Using Python to validate the Certbot expiration date.

src/functions/__init__.py

@@ -6,6 +6,8 @@ import time
 import os
 import re
 import time
+from OpenSSL import crypto
+
 
 class Functions:
     HAPROXY_LOG = "HAPROXY"
@@ -94,7 +96,7 @@ class Functions:
 
             return output
         except Exception as e:
-            Functions.log(source, Functions.ERROR, "%s" % (e))
+            Functions.log(source, Functions.ERROR, "%s" % e)
 
 
 class Consts:
@@ -103,6 +105,7 @@ class Consts:
     certs_letsencrypt = "/certs/letsencrypt"
     certs_haproxy = "/certs/haproxy"
 
+
 class DaemonizeHAProxy:
     def __init__(self):
         self.process = None
@@ -111,10 +114,13 @@ class DaemonizeHAProxy:
 
     def haproxy(self, action):
         if action == "start":
-            self.__prepare("/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock")
+            self.__prepare(
+                "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock")
         else:
             pid = "".join(Functions().run_bash(Functions.HAPROXY_LOG, "cat /run/haproxy.pid", log_output=False))
-            self.__prepare("/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -x /var/run/haproxy.sock -sf %s" % (pid))
+            self.__prepare(
+                "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -x /var/run/haproxy.sock -sf %s" % (
+                    pid))
 
         if self.process is None:
             return
@@ -136,8 +142,7 @@ class DaemonizeHAProxy:
                                             universal_newlines=True)
 
         except Exception as e:
-            Functions.log(source, Functions.ERROR, "%s" % (e))
-
+            Functions.log(source, Functions.ERROR, "%s" % e)
 
     def __start(self):
         source = Functions.HAPROXY_LOG
@@ -150,7 +155,7 @@ class DaemonizeHAProxy:
             Functions.log(source, Functions.DEBUG, "Return code %s" % (returncode))
 
         except Exception as e:
-            Functions.log(source, Functions.ERROR, "%s" % (e))
+            Functions.log(source, Functions.ERROR, "%s" % e)
 
     def is_alive(self):
         return self.thread.is_alive()
@@ -197,18 +202,27 @@ class Certbot:
             current_time = time.time()
             for host in hosts:
                 filename = "%s/%s.pem" % (self.certs, host)
-                host_arg = '-d %s' % (host)
+                host_arg = '-d %s' % host
                 if not os.path.exists(filename):
-                    Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Request new certificate for %s" % (host))
+                    Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Request new certificate for %s" % host)
                     request_certs.append(host_arg)
                 else:
-                    creation_time = os.path.getctime(filename)
-                    if (current_time - creation_time) // (24 * 3600) > 90:
-                        Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Request expired certificate for %s" % (host))
+                    try:
+                        with open(filename, 'r') as file:
+                            certificate_str = file.read()
+                        certificate = crypto.load_certificate(crypto.FILETYPE_PEM, certificate_str)
+                        expiration_after = datetime.strptime(certificate.get_notAfter().decode()[:-1],
+                                                             '%Y%m%d%H%M%S').timestamp()
+
+                        if current_time >= expiration_after:
+                            Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG,
+                                          "Request expired certificate for %s" % host)
                             request_certs.append(host_arg)
-                    if (current_time - creation_time) // (24 * 3600) >= 45:
-                        Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Renew certificate for %s" % (host))
+                        if (expiration_after - current_time) // (24 * 3600) >= 15:
+                            Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Renew certificate for %s" % host)
                             renew_certs.append(host_arg)
+                    except Exception as e:
+                        Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "Certificate %s error %s" % (host, e))
 
             certbot_certonly = ('/usr/bin/certbot certonly {test_server}'
                                 '    --standalone'
@@ -230,7 +244,7 @@ class Certbot:
                 ret_reload = True
 
             if len(renew_certs) > 0:
-                Functions.run_bash(Functions.CERTBOT_LOG, "/usb/bin/certbot renew", return_result=False)
+                Functions.run_bash(Functions.CERTBOT_LOG, "/usr/bin/certbot renew", return_result=False)
                 ret_reload = True
 
             if ret_reload:
@@ -238,7 +252,7 @@ class Certbot:
 
             return ret_reload
         except Exception as e:
-            Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "%s" % (e))
+            Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "%s" % e)
             return False
 
     def merge_certificate(self, cert, key, filename):

src/requirements.txt

@@ -5,3 +5,4 @@ pytest
 docker
 kubernetes
 deepdiff
+pyopenssl