptions
 
 if ($opt_V) {
         print_revision($PROGNAME,'@NP_VERSION@'); #'
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
 if ($opt_h) {
         print_help();
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 
 $opt_H = shift unless ($opt_H);
diff --git a/plugins-scripts/t/check_rpc.t b/plugins-scripts/t/check_rpc.t
index be8ae2f..c58f7bf 100644
--- a/plugins-scripts/t/check_rpc.t
+++ b/plugins-scripts/t/check_rpc.t
@@ -15,7 +15,7 @@ my $successOutput = '/^check_rpc/';
 
 my $t;
 
-$t += checkCmd( "./check_rpc -V",   0, $successOutput );
+$t += checkCmd( "./check_rpc -V",   3, $successOutput );
 
 exit(0) if defined($Test::Harness::VERSION);
 exit($tests - $t);
diff --git a/plugins/check_apt.c b/plugins/check_apt.c
index 8747f90..a639a41 100644
--- a/plugins/check_apt.c
+++ b/plugins/check_apt.c
@@ -160,10 +160,10 @@ int process_arguments (int argc, char **argv) {
                 switch(c) {
                 case 'h':
                         print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                 case 'V':
                         print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                 case 'v':
                         verbose++;
                         break;
diff --git a/plugins/check_by_ssh.c b/plugins/check_by_ssh.c
index a877f88..04bce38 100644
--- a/plugins/check_by_ssh.c
+++ b/plugins/check_by_ssh.c
@@ -209,10 +209,10 @@ process_arguments (int argc, char **argv)
                 switch (c) {
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'v':                                                                       /* help */
                         verbose = TRUE;
                         break;
diff --git a/plugins/check_cluster.c b/plugins/check_cluster.c
index cf699e1..b86e501 100644
--- a/plugins/check_cluster.c
+++ b/plugins/check_cluster.c
@@ -200,7 +200,7 @@ int process_arguments(int argc, char **argv){
 
                 case 'V': /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                         break;
 
                 case 'H': /* help */
diff --git a/plugins/check_dbi.c b/plugins/check_dbi.c
index a3d033f..826eb8d 100644
--- a/plugins/check_dbi.c
+++ b/plugins/check_dbi.c
@@ -368,10 +368,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':     /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':     /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
 
                 case 'c':     /* critical range */
                         critical_range = optarg;
diff --git a/plugins/check_dig.c b/plugins/check_dig.c
index d899b11..db4b20e 100644
--- a/plugins/check_dig.c
+++ b/plugins/check_dig.c
@@ -223,10 +223,10 @@ process_arguments (int argc, char **argv)
     switch (c) {
     case 'h':                 /* help */
       print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'V':                 /* version */
       print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'H':                 /* hostname */
       host_or_die(optarg);
       dns_server = optarg;
diff --git a/plugins/check_disk.c b/plugins/check_disk.c
index eb573f5..9693bad 100644
--- a/plugins/check_disk.c
+++ b/plugins/check_disk.c
@@ -766,10 +766,10 @@ process_arguments (int argc, char **argv)
       break;
     case 'V':                 /* version */
       print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'h':                 /* help */
       print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case '?':                 /* help */
       usage (_("Unknown argument"));
     }
diff --git a/plugins/check_dns.c b/plugins/check_dns.c
index 2212122..d6bd2c0 100644
--- a/plugins/check_dns.c
+++ b/plugins/check_dns.c
@@ -395,10 +395,10 @@ process_arguments (int argc, char **argv)
     switch (c) {
     case 'h': /* help */
       print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'V': /* version */
       print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'v': /* version */
       verbose = TRUE;
       break;
diff --git a/plugins/check_dummy.c b/plugins/check_dummy.c
index 3ed6871..212a134 100644
--- a/plugins/check_dummy.c
+++ b/plugins/check_dummy.c
@@ -52,11 +52,11 @@ main (int argc, char **argv)
     usage4 (_("Could not parse arguments"));
   else if (strcmp (argv[1], "-V") == 0 || strcmp (argv[1], "--version") == 0) {
     print_revision (progname, NP_VERSION);
-    exit (STATE_OK);
+    exit (STATE_UNKNOWN);
   }
   else if (strcmp (argv[1], "-h") == 0 || strcmp (argv[1], "--help") == 0) {
     print_help ();
-    exit (STATE_OK);
+    exit (STATE_UNKNOWN);
   }
   else if (!is_integer (argv[1]))
     usage4 (_("Arguments to check_dummy must be an integer"));
diff --git a/plugins/check_fping.c b/plugins/check_fping.c
index 274dd75..da1ce1a 100644
--- a/plugins/check_fping.c
+++ b/plugins/check_fping.c
@@ -314,10 +314,10 @@ process_arguments (int argc, char **argv)
       usage5 ();
     case 'h':                 /* help */
       print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'V':                 /* version */
       print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'v':                 /* verbose mode */
       verbose = TRUE;
       break;
diff --git a/plugins/check_game.c b/plugins/check_game.c
index 29e59e2..709dae1 100644
--- a/plugins/check_game.c
+++ b/plugins/check_game.c
@@ -196,10 +196,10 @@ process_arguments (int argc, char **argv)
     switch (c) {
     case 'h': /* help */
       print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'V': /* version */
       print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
     case 'v': /* version */
       verbose = TRUE;
       break;
diff --git a/plugins/check_hpjd.c b/plugins/check_hpjd.c
index 5fe0698..f159f5a 100644
--- a/plugins/check_hpjd.c
+++ b/plugins/check_hpjd.c
@@ -350,10 +350,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case '?':                                                                       /* help */
                         usage5 ();
                 }
diff --git a/plugins/check_http.c b/plugins/check_http.c
index b1a69e5..2038f4a 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -267,11 +267,11 @@ process_arguments (int argc, char **argv)
       break;
     case 'h': /* help */
       print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
       break;
     case 'V': /* version */
       print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
       break;
     case 't': /* timeout period */
       if (!is_intnonneg (optarg))
@@ -880,17 +880,42 @@ check_http (void)
   double elapsed_time_transfer = 0.0;
   int page_len = 0;
   int result = STATE_OK;
+  char *force_host_header = NULL;
 
   /* try to connect to the host at the given port number */
   gettimeofday (&tv_temp, NULL);
   if (my_tcp_connect (server_address, server_port, &sd) != STATE_OK)
     die (STATE_CRITICAL, _("HTTP CRITICAL - Unable to open TCP socket\n"));
   microsec_connect = deltime (tv_temp);
+
+    /* if we are called with the -I option, the -j method is CONNECT and */
+    /* we received -S for SSL, then we tunnel the request through a proxy*/
+    /* @20100414, public[at]frank4dd.com, http://www.frank4dd.com/howto  */
+
+    if ( server_address != NULL && strcmp(http_method, "CONNECT") == 0
+      && host_name != NULL && use_ssl == TRUE) {
+
+    if (verbose) printf ("Entering CONNECT tunnel mode with proxy %s:%d to dst %s:%d\n", server_address, server_port, host_name, HTTPS_PORT);
+    asprintf (&buf, "%s %s:%d HTTP/1.1\r\n%s\r\n", http_method, host_name, HTTPS_PORT, user_agent);
+    asprintf (&buf, "%sProxy-Connection: keep-alive\r\n", buf);
+    asprintf (&buf, "%sHost: %s\r\n", buf, host_name);
+    /* we finished our request, send empty line with CRLF */
+    asprintf (&buf, "%s%s", buf, CRLF);
+    if (verbose) printf ("%s\n", buf);
+    send(sd, buf, strlen (buf), 0);
+    buf[0]='\0';
+
+    if (verbose) printf ("Receive response from proxy\n");
+    read (sd, buffer, MAX_INPUT_BUFFER-1);
+    if (verbose) printf ("%s", buffer);
+    /* Here we should check if we got HTTP/1.1 200 Connection established */
+  }
 #ifdef HAVE_SSL
   elapsed_time_connect = (double)microsec_connect / 1.0e6;
   if (use_ssl == TRUE) {
     gettimeofday (&tv_temp, NULL);
     result = np_net_ssl_init_with_hostname_version_and_cert(sd, (use_sni ? host_name : NULL), ssl_version, client_cert, client_privkey);
+    if (verbose) printf ("SSL initialized\n");
     if (result != STATE_OK)
       die (STATE_CRITICAL, NULL);
     microsec_ssl = deltime (tv_temp);
@@ -904,29 +929,51 @@ check_http (void)
   }
 #endif /* HAVE_SSL */
 
-  xasprintf (&buf, "%s %s %s\r\n%s\r\n", http_method, server_url, host_name ? "HTTP/1.1" : "HTTP/1.0", user_agent);
+  if ( server_address != NULL && strcmp(http_method, "CONNECT") == 0
+       && host_name != NULL && use_ssl == TRUE)
+    asprintf (&buf, "%s %s %s\r\n%s\r\n", "GET", server_url, host_name ? "HTTP/1.1" : "HTTP/1.0", user_agent);
+  else
+    asprintf (&buf, "%s %s %s\r\n%s\r\n", http_method, server_url, host_name ? "HTTP/1.1" : "HTTP/1.0", user_agent);
 
   /* tell HTTP/1.1 servers not to keep the connection alive */
   xasprintf (&buf, "%sConnection: close\r\n", buf);
 
+  /* check if Host header is explicitly set in options */
+  if (http_opt_headers_count) {
+    for (i = 0; i < http_opt_headers_count ; i++) {
+      if (strncmp(http_opt_headers[i], "Host:", 5) == 0) {
+        force_host_header = http_opt_headers[i];
+      }
+    }
+  }
+
   /* optionally send the host header info */
   if (host_name) {
-    /*
-     * Specify the port only if we're using a non-default port (see RFC 2616,
-     * 14.23).  Some server applications/configurations cause trouble if the
-     * (default) port is explicitly specified in the "Host:" header line.
-     */
-    if ((use_ssl == FALSE && server_port == HTTP_PORT) ||
-        (use_ssl == TRUE && server_port == HTTPS_PORT))
-      xasprintf (&buf, "%sHost: %s\r\n", buf, host_name);
-    else
-      xasprintf (&buf, "%sHost: %s:%d\r\n", buf, host_name, server_port);
+    if (force_host_header) {
+      xasprintf (&buf, "%s%s\r\n", buf, force_host_header);
+    }
+    else {
+      /*
+       * Specify the port only if we're using a non-default port (see RFC 2616,
+       * 14.23).  Some server applications/configurations cause trouble if the
+       * (default) port is explicitly specified in the "Host:" header line.
+       */
+      if ((use_ssl == FALSE && server_port == HTTP_PORT) ||
+          (use_ssl == TRUE && server_port == HTTPS_PORT) ||
+          (server_address != NULL && strcmp(http_method, "CONNECT") == 0
+         && host_name != NULL && use_ssl == TRUE))
+        xasprintf (&buf, "%sHost: %s\r\n", buf, host_name);
+      else
+        xasprintf (&buf, "%sHost: %s:%d\r\n", buf, host_name, server_port);
+    }
   }
 
   /* optionally send any other header tag */
   if (http_opt_headers_count) {
     for (i = 0; i < http_opt_headers_count ; i++) {
-      xasprintf (&buf, "%s%s\r\n", buf, http_opt_headers[i]);
+      if (force_host_header != http_opt_headers[i]) {
+        xasprintf (&buf, "%s%s\r\n", buf, http_opt_headers[i]);
+      }
     }
     /* This cannot be free'd here because a redirection will then try to access this and segfault */
     /* Covered in a testcase in tests/check_http.t */
@@ -1508,7 +1555,7 @@ print_help (void)
   printf ("    %s\n", _("URL to GET or POST (default: /)"));
   printf (" %s\n", "-P, --post=STRING");
   printf ("    %s\n", _("URL encoded http POST data"));
-  printf (" %s\n", "-j, --method=STRING  (for example: HEAD, OPTIONS, TRACE, PUT, DELETE)");
+  printf (" %s\n", "-j, --method=STRING  (for example: HEAD, OPTIONS, TRACE, PUT, DELETE, CONNECT)");
   printf ("    %s\n", _("Set HTTP method."));
   printf (" %s\n", "-N, --no-body");
   printf ("    %s\n", _("Don't wait for document body: stop reading after headers."));
@@ -1582,7 +1629,7 @@ print_help (void)
   printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
   printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
   printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
-  printf (" %s\n", _("the certificate is expired."));
+  printf (" %s\n\n", _("the certificate is expired."));
   printf ("\n");
   printf (" %s\n\n", "CHECK CERTIFICATE: check_http -H www.verisign.com -C 30,14");
   printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 30 days,"));
@@ -1590,6 +1637,13 @@ print_help (void)
   printf (" %s\n", _("30 days, but more than 14 days, a STATE_WARNING is returned."));
   printf (" %s\n", _("A STATE_CRITICAL will be returned when certificate expires in less than 14 days"));
 
+  printf (" %s\n\n", "CHECK SSL WEBSERVER CONTENT VIA PROXY USING HTTP 1.1 CONNECT: ");
+  printf (" %s\n", _("check_http -I 192.168.100.35 -p 80 -u https://www.verisign.com/ -S -j CONNECT -H www.verisign.com "));
+  printf (" %s\n", _("all these options are needed: -I <proxy> -p <proxy-port> -u <check-url> -S(sl) -j CONNECT -H <webserver>"));
+  printf (" %s\n", _("a STATE_OK will be returned. When the server returns its content but exceeds"));
+  printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
+  printf (" %s\n", _("a STATE_CRITICAL will be returned."));
+
 #endif
 
   printf (UT_SUPPORT);
diff --git a/plugins/check_ide_smart.c b/plugins/check_ide_smart.c
index 47605e9..8d540ca 100644
--- a/plugins/check_ide_smart.c
+++ b/plugins/check_ide_smart.c
@@ -234,10 +234,10 @@ main (int argc, char *argv[])
                         break;
                 case 'h':
                         print_help ();
-                        return STATE_OK;
+                        return STATE_UNKNOWN;
                 case 'V':
                         print_revision (progname, NP_VERSION);
-                        return STATE_OK;
+                        return STATE_UNKNOWN;
                 default:
                         usage5 ();
                 }
@@ -249,7 +249,7 @@ main (int argc, char *argv[])
 
         if (!device) {
                 print_help ();
-                return STATE_OK;
+                return STATE_UNKNOWN;
         }
 
         fd = open (device, OPEN_MODE);
diff --git a/plugins/check_ldap.c b/plugins/check_ldap.c
index cfc8222..e70d6a5 100644
--- a/plugins/check_ldap.c
+++ b/plugins/check_ldap.c
@@ -325,10 +325,10 @@ process_arguments (int argc, char **argv)
                 switch (c) {
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 't':                                                                       /* timeout period */
                         if (!is_intnonneg (optarg))
                                 usage2 (_("Timeout interval must be a positive integer"), optarg);
diff --git a/plugins/check_load.c b/plugins/check_load.c
index cde63e5..a96435f 100644
--- a/plugins/check_load.c
+++ b/plugins/check_load.c
@@ -251,10 +251,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case '?':                                                                       /* help */
                         usage5 ();
                 }
diff --git a/plugins/check_mrtg.c b/plugins/check_mrtg.c
index cf3fe04..1fda549 100644
--- a/plugins/check_mrtg.c
+++ b/plugins/check_mrtg.c
@@ -234,10 +234,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case '?':                                                                       /* help */
                         usage5 ();
                 }
diff --git a/plugins/check_mrtgtraf.c b/plugins/check_mrtgtraf.c
index 3b038cf..eb66f62 100644
--- a/plugins/check_mrtgtraf.c
+++ b/plugins/check_mrtgtraf.c
@@ -270,10 +270,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case '?':                                                                       /* help */
                         usage5 ();
                 }
diff --git a/plugins/check_mysql.c b/plugins/check_mysql.c
index 216626b..5773afd 100644
--- a/plugins/check_mysql.c
+++ b/plugins/check_mysql.c
@@ -444,10 +444,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'v':
                         verbose++;
                         break;
diff --git a/plugins/check_mysql_query.c b/plugins/check_mysql_query.c
index 71ab776..49a14dd 100644
--- a/plugins/check_mysql_query.c
+++ b/plugins/check_mysql_query.c
@@ -250,10 +250,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'q':
                         xasprintf(&sql_query, "%s", optarg);
                         break;
diff --git a/plugins/check_nagios.c b/plugins/check_nagios.c
index 791b6db..40d68f0 100644
--- a/plugins/check_nagios.c
+++ b/plugins/check_nagios.c
@@ -235,10 +235,10 @@ process_arguments (int argc, char **argv)
                 switch (c) {
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'F':                                                                       /* status log */
                         status_log = optarg;
                         break;
diff --git a/plugins/check_nt.c b/plugins/check_nt.c
index f621b0a..59c135d 100644
--- a/plugins/check_nt.c
+++ b/plugins/check_nt.c
@@ -553,10 +553,10 @@ int process_arguments(int argc, char **argv){
                         usage5 ();
                         case 'h': /* help */
                                 print_help();
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                         case 'V': /* version */
                                 print_revision(progname, NP_VERSION);
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                         case 'H': /* hostname */
                                 server_address = optarg;
                                 break;
diff --git a/plugins/check_ntp.c b/plugins/check_ntp.c
index a7d278d..75efc28 100644
--- a/plugins/check_ntp.c
+++ b/plugins/check_ntp.c
@@ -691,11 +691,11 @@ int process_arguments(int argc, char **argv){
                 switch (c) {
                 case 'h':
                         print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                         break;
                 case 'V':
                         print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                         break;
                 case 'v':
                         verbose++;
diff --git a/plugins/check_ntp_peer.c b/plugins/check_ntp_peer.c
index 44424af..c656b0f 100644
--- a/plugins/check_ntp_peer.c
+++ b/plugins/check_ntp_peer.c
@@ -448,11 +448,11 @@ int process_arguments(int argc, char **argv){
                 switch (c) {
                 case 'h':
                         print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                         break;
                 case 'V':
                         print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                         break;
                 case 'v':
                         verbose++;
diff --git a/plugins/check_ntp_time.c b/plugins/check_ntp_time.c
index e344f8b..295f86f 100644
--- a/plugins/check_ntp_time.c
+++ b/plugins/check_ntp_time.c
@@ -477,11 +477,11 @@ int process_arguments(int argc, char **argv){
                 switch (c) {
                 case 'h':
                         print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                         break;
                 case 'V':
                         print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                         break;
                 case 'v':
                         verbose++;
diff --git a/plugins/check_nwstat.c b/plugins/check_nwstat.c
index 1a7bfa1..e7e8de0 100644
--- a/plugins/check_nwstat.c
+++ b/plugins/check_nwstat.c
@@ -1354,10 +1354,10 @@ int process_arguments(int argc, char **argv) {
                         usage5 ();
                         case 'h': /* help */
                                 print_help();
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                         case 'V': /* version */
                                 print_revision(progname, NP_VERSION);
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                         case 'H': /* hostname */
                                 server_address=optarg;
                                 break;
diff --git a/plugins/check_overcr.c b/plugins/check_overcr.c
index af5eb9b..9a4d25f 100644
--- a/plugins/check_overcr.c
+++ b/plugins/check_overcr.c
@@ -340,10 +340,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'H':                                                                       /* hostname */
                         server_address = optarg;
                         break;
diff --git a/plugins/check_pgsql.c b/plugins/check_pgsql.c
index 9bad1ec..2eb699e 100644
--- a/plugins/check_pgsql.c
+++ b/plugins/check_pgsql.c
@@ -302,10 +302,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':     /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':     /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 't':     /* timeout period */
                         if (!is_integer (optarg))
                                 usage2 (_("Timeout interval must be a positive integer"), optarg);
diff --git a/plugins/check_ping.c b/plugins/check_ping.c
index dbc5c3e..423ecbe 100644
--- a/plugins/check_ping.c
+++ b/plugins/check_ping.c
@@ -224,11 +224,11 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                         break;
                 case 'V':       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                         break;
                 case 't':       /* timeout period */
                         timeout_interval = atoi (optarg);
diff --git a/plugins/check_procs.c b/plugins/check_procs.c
index 402aac5..4bcc56b 100644
--- a/plugins/check_procs.c
+++ b/plugins/check_procs.c
@@ -428,10 +428,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 't':                                                                       /* timeout period */
                         if (!is_integer (optarg))
                                 usage2 (_("Timeout interval must be a positive integer"), optarg);
diff --git a/plugins/check_radius.c b/plugins/check_radius.c
index b294347..03cbb8b 100644
--- a/plugins/check_radius.c
+++ b/plugins/check_radius.c
@@ -259,10 +259,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (OK);
+                        exit (STATE_UNKNOWN);
                 case 'v':                                                                       /* verbose mode */
                         verbose = TRUE;
                         break;
diff --git a/plugins/check_real.c b/plugins/check_real.c
index 00bd4d2..6491e6e 100644
--- a/plugins/check_real.c
+++ b/plugins/check_real.c
@@ -359,10 +359,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case '?':                                                                       /* usage */
                         usage5 ();
                 }
diff --git a/plugins/check_smtp.c b/plugins/check_smtp.c
index 2430453..56040ff 100644
--- a/plugins/check_smtp.c
+++ b/plugins/check_smtp.c
@@ -623,10 +623,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case '?':                                                                       /* help */
                         usage5 ();
                 }
diff --git a/plugins/check_snmp.c b/plugins/check_snmp.c
index 62e6b8b..28cc44d 100644
--- a/plugins/check_snmp.c
+++ b/plugins/check_snmp.c
@@ -709,10 +709,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'v': /* verbose */
                         verbose++;
                         break;
diff --git a/plugins/check_ssh.c b/plugins/check_ssh.c
index 3658965..8ccbd5a 100644
--- a/plugins/check_ssh.c
+++ b/plugins/check_ssh.c
@@ -128,10 +128,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'v':                                                                       /* verbose */
                         verbose = TRUE;
                         break;
diff --git a/plugins/check_swap.c b/plugins/check_swap.c
index 25e0bac..4d5a407 100644
--- a/plugins/check_swap.c
+++ b/plugins/check_swap.c
@@ -470,10 +470,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case '?':                                                                       /* error */
                         usage5 ();
                 }
diff --git a/plugins/check_tcp.c b/plugins/check_tcp.c
index a18c37a..6dc9aa9 100644
--- a/plugins/check_tcp.c
+++ b/plugins/check_tcp.c
@@ -237,7 +237,7 @@ main (int argc, char **argv)
         gettimeofday (&tv, NULL);
 
         result = np_net_connect (server_address, server_port, &sd, PROTOCOL);
-        if (result == STATE_CRITICAL) return STATE_CRITICAL;
+        if (result == STATE_CRITICAL) return econn_refuse_state;
 
 #ifdef HAVE_SSL
         if (flags & FLAG_SSL){
@@ -463,10 +463,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':                 /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                 /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'v':                 /* verbose mode */
                         flags |= FLAG_VERBOSE;
                         match_flags |= NP_MATCH_VERBOSE;
diff --git a/plugins/check_time.c b/plugins/check_time.c
index 3943742..baf8c59 100644
--- a/plugins/check_time.c
+++ b/plugins/check_time.c
@@ -231,10 +231,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'H':                                                                       /* hostname */
                         if (is_host (optarg) == FALSE)
                                 usage2 (_("Invalid hostname/address"), optarg);
diff --git a/plugins/check_ups.c b/plugins/check_ups.c
index 099881d..dc5a348 100644
--- a/plugins/check_ups.c
+++ b/plugins/check_ups.c
@@ -558,10 +558,10 @@ process_arguments (int argc, char **argv)
                         break;
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 }
         }
 
diff --git a/plugins/check_users.c b/plugins/check_users.c
index a009f20..54415a4 100644
--- a/plugins/check_users.c
+++ b/plugins/check_users.c
@@ -210,10 +210,10 @@ process_arguments (int argc, char **argv)
                         usage5 ();
                 case 'h':                                                                       /* help */
                         print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'V':                                                                       /* version */
                         print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                 case 'c':                                                                       /* critical */
                         if (!is_intnonneg (optarg))
                                 usage4 (_("Critical threshold must be a positive integer"));
diff --git a/plugins/netutils.c b/plugins/netutils.c
index 83f8942..705aaf0 100644
--- a/plugins/netutils.c
+++ b/plugins/netutils.c
@@ -161,6 +161,10 @@ process_request (const char *server_address, int server_port, int proto,
 int
 np_net_connect (const char *host_name, int port, int *sd, int proto)
 {
+        /* send back STATE_UNKOWN if there's an error
+           send back STATE_OK if we connect
+           send back STATE_CRITICAL if we can't connect.
+           Let upstream figure out what to send to the user. */
         struct addrinfo hints;
         struct addrinfo *r, *res;
         struct sockaddr_un su;
@@ -250,16 +254,14 @@ np_net_connect (const char *host_name, int port, int *sd, int proto)
         else if (was_refused) {
                 switch (econn_refuse_state) { /* a user-defined expected outcome */
                 case STATE_OK:
-                case STATE_WARNING:  /* user wants WARN or OK on refusal */
-                        return econn_refuse_state;
-                        break;
-                case STATE_CRITICAL: /* user did not set econn_refuse_state */
+                case STATE_WARNING:  /* user wants WARN or OK on refusal, or... */
+                case STATE_CRITICAL: /* user did not set econn_refuse_state, or wanted critical */
                         if (is_socket)
                                 printf("connect to file socket %s: %s\n", host_name, strerror(errno));
                         else
                                 printf("connect to address %s and port %d: %s\n",
                                        host_name, port, strerror(errno));
-                        return econn_refuse_state;
+                        return STATE_CRITICAL;
                         break;
                 default: /* it's a logic error if we do not end up in STATE_(OK|WARNING|CRITICAL) */
                         return STATE_UNKNOWN;
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index 43b1a5a..4f9c793 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -195,7 +195,9 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
 #  ifdef USE_OPENSSL
         X509 *certificate=NULL;
         X509_NAME *subj=NULL;
+        char timestamp[50] = "";
         char cn[MAX_CN_LENGTH]= "";
+        
         int cnlen =-1;
         int status=STATE_UNKNOWN;
 
@@ -204,7 +206,7 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
         struct tm stamp;
         float time_left;
         int days_left;
-        char timestamp[50] = "";
+        int time_remaining;
         time_t tm_t;
 
         certificate=SSL_get_peer_certificate(s);
@@ -258,7 +260,8 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
                 (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
         stamp.tm_min =
                 (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
-        stamp.tm_sec = 0;
+        stamp.tm_sec =
+                (tm->data[10 + offset] - '0') * 10 + (tm->data[11 + offset] - '0');
         stamp.tm_isdst = -1;
 
         time_left = difftime(timegm(&stamp), time(NULL));
@@ -269,21 +272,35 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
         if (days_left > 0 && days_left <= days_till_exp_warn) {
                 printf (_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, days_left, timestamp);
                 if (days_left > days_till_exp_crit)
-                        return STATE_WARNING;
+                        status = STATE_WARNING;
                 else
-                        return STATE_CRITICAL;
+                        status = STATE_CRITICAL;
+        } else if (days_left == 0 && time_left > 0) {
+                if (time_left >= 3600)
+                        time_remaining = (int) time_left / 3600;
+                else
+                        time_remaining = (int) time_left / 60;
+
+                printf (_("%s - Certificate '%s' expires in %u %s (%s)\n"),
+                        (days_left>days_till_exp_crit) ? "WARNING" : "CRITICAL", cn, time_remaining,
+                        time_left >= 3600 ? "hours" : "minutes", timestamp);
+
+                if ( days_left > days_till_exp_crit)
+                        status = STATE_WARNING;
+                else
+                        status = STATE_CRITICAL;
         } else if (time_left < 0) {
                 printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
                 status=STATE_CRITICAL;
         } else if (days_left == 0) {
-                printf (_("%s - Certificate '%s' expires today (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, timestamp);
+                printf (_("%s - Certificate '%s' just expired (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, timestamp);
                 if (days_left > days_till_exp_crit)
-                        return STATE_WARNING;
+                        status = STATE_WARNING;
                 else
-                        return STATE_CRITICAL;
+                        status = STATE_CRITICAL;
         } else {
                 printf(_("OK - Certificate '%s' will expire on %s.\n"), cn, timestamp);
-                status=STATE_OK;
+                status = STATE_OK;
         }
         X509_free(certificate);
         return status;
diff --git a/plugins/t/check_http.t b/plugins/t/check_http.t
index 2539a28..c2caec6 100644
--- a/plugins/t/check_http.t
+++ b/plugins/t/check_http.t
@@ -6,9 +6,10 @@
 
 use strict;
 use Test::More;
+use POSIX qw/mktime strftime/;
 use NPTest;
 
-plan tests => 30;
+plan tests => 42;
 
 my $successOutput = '/OK.*HTTP.*second/';
 
@@ -34,6 +35,8 @@ my $host_tcp_http2  = getTestParameter( "NP_HOST_TCP_HTTP2",
             "A host providing an index page containing the string 'monitoring'",
             "test.monitoring-plugins.org" );
 
+my $faketime = -x '/usr/bin/faketime' ? 1 : 0;
+
 
 $res = NPTest->testCmd(
         "./check_http $host_tcp_http -wt 300 -ct 600"
@@ -47,10 +50,10 @@ $res = NPTest->testCmd(
 like( $res->output, '/bob:there\r\ncarl:frown\r\n/', "Got headers with multiple -k options" );
 
 $res = NPTest->testCmd(
-        "./check_http $host_nonresponsive -wt 1 -ct 2"
+        "./check_http $host_nonresponsive -wt 1 -ct 2 -t 3"
         );
 cmp_ok( $res->return_code, '==', 2, "Webserver $host_nonresponsive not responding" );
-cmp_ok( $res->output, 'eq', "CRITICAL - Socket timeout after 10 seconds", "Output OK");
+cmp_ok( $res->output, 'eq', "CRITICAL - Socket timeout after 3 seconds", "Output OK");
 
 $res = NPTest->testCmd(
         "./check_http $hostname_invalid -wt 1 -ct 2"
@@ -112,6 +115,40 @@ SKIP: {
         $res = NPTest->testCmd( "./check_http www.verisign.com -C 1" );
         cmp_ok( $res->output, 'eq', $saved_cert_output, "Old syntax for cert checking still works");
 
+        # run some certificate checks with faketime
+        SKIP: {
+                skip "No faketime binary found", 12 if !$faketime;
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/OK - Certificate 'www.verisign.com' will expire on/, "Catch cert output");
+                is( $res->return_code, 0, "Catch cert output exit code" );
+                my($mon,$day,$hour,$min,$sec,$year) = ($res->output =~ /(\w+)\s+(\d+)\s+(\d+):(\d+):(\d+)\s+(\d+)\./);
+                if(!defined $year) {
+                    die("parsing date failed from: ".$res);
+                }
+                my $months = {'Jan' => 0, 'Feb' => 1, 'Mar' => 2, 'Apr' => 3, 'May' => 4, 'Jun' => 5, 'Jul' => 6, 'Aug' => 7, 'Sep' => 8, 'Oct' => 9, 'Nov' => 10, 'Dec' => 11};
+                my $ts   = mktime($sec, $min, $hour, $day, $months->{$mon}, $year-1900);
+                my $time = strftime("%Y-%m-%d %H:%M:%S", localtime($ts));
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' just expired/, "Output on expire date");
+                is( $res->return_code, 2, "Output on expire date" );
+
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-1))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expires in 0 minutes/, "cert expires in 1 second output");
+                is( $res->return_code, 2, "cert expires in 1 second exit code" );
+
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-120))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expires in 2 minutes/, "cert expires in 2 minutes output");
+                is( $res->return_code, 2, "cert expires in 2 minutes exit code" );
+
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-7200))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expires in 2 hours/, "cert expires in 2 hours output");
+                is( $res->return_code, 2, "cert expires in 2 hours exit code" );
+
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts+1))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expired on/, "Certificate expired output");
+                is( $res->return_code, 2, "Certificate expired exit code" );
+        };
+
         $res = NPTest->testCmd( "./check_http --ssl www.verisign.com -E" );
         like  ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' );
         like  ( $res->output, '/time_ssl=[\d\.]+/', 'Extended Performance Data SSL Output OK' );
diff --git a/plugins/tests/check_http.t b/plugins/tests/check_http.t
index d93a0ec..e72d243 100755
--- a/plugins/tests/check_http.t
+++ b/plugins/tests/check_http.t
@@ -186,21 +186,21 @@ SKIP: {
 
         $result = NPTest->testCmd( "$command -p $port_https -S -C 14" );
         is( $result->return_code, 0, "$command -p $port_https -S -C 14" );
-        is( $result->output, 'OK - Certificate \'Ton Voon\' will expire on Sun Mar  3 21:41:00 2019.', "output ok" );
+        is( $result->output, 'OK - Certificate \'Ton Voon\' will expire on Sun Mar  3 21:41:28 2019.', "output ok" );
 
         $result = NPTest->testCmd( "$command -p $port_https -S -C 14000" );
         is( $result->return_code, 1, "$command -p $port_https -S -C 14000" );
-        like( $result->output, '/WARNING - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:00 2019\)./', "output ok" );
+        like( $result->output, '/WARNING - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:28 2019\)./', "output ok" );
 
         # Expired cert tests
         $result = NPTest->testCmd( "$command -p $port_https -S -C 13960,14000" );
         is( $result->return_code, 2, "$command -p $port_https -S -C 13960,14000" );
-        like( $result->output, '/CRITICAL - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:00 2019\)./', "output ok" );
+        like( $result->output, '/CRITICAL - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:28 2019\)./', "output ok" );
 
         $result = NPTest->testCmd( "$command -p $port_https_expired -S -C 7" );
         is( $result->return_code, 2, "$command -p $port_https_expired -S -C 7" );
         is( $result->output,
-                'CRITICAL - Certificate \'Ton Voon\' expired on Thu Mar  5 00:13:00 2009.',
+                'CRITICAL - Certificate \'Ton Voon\' expired on Thu Mar  5 00:13:16 2009.',
                 "output ok" );
 
 }
diff --git a/plugins/utils.c b/plugins/utils.c
index 7f49e7b..a864e4a 100644
--- a/plugins/utils.c
+++ b/plugins/utils.c
@@ -144,8 +144,6 @@ usage5 (void)
 void
 print_revision (const char *command_name, const char *revision)
 {
-        char plugin_revision[STRLEN];
-
         printf ("%s v%s (%s %s)\n",
                  command_name, revision, PACKAGE, VERSION);
 }