鯖缶

証明書の失効日時 (の unix date) の取得: openssl s_client -connect DOMAIN:443 </dev/null 2>/dev/null | openssl x509 -noout -dates 2>/dev/null | sed -ne 's!^notAfter=\(.*\)$!\1!p' | date -f - '+%s'

できた。

Usage: restart-caddy-to-renew-certs.sh [HOST[:PORT]]...

#!/bin/sh
{{ ansible_managed | comment }}
set -eu

NOW="$(date '+%s')"
FORCE_RENEW_PERIOD='{{ __caddy_force_renew_grace_period }}'

while [ $# -gt 0 ] ; do
	# Note that `openssl s_client -connect` requires the `:port` part
	# even for the port 443.
	HOST_PORT="$1"
	if [ "x${HOST_PORT%:*}" = "x${HOST_PORT}" ] ; then
		# `:port` is omitted.
		HOST_PORT="${HOST_PORT}:443"
	fi

	NOW="$(date '+%s')"
	NOT_AFTER="$(timeout 3 openssl s_client -connect "$HOST_PORT" </dev/null 2>/dev/null | openssl x509 -noout -dates 2>/dev/null | sed -ne 's!^notAfter=\(.*\)$!\1!p' | date -f - '+%s')"

	if [ "x${NOT_AFTER:-}" = x ] ; then
		# Cannot connect. Skip.
		echo "Skipping due to connection failure: domain=${HOST_PORT}"
		shift
		continue
	fi

	if [ "$(( $NOW + $FORCE_RENEW_PERIOD ))" -gt "$NOT_AFTER" ] ; then
		echo "Trying force renewal by restart: domain=${HOST_PORT}, notAfter=$(date -d "$NOT_AFTER" '+%F_%T%:z')"
		# The certificate will expire in FORCE_RENEW_PERIOD seconds
		# (or already have been expired).
		systemctl try-restart caddy.service

		# Renewal will take some seconds.
		sleep 10
		continue
	else
		shift
	fi
done

# vim: set ft=sh :