import socket
import ssl
import sys
from datetime import datetime, timezone

from cryptography import x509
from cryptography.hazmat.backends import default_backend


def fetch_certificate(host, port=443, timeout=10):
    # diagnostic only -- never use an unverified context to fetch real data
    ctx = ssl._create_unverified_context()

    with socket.create_connection((host, port), timeout=timeout) as sock:
        with ctx.wrap_socket(sock, server_hostname=host) as ssock:
            return ssock.getpeercert(binary_form=True)


def describe_certificate(der_cert):
    cert = x509.load_der_x509_certificate(der_cert, default_backend())

    subject = cert.subject.rfc4514_string()
    issuer = cert.issuer.rfc4514_string()

    try:
        expires = cert.not_valid_after_utc
    except AttributeError:
        expires = cert.not_valid_after.replace(tzinfo=timezone.utc)

    days_left = (expires - datetime.now(timezone.utc)).days

    return {
        "subject": subject,
        "issuer": issuer,
        "expires": expires,
        "days_until_expiry": days_left,
        "is_expired": days_left < 0,
    }


def main(host):
    print(f"Connecting to {host} (verification disabled -- diagnostic only)...")
    der_cert = fetch_certificate(host)
    info = describe_certificate(der_cert)

    print(f"Subject : {info['subject']}")
    print(f"Issuer : {info['issuer']}")
    print(f"Expires : {info['expires'].strftime('%Y-%m-%d %H:%M:%S UTC')}")

    if info["is_expired"]:
        print(f"Status : EXPIRED {abs(info['days_until_expiry'])} days ago")
    else:
        print(f"Status : valid, expires in {info['days_until_expiry']} days")


if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "en.wikipedia.org"
    main(target)