s_verify_imap

#! /bin/sh
# s_verify_imap (Bourne shell script) -- Connects to an IMAP server, invokes STARTTLS and verifies the X.509 certificate
#
# Version: 1.2
# Copyright: (c) 2019 Alastair Irvine <alastair@plug.org.au>
# Keywords: openssl, SSL, TLS, secure certificate
# Licence: This file is released under the GNU General Public License v2
#
# Uses "Server Name Indication" (SNI) with TLS
# Note: Verifies the chain but won't actually compare the CN of the returned
# cert agains the server name

SELF=$(basename "$0")

if [ "$1" = -P ] ; then
  PORT=$2
  shift
  shift
fi

if [ $# -lt 1 -o $# -gt 3 ] ; then
  echo "Usage: $SELF [ -P <port> ] <servername> [ <sitename> ] [ <opts> ]" >&2
  exit 1
fi

if [ -z "$SSL_PATH" ] ; then
  if [ -d /etc/pki/tls ] ; then
    SSL_PATH=/etc/pki/tls
  else
    SSL_PATH=/etc/ssl
  fi
fi

openssl s_client -connect $1:${PORT-143} -starttls imap -servername ${2:-$1} ${3:--no_ssl3} -verify 20 -CApath $SSL_PATH/certs/ < /dev/null |
  sed "/^-----BEGIN CERTIFICATE-----/,/^-----END CERTIFICATE-----/d" |
  ${PAGER:-less}