Automated Ephemeral TLS Certificate Verification and CRL Audit

This automation script performs parallel TLS standard socket connections to remote target endpoints across provided IP ranges, extracting x509 certificate chains to validate expiration deltas, SAN matching, and Certificate Revocation List (CRL) availability. Internally, it leverages Python ssl and socket modules combined with cryptography primitives to parse raw ASN.1 structure non-blockingly, inspecting issuer extensions without establishing high-level HTTP protocol overhead.

In enterprise environments, this script functions as an agentless TLS posture auditor within CI/CD pipelines or scheduled network compliance scans. It prevents rogue self-signed certificates, missing intermediate chains, or revoked certificates from remaining active across internal microservice ingresses and staging gateways prior to routing production client traffic.

Security risks involve handling malformed TLS handshake responses from untrusted endpoints, which can lead to socket hangs if explicit read timeouts are omitted. Performance overhead is constrained using thread pools or non-blocking IO, though wide CIDR scans require adjusting OS file descriptor limits (ulimit -n). A common pitfall is ignoring intermediate CA validation, causing client-side trust failures on devices lacking cached trust stores.

> System.Execute()

import socket, ssl, datetime
from cryptography import x509
from cryptography.hazmat.backends import default_backend

def check_tls_cert(hostname, port=443, timeout=5):
    ctx = ssl.create_default_context()
    conn = socket.create_connection((hostname, port), timeout=timeout)
    with ctx.wrap_socket(conn, server_hostname=hostname) as s:
        der_cert = s.getpeercert(binary_form=True)
        cert = x509.load_der_x509_certificate(der_cert, default_backend())
        days_left = (cert.not_valid_after_utc - datetime.datetime.now(datetime.timezone.utc)).days
        print(f"[+] Host: {hostname} | Subject: {cert.subject.rfc4514_string()} | Days Left: {days_left}")
        return days_left > 14

check_tls_cert("internal-api.service.local")

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-FEA369C7F05D