#!/usr/bin/env bash
# ssl-expire host[:port] [threshold_days]
set -Eeuo pipefail
[[ $# -ge 1 ]] || { echo "usage: ssl-expire host[:port] [threshold_days]"; exit 2; }
t="$1"; th="${2:-14}"
host="${t%:*}"; port="${t##*:}"; [[ "$host" == "$port" ]] && port=443
end=$(echo | openssl s_client -servername "$host" -connect "$host:$port" 2>/dev/null \
      | openssl x509 -noout -enddate | cut -d= -f2) || { echo "cannot fetch cert"; exit 1; }
end_s=$(date -d "$end" +%s); now_s=$(date +%s); days=$(( (end_s - now_s) / 86400 ))
(( days < 0 )) && { echo "EXPIRED ${days#-}d ago ($host:$port)"; exit 1; }
(( days <= th )) && { echo "WARN $host:$port expires in ${days}d (<=${th})"; exit 1; }
echo "OK $host:$port ${days}d left"

ssl-expire example.com, ssl-expire example.com:8443 7