package main

import (
	"crypto/tls"
	"fmt"
)

func main() {
	conn, _ := tls.Dial("tcp", "www.baidu.com:443", nil)
	cert := conn.ConnectionState().PeerCertificates[0]

	// 時(shí)間信息
	fmt.Printf("NotBefore: %v\n", cert.NotBefore)
	// NotBefore: 2022-07-05 05:16:02 +0000 UTC

	fmt.Printf("NotAfter: %v\n", cert.NotAfter)
	// NotAfter: 2023-08-06 05:16:01 +0000 UTC

	// 其他信息
	fmt.Printf("IPAddresses: %v\n", cert.IPAddresses)
	// IPAddresses: []
	fmt.Printf("IPAddresses: %v\n", conn.RemoteAddr())
	// IPAddresses: 220.181.38.150:443
	fmt.Printf("Version: %v\n", cert.Version)
	fmt.Printf("SerialNumber: %v\n", cert.SerialNumber)
	fmt.Printf("Issuer: %v\n", cert.Issuer)
	fmt.Printf("Subject: %v\n", cert.Subject)
}

package main
import (
    "crypto/tls"
    "fmt"
    "net"
    "time"
)
// CheckSSLCertExpiry 檢查給定域名的 SSL 證書有效期，返回剩余天數(shù)
func CheckSSLCertExpiry(domain string) (int, error) {
    // 1. 配置 tls.Config
    // InsecureSkipVerify: true 用來繞過證書本身的校驗(yàn)，否則證書過期或無效時(shí)連接會(huì)失敗，我們反而拿不到證書信息。
    // ServerName: 顯式設(shè)置 SNI，對(duì)于使用 CDN 的網(wǎng)站尤其重要，以防止獲取到錯(cuò)誤的默認(rèn)證書。
    conf := &tls.Config{
        InsecureSkipVerify: true,
        ServerName:         domain,
    }
    // 2. 建立 TLS 連接
    // 設(shè)置一個(gè)連接超時(shí)，防止網(wǎng)絡(luò)問題導(dǎo)致程序長(zhǎng)時(shí)間阻塞。
    dialer := &net.Dialer{Timeout: 10 * time.Second}
    conn, err := tls.DialWithDialer(dialer, "tcp", fmt.Sprintf("%s:443", domain), conf)
    if err != nil {
        return 0, fmt.Errorf("failed to connect to %s: %w", domain, err)
    }
    defer conn.Close()
    // 3. 獲取證書鏈
    // PeerCertificates 返回的是對(duì)端發(fā)送的證書鏈，第一個(gè)元素 (索引0) 通常是服務(wù)器本身的證書（葉子證書）。
    certs := conn.ConnectionState().PeerCertificates
    if len(certs) == 0 {
        return 0, fmt.Errorf("no certificates found for %s", domain)
    }
    leafCert := certs[0]
    // 4. 計(jì)算剩余天數(shù)
    // NotAfter 是 UTC 時(shí)間，time.Now() 返回的是本地時(shí)間，但 Go 的 time 包在比較時(shí)會(huì)自動(dòng)轉(zhuǎn)換到同一時(shí)區(qū)，所以直接相減是安全的。
    // 使用 math.Ceil 確保剩余天數(shù)向上取整，避免因精度問題將 "剩余0.9天" 顯示為 "0天"。
    remaining := time.Until(leafCert.NotAfter)
    days := int(remaining.Hours() / 24)
    if remaining.Hours() > 0 && days == 0 {
        days = 1
    }
    return days, nil
}
func main() {
    // 示例：檢查 example.com 的證書有效期
    domain := "www.baidu.com"
    days, err := CheckSSLCertExpiry(domain)
    if err != nil {
        fmt.Printf("Error: %v\n", err)
        return
    }
    fmt.Printf("SSL certificate for %s is valid for %d more days.\n", domain, days)
}

package main
import (
    "crypto/x509"
    "encoding/pem"
    "fmt"
    "io/ioutil"
    "time"
)
func main() {
    certPEM, err := ioutil.ReadFile("path/to/certificate.pem")
    if err != nil {
        fmt.Println("Error reading certificate file:", err)
        return
    }
    block, _ := pem.Decode(certPEM)
    if block == nil {
        fmt.Println("Failed to parse certificate PEM")
        return
    }
    cert, err := x509.ParseCertificate(block.Bytes)
    if err != nil {
        fmt.Println("Error parsing certificate:", err)
        return
    }
    fmt.Println("Certificate Expiry Date:", cert.NotAfter)
    now := time.Now()
    if now.Before(cert.NotBefore) {
        fmt.Println("Certificate is not yet valid")
    } else if now.After(cert.NotAfter) {
        fmt.Println("Certificate has expired")
    } else {
        fmt.Println("Certificate is valid")
    }
}

func GetDomainSslExpireDate(domain string) string {
	if !strings.HasPrefix(domain, "http") {
		domain = fmt.Sprint("https://", domain)
	}
	command := fmt.Sprint("curl -v -I -k ", domain)
	cmd := exec.Command("/bin/bash", "-c", command)
	output, err := cmd.CombinedOutput()
	if err != nil {
		return time.Time{}
	}
	outStr := string(output)
	outArr := strings.Split(outStr, "\n")
	for _, out := range outArr {
		if strings.Contains(out, "expire date") {
			return out[strings.Index(out, ":")+1:]
			return StrToDate(dateStr)
		}
	}
	return ""
}