# 检查服务器支持的 TLS 版本
openssl s_client -connect www.baidu.com:443 -tls1_2 </dev/null 2>/dev/null | grep "Protocol"
openssl s_client -connect www.baidu.com:443 -tls1_3 </dev/null 2>/dev/null | grep "Protocol"

# 完整验证过程
echo | openssl s_client -connect github.com:443 -servername github.com \
  -verify 5 -verify_return_error -status \
  -CApath /etc/ssl/certs 2>&1 | grep -E "Verify|verify|depth|OCSP"

# 输出示例：
# depth=2 C=US, O=DigiCert Inc, CN=DigiCert Global Root G3
# depth=1 C=US, CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1
# depth=0 CN=github.com
# Verify return code: 0 (ok)
# OCSP Response Status: successful (0)

# 查看证书有效期
echo | openssl s_client -connect expired.badssl.com:443 2>/dev/null \
  | openssl x509 -noout -dates

# 输出：
# notBefore=Apr  9 00:00:00 2015 GMT
# notAfter=Apr 12 23:59:59 2015 GMT
# ↑ 已过期

# 验证过期证书会报错
openssl s_client -connect expired.badssl.com:443 </dev/null 2>&1 | grep "Verify"
# Verify return code: 10 (certificate has expired)

# 手动验证签名
# 1. 获取证书
echo | openssl s_client -connect www.baidu.com:443 2>/dev/null \
  | openssl x509 > leaf.pem

# 2. 获取签发者证书（中间证书）
echo | openssl s_client -connect www.baidu.com:443 -showcerts 2>/dev/null \
  | awk '/BEGIN/{n++} n==2' > intermediate.pem

# 3. 验证签名
openssl verify -CAfile intermediate.pem leaf.pem

# 查看证书的 AIA 扩展
echo | openssl s_client -connect www.baidu.com:443 2>/dev/null \
  | openssl x509 -noout -text | grep -A2 "Authority Information Access"

# 输出示例：
# Authority Information Access:
#     OCSP - URI:http://ocsp.digicert.com
#     CA Issuers - URI:http://cacerts.digicert.com/DigiCertSecureSiteCNCAG3.crt

# 使用 openssl 验证证书链
# -CAfile: 指定信任的根证书
# -untrusted: 指定中间证书
openssl verify \
  -CAfile /etc/ssl/certs/ca-certificates.crt \
  -untrusted chain.pem \
  leaf.pem

# 如果缺少中间证书，可能报错：
# error 2 at 1 depth lookup: unable to get issuer certificate

# 查看系统信任锚点数量
ls /etc/ssl/certs/*.pem 2>/dev/null | wc -l
# 输出: 130+ (Ubuntu)

# 列出信任锚点摘要
for cert in /etc/ssl/certs/*.pem; do
  subject=$(openssl x509 -in "$cert" -noout -subject 2>/dev/null)
  if echo "$subject" | grep -q "Root"; then
    echo "$subject"
  fi
done | head -20

# 添加自定义 CA 为信任锚点（Debian/Ubuntu）
sudo cp my-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# 验证
openssl verify /path/to/cert-signed-by-my-ca.pem

# 获取 OCSP 响应者 URL
echo | openssl s_client -connect www.baidu.com:443 2>/dev/null \
  | openssl x509 -noout -ocsp_uri
# 输出: http://ocsp.digicert.com

# 发送 OCSP 查询
# 1. 提取证书和签发者证书
echo | openssl s_client -connect www.baidu.com:443 -showcerts 2>/dev/null > chain.pem

# 2. 构建 OCSP 请求
openssl ocsp \
  -issuer intermediate.pem \
  -cert leaf.pem \
  -url http://ocsp.digicert.com \
  -resp_text -no_nonce

# 输出示例：
# Response Status: successful (0)
# Cert Status: good         ← 证书有效
# This Update: May  8 00:00:00 2025 GMT
# Next Update: May 15 00:00:00 2025 GMT

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate      /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key  /etc/nginx/ssl/privkey.pem;

    # 启用 OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # 指定信任的 CA 证书链（用于验证 OCSP 响应）
    ssl_trusted_certificate /etc/nginx/ssl/chain.pem;

    # DNS 解析器
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
}

# 验证 OCSP Stapling 是否生效
echo | openssl s_client -connect example.com:443 -status 2>/dev/null \
  | grep -A2 "OCSP Response"

# 输出：
# OCSP Response Status: successful (0)
# Cert Status: good

# 获取 CRL 分发点
echo | openssl s_client -connect www.baidu.com:443 2>/dev/null \
  | openssl x509 -noout -text | grep -A2 "CRL Distribution Points"

# 下载并查看 CRL
curl -s "http://crl3.digicert.com/DigiCertGlobalRootG3.crl" > ca.crl
openssl crl -in ca.crl -noout -text | head -20

# 检查证书中的 SCT
echo | openssl s_client -connect www.google.com:443 -ct 2>/dev/null \
  | grep -A5 "SCT"

# 使用 crt.sh 查询域名的 CT 日志
curl -s "https://crt.sh/?q=baidu.com&output=json" | jq '.[0:3] | .[] | {issuer_name, not_before, not_after}'

# SSL 会话缓存
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;

# Session Ticket
ssl_session_tickets on;
# 建议定期轮换 ticket key
ssl_session_ticket_key /etc/nginx/ssl/ticket.key;

# Nginx（需要 OpenSSL 3.0+）
ssl_certificate_compression zlib;

#!/usr/bin/env bash
# ssl-verify.sh - 全面验证目标站点的证书状态
# 用法: ./ssl-verify.sh <hostname> [port]

set -euo pipefail

HOST="${1:?用法: $0 <hostname> [port]}"
PORT="${2:-443}"

echo "========================================="
echo " SSL/TLS 证书验证报告: ${HOST}:${PORT}"
echo "========================================="
echo ""

# 1. 获取证书信息
CERT_INFO=$(echo | openssl s_client -connect "${HOST}:${PORT}" \
  -servername "${HOST}" -status 2>/dev/null)

echo "【1. 基本信息】"
echo "$CERT_INFO" | openssl x509 -noout \
  -subject -issuer -dates -serial -fingerprint 2>/dev/null
echo ""

# 2. 验证证书链
echo "【2. 证书链验证】"
VERIFY_RESULT=$(echo | openssl s_client -connect "${HOST}:${PORT}" \
  -servername "${HOST}" -verify 5 -CApath /etc/ssl/certs 2>&1)
echo "$VERIFY_RESULT" | grep -E "Verify|depth"
echo ""

# 3. 证书链详情
echo "【3. 证书链详情】"
echo "$CERT_INFO" | grep -E "^ [0-9] s:|^   i:" 2>/dev/null
echo ""

# 4. OCSP 状态
echo "【4. OCSP 状态】"
if echo "$CERT_INFO" | grep -q "OCSP Response Status: successful"; then
  echo "OCSP Stapling: ✅ 已启用"
  echo "$CERT_INFO" | grep "Cert Status"
else
  echo "OCSP Stapling: ❌ 未启用"
fi
echo ""

# 5. TLS 版本
echo "【5. TLS 版本】"
for ver in tls1_2 tls1_3; do
  if echo | openssl s_client -connect "${HOST}:${PORT}" \
    -servername "${HOST}" -"${ver}" </dev/null 2>/dev/null | grep -q "Protocol.*TLSv"; then
    PROTO=$(echo | openssl s_client -connect "${HOST}:${PORT}" \
      -servername "${HOST}" -"${ver}" </dev/null 2>/dev/null | grep "Protocol" | awk '{print $NF}')
    echo "  ${ver}: ✅ 支持 (${PROTO})"
  else
    echo "  ${ver}: ❌ 不支持"
  fi
done
echo ""

# 6. 密码套件
echo "【6. 协商的密码套件】"
echo "$CERT_INFO" | grep "Cipher is"
echo ""

# 7. 天数检查
echo "【7. 有效期检查】"
NOT_AFTER=$(echo | openssl s_client -connect "${HOST}:${PORT}" \
  -servername "${HOST}" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null \
  | cut -d= -f2)
EXPIRE_EPOCH=$(date -d "$NOT_AFTER" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$NOT_AFTER" +%s 2>/dev/null)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( (EXPIRE_EPOCH - NOW_EPOCH) / 86400 ))

if [ "$DAYS_LEFT" -gt 30 ]; then
  echo "  证书剩余天数: ${DAYS_LEFT} 天 ✅"
elif [ "$DAYS_LEFT" -gt 0 ]; then
  echo "  证书剩余天数: ${DAYS_LEFT} 天 ⚠️ 即将过期！"
else
  echo "  证书已过期 ${DAYS_LEFT#-} 天 ❌"
fi

echo ""
echo "========================================="
echo " 验证完成"
echo "========================================="

# 运行示例
chmod +x ssl-verify.sh
./ssl-verify.sh github.com
./ssl-verify.sh www.baidu.com