Scan HTTP-ish ports for SSL/TLS and print certificate expiration dates

ssl_service_scan.sh

#!/bin/bash
# Scan ports for SSL/TLS and print certificate expiration dates
PORTS=( $(netstat -tuln | grep -oP ':\K[0-9]+' | sort -nu) )
for port in "${PORTS[@]}"; do
  echo -n "Checking port $port... "
  result=$(timeout 5 bash -c "echo | openssl s_client -connect 127.0.0.1:$port 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null")
  if [[ $result == notAfter* ]]; then
    echo "$result" | sed 's/notAfter=/\tExpires: /'
    #TODO: parse date and show days remaining, or if expired, output loud warning message to STDERR
    sudo lsof -i :${port} -sTCP:LISTEN -nP | awk '{print "\t\t\t",$1,$3,$9}'
  else
    echo -e "\tNo SSL/TLS detected."
  fi
done