IBM Maximo: Script to check router certificates on MAS

Script para coletar todas as Routes em mas-dev01-core e mas-dev01-manage e verificar detalhadamente os certificados TLS associados.

Script

#!/usr/bin/env bash


set -uo pipefail

NAMESPACES=("mas-dev01-core" "mas-dev01-manage")

OUTPUT_FILE="report-certificates-routes.txt"

exec > >(tee -i "${OUTPUT_FILE}") 2>&1

echo "========================================================================"
echo " RELATÓRIO DE CERTIFICADOS TLS DAS ROUTES"
echo " Namespaces: ${NAMESPACES[*]}"
echo " Data/Hora: $(date '+%Y-%m-%d %H:%M:%S')"
echo "========================================================================"
echo ""

for ns in "${NAMESPACES[@]}"; do
    echo "########################################################################"
    echo " NAMESPACE: $ns"
    echo "########################################################################"
    
    ROUTES=$(oc get routes -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "")
    
    if [ -z "$ROUTES" ]; then
        echo "Nenhuma Route encontrada no namespace $ns."
        echo ""
        continue
    fi
    
    for route in $ROUTES; do
        echo "------------------------------------------------------------------------"
        echo " Route: $route"
        
        HOST=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.host}')
        TERMINATION=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.tls.termination}')
        INSECURE_POLICY=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.tls.insecureEdgeTerminationPolicy}')
        
        echo " Host: $HOST"
        echo " Terminação TLS: ${TERMINATION:-'Nenhuma (HTTP/Sem TLS)'}"
        echo " Política Insegura: ${INSECURE_POLICY:-'None'}"
        
        # Extrai certificado embutido na Route
        CERT=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.tls.certificate}')
        CA_CERT=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.tls.caCertificate}')
        DEST_CA=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.tls.destinationCACertificate}')
        
        if [ -n "$CERT" ]; then
            echo ""
            echo " [✓] Certificado Customizado Presente na Route:"
            echo "$CERT" | openssl x509 -noout -subject -issuer -dates 2>/dev/null || echo "     Erro ao parsear certificado com OpenSSL."
            
            # SANs
            SANS=$(echo "$CERT" | openssl x509 -noout -ext subjectAltName 2>/dev/null | grep -v "X509v3" | sed 's/^[ \t]*//' || true)
            if [ -n "$SANS" ]; then
                echo "     SANs: $SANS"
            fi
            
            # Validação de data
            if ! echo "$CERT" | openssl x509 -checkend 0 -noout 2>/dev/null; then
                echo "     [!] STATUS: CERTIFICADO EXPIRADO!"
            else
                echo "     [✓] STATUS: VÁLIDO"
            fi
        else
            if [ -z "$TERMINATION" ]; then
                echo " [!] Sem terminação TLS configurada."
            elif [ "$TERMINATION" == "passthrough" ]; then
                echo " [i] Terminação Passthrough (Certificado gerenciado diretamente pelo Pod/Backend)."
            else
                echo " [i] Usa o Certificado Padrão do Ingress do OpenShift (*.apps...)."
            fi
        fi

        if [ -n "$CA_CERT" ]; then
            echo ""
            echo " [i] CA Certificate na Route:"
            echo "$CA_CERT" | openssl x509 -noout -subject -issuer -dates 2>/dev/null || echo "     Erro ao parsear CA cert."
        fi

        if [ -n "$DEST_CA" ]; then
            echo ""
            echo " [i] Destination CA Certificate (para reencrypt):"
            echo "$DEST_CA" | openssl x509 -noout -subject -issuer -dates 2>/dev/null || echo "     Erro ao parsear Destination CA."
        fi
        
        echo ""
    done
    echo ""
done

echo "========================================================================"
echo " Resumo e Verificação de Conectividade TLS Externa (via OpenSSL s_client)"
echo "========================================================================"

for ns in "${NAMESPACES[@]}"; do
    ROUTES=$(oc get routes -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "")
    for route in $ROUTES; do
        HOST=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.host}')
        TERMINATION=$(oc get route "$route" -n "$ns" -o jsonpath='{.spec.tls.termination}')
        
        if [ -n "$TERMINATION" ] && [ -n "$HOST" ]; then
            echo -n "Testando handshake TLS em $HOST:443 ... "
            # Tenta conectar via porta 443 com timeout de 3s
            RESP=$(timeout 3 openssl s_client -connect "${HOST}:443" -servername "$HOST" </dev/null 2>&1 || true)
            if echo "$RESP" | grep -q "CONNECTED"; then
                EXP_DATE=$(echo "$RESP" | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2 || echo "N/A")
                SUBJECT=$(echo "$RESP" | openssl x509 -noout -subject 2>/dev/null || echo "N/A")
                echo "OK (Expira em: $EXP_DATE | $SUBJECT)"
            else
                echo "FALHA / TIMEOUT na conexão externa."
            fi
        fi
    done
done

echo ""
echo "========================================================================"
echo " Check Complete. See file: $OUTPUT_FILE"
echo "========================================================================"

See also

• Artigos sobre Cloud
• Mais Artigos sobre Cloud / WebDev / Tecnologias