Python 自动检测服务HTTPS证书过期时间并发送预警

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
HTTPS 证书过期时间自动检测与邮件预警脚本
"""

import ssl
import socket
from datetime import datetime
import smtplib
from email.mime.text import MIMEText
from email.header import Header
from typing import List, Tuple

# ============ 用户配置区域 ============
# 需要监控的域名列表
DOMAINS_TO_CHECK = [
    " www.example.com ",
    "api.example.com",
    "blog.example.org",
]
# 预警阈值（天）：证书剩余有效期少于等于此值时触发预警
WARNING_THRESHOLD_DAYS = 30
# 邮件服务器配置
SMTP_SERVER = "smtp.office365.com"  # 例如：smtp.gmail.com, smtp.qq.com
SMTP_PORT = 587
SENDER_EMAIL = "your_monitor@example.com"
SENDER_PASSWORD = "your_app_password"  # 注意：建议使用应用专用密码，而非邮箱登录密码
RECIPIENT_EMAILS = ["admin@example.com", "ops@example.com"]
# ============ 配置结束 ============

def get_cert_expiry_date(hostname: str, port: int = 443) -> datetime:
    """
    获取指定主机和端口的 SSL 证书过期日期。

    Args:
        hostname: 目标主机名
        port: 端口号，默认为 443

    Returns:
        datetime: 证书过期时间（UTC）
    """
    context = ssl.create_default_context()
    with socket.create_connection((hostname, port), timeout=10) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            cert = ssock.getpeercert()
            # 证书中的日期格式为：'Aug 28 12:00:00 2025 GMT'
            expire_str = cert['notAfter']
            # 解析字符串为 datetime 对象
            expire_date = datetime.strptime(expire_str, '%b %d %H:%M:%S %Y %Z')
            return expire_date

def check_domains(domains: List[str]) -> List[Tuple[str, datetime, int]]:
    """
    检查域名列表，返回需要预警的域名及其信息。

    Args:
        domains: 待检查的域名列表

    Returns:
        List[Tuple]: 每个元素为 (域名, 过期时间, 剩余天数) 的元组，仅包含需要预警的域名。
    """
    warning_list = []
    current_time = datetime.utcnow()

    for domain in domains:
        try:
            expiry_date = get_cert_expiry_date(domain)
            days_left = (expiry_date - current_time).days
            print(f"[INFO] 域名: {domain:20s} 过期时间: {expiry_date.date()} 剩余天数: {days_left:3d}")

            if days_left <= WARNING_THRESHOLD_DAYS:
                warning_list.append((domain, expiry_date, days_left))
        except socket.gaierror:
            print(f"[ERROR] 无法解析域名: {domain}")
        except (socket.timeout, ConnectionRefusedError, ssl.SSLError) as e:
            print(f"[ERROR] 连接 {domain} 失败: {e}")
        except Exception as e:
            print(f"[ERROR] 检查 {domain} 时发生未知错误: {e}")

    return warning_list

def send_warning_email(warning_list: List[Tuple[str, datetime, int]]) -> None:
    """
    发送证书过期预警邮件。

    Args:
        warning_list: 由 check_domains 函数生成的预警列表。
    """
    if not warning_list:
        print("[INFO] 没有证书需要预警，邮件未发送。")
        return

    # 构建邮件正文
    email_body_lines = ["【重要】HTTPS 证书过期预警通知\n"]
    email_body_lines.append(f"以下服务的 SSL/TLS 证书将在 {WARNING_THRESHOLD_DAYS} 天内过期，请及时处理！\n")
    email_body_lines.append("-" * 50)
    for domain, expiry_date, days_left in warning_list:
        email_body_lines.append(f"域名: {domain}")
        email_body_lines.append(f"过期时间: {expiry_date.strftime('%Y-%m-%d %H:%M:%S UTC')}")
        email_body_lines.append(f"剩余天数: {days_left} 天\n")

    email_body_lines.append("-" * 50)
    email_body_lines.append(f"生成时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    email_body = "\n".join(email_body_lines)

    # 构建邮件
    subject = f"HTTPS 证书过期预警 ({len(warning_list)} 个服务)"
    msg = MIMEText(email_body, 'plain', 'utf-8')
    msg['From'] = Header(f"证书监控系统 <{SENDER_EMAIL}>", 'utf-8')
    msg['To'] = Header(",".join(RECIPIENT_EMAILS), 'utf-8')
    msg['Subject'] = Header(subject, 'utf-8')

    # 发送邮件
    try:
        with smtplib.SMTP(SMTP_SERVER, SMTP_PORT) as server:
            server.starttls()  # 启用 TLS 加密
            server.login(SENDER_EMAIL, SENDER_PASSWORD)
            server.sendmail(SENDER_EMAIL, RECIPIENT_EMAILS, msg.as_string())
        print(f"[SUCCESS] 预警邮件已发送至 {RECIPIENT_EMAILS}")
    except Exception as e:
        print(f"[FAILED] 邮件发送失败: {e}")

def main():
    """主函数"""
    print("=" * 60)
    print("开始执行 HTTPS 证书过期检查...")
    print("=" * 60)

    # 1. 检查所有配置的域名
    need_warning_domains = check_domains(DOMAINS_TO_CHECK)

    # 2. 如果有需要预警的域名，则发送邮件
    if need_warning_domains:
        send_warning_email(need_warning_domains)
    else:
        print("[INFO] 所有证书状态正常，无需预警。")

    print("=" * 60)
    print("检查完成。")
    print("=" * 60)

if __name__ == "__main__":
    main()