Check SMTP server revocation status

smtp-revoke.sh

#!/usr/bin/env bash

if [ "$#" -eq 0 ];
then
    echo "pass host to scan"
    exit 1
fi

server=$1
mxserver=`dig mx $server +short 2>/dev/null | tail -1 | cut -d ' ' -f2`

if [ -z "$mxserver" ];
then
    echo "$server [unable to find MX]"
    exit 2
fi

#echo "Host: ${server}"
#echo "MX: ${mxserver}"

details=$(echo EOF | timeout 3 openssl s_client -CApath /etc/ssl/certs/ -starttls smtp -crlf -showcerts -connect ${mxserver}:25 2>/dev/null)

if [ -z "$details" ];
then
    echo "$server: SSL Timeout"
    exit 5
fi

verify=$(echo "${details}" | grep "Verify return code:" | cut -d ':' -f 2)

verifyCode=$(echo ${verify} | cut -d ' ' -f 1)
if [ ${verifyCode} != "0" ]; then
    echo "${verify}"
    exit 4
fi

cert=$(echo "${details}" | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p')

crl_url=$(echo "${cert}" | openssl x509 -text | grep crl | cut -d':' -f 2- )

if [ -z "$crl_url" ];
then
    echo "No CRL_URL found!"
    exit 3
fi

#echo "CRL_URL: ${crl_url}"

crl=$(curl -s ${crl_url} | openssl crl -inform der)

result=$(echo "${cert}" | openssl verify -crl_check -CAfile <(echo -e "${cert}\n${crl}") | tail -1)

result=$(echo "${result}" | cut -d ':' -f 2)

echo "${result}"