diff --git a/check_ssl_cert/Makefile b/check_ssl_cert/Makefile
deleted file mode 100644
index cf9673d..0000000
--- a/check_ssl_cert/Makefile
+++ /dev/null
@@ -1,3 +0,0 @@
-#/usr/bin/make -f
-
-include ../common.mk
diff --git a/check_ssl_cert/check_ssl_cert b/check_ssl_cert/check_ssl_cert
deleted file mode 100644
index c0365fd..0000000
--- a/check_ssl_cert/check_ssl_cert
+++ /dev/null
@@ -1,1713 +0,0 @@
-#!/bin/sh
-#
-# check_ssl_cert
-#
-# Checks an X.509 certificate:
-# - checks if the server is running and delivers a valid certificate
-# - checks if the CA matches a given pattern
-# - checks the validity
-#
-# See  the INSTALL file for installation instructions
-#
-# Copyright (c) 2007-2012 ETH Zurich.
-# Copyright (c) 2007-2016 Matteo Corti <matteo@corti.li>
-#
-# This module is free software; you can redistribute it and/or modify it
-# under the terms of GNU general public license (gpl) version 3.
-# See the LICENSE file for details.
-
-################################################################################
-# Constants
-
-VERSION=1.37.0
-SHORTNAME="SSL_CERT"
-
-VALID_ATTRIBUTES=",startdate,enddate,subject,issuer,serial,modulus,serial,hash,email,ocsp_uri,fingerprint,"
-
-################################################################################
-# Functions
-
-################################################################################
-# Prints usage information
-# Params
-#   $1 error message (optional)
-usage() {
-
-    if [ -n "$1" ] ; then
-        echo "Error: $1" 1>&2
-    fi
-
-    #### The following line is 80 characters long (helps to fit the help text in a standard terminal)
-    ######--------------------------------------------------------------------------------
-
-    echo
-    echo "Usage: check_ssl_cert -H host [OPTIONS]"
-    echo
-    echo "Arguments:"
-    echo "   -H,--host host             server"
-    echo
-    echo "Options:"
-    echo "   -A,--noauth                ignore authority warnings (expiration only)"
-    echo "      --altnames              matches the pattern specified in -n with alternate"
-    echo "                              names too"
-    echo "   -C,--clientcert path       use client certificate to authenticate"
-    echo "      --clientpass phrase     set passphrase for client certificate."
-    echo "   -c,--critical days         minimum number of days a certificate has to be valid"
-    echo "                              to issue a critical status"
-    echo "   -d,--debug                 produces debugging output"
-    echo "   -e,--email address         pattern to match the email address contained in the"
-    echo "                              certificate"
-    echo "       --ecdsa                cipher selection: force ECDSA authentication"
-    echo "   -f,--file file             local file path (works with -H localhost only)"
-    echo "      --file-bin path         path of the file binary to be used"
-    echo "   -h,--help,-?               this help message"
-    echo "      --ignore-exp            ignore expiration date"
-    echo "      --ignore-sig-alg        do not check if the certificate was signed with SHA1"
-    echo "                              or MD5"
-    echo "      --ignore-ocsp           do not check revocation with OCSP"
-    echo "   -i,--issuer issuer         pattern to match the issuer of the certificate"
-    echo "   -L,--check-ssl-labs grade  SSL Labs assestment"
-    echo "                              (please check https://www.ssllabs.com/about/terms.html)"
-    echo "      --ignore-ssl-labs-cache Forces a new check by SSL Labs (see -L)"
-    echo "      --long-output list      append the specified comma separated (no spaces) list"
-    echo "                              of attributes to the plugin output on additional lines"
-    echo "                              Valid attributes are:"
-    echo "                                enddate, startdate, subject, issuer, modulus,"
-    echo "                                serial, hash, email, ocsp_uri and fingerprint."
-    echo "                              'all' will include all the available attributes."
-    echo "   -n,--cn name               pattern to match the CN of the certificate (can be"
-    echo "                              specified multiple times)"
-    echo "      --no_ssl2               disable SSL version 2"
-    echo "      --no_ssl3               disable SSL version 3"
-    echo "      --no_tls1               disable TLS version 1"
-    echo "      --no_tls1_1             disable TLS version 1.1"
-    echo "      --no_tls1_2             disable TLS version 1.2"
-    echo "   -N,--host-cn               match CN with the host name"
-    echo "   -o,--org org               pattern to match the organization of the certificate"
-    echo "      --openssl path          path of the openssl binary to be used"
-    echo "   -p,--port port             TCP port"
-    echo "   -P,--protocol protocol     use the specific protocol {http|smtp|pop3|imap|ftp|xmpp|irc}"
-    echo "                              http:               default"
-    echo "                              smtp,pop3,imap,ftp: switch to TLS"
-    echo "   -s,--selfsigned            allows self-signed certificates"
-    echo "      --serial serialnum      pattern to match the serial number"
-    echo "      --ssl2                  force SSL version 2"
-    echo "      --ssl3                  force SSL version 3"
-    echo "   -r,--rootcert path         root certificate or directory to be used for"
-    echo "                              certificate validation"
-    echo "       --rsa                  cipher selection: force RSA authentication"
-    echo "   -t,--timeout               seconds timeout after the specified time"
-    echo "                              (defaults to 15 seconds)"
-    echo "      --temp dir              directory where to store the temporary files"
-    echo "      --tls1                  force TLS version 1"
-    echo "      --tls1_1                force TLS version 1.1"
-    echo "      --tls1_2                force TLS version 1.2"
-    echo "   -v,--verbose               verbose output"
-    echo "   -V,--version               version"
-    echo "   -w,--warning days          minimum number of days a certificate has to be valid"
-    echo "                              to issue a warning status"
-    echo
-    echo "Deprecated options:"
-    echo "   -d,--days days             minimum number of days a certificate has to be valid"
-    echo "                              (see --critical and --warning)"
-    echo "      --ocsp                  check revocation via OCSP"
-    echo "   -S,--ssl version           force SSL version (2,3)"
-    echo "                              (see: --ss2 or --ssl3)"
-    echo
-    echo "Report bugs to https://github.com/matteocorti/check_ssl_cert/issues"
-    echo
-
-    exit 3
-
-}
-
-################################################################################
-# Exits with a critical message
-# Params
-#   $1 error message
-critical() {
-    if [ -n "${CN}" ] ; then
-        tmp=" ${CN}"
-    fi
-    printf '%s CRITICAL%s: %s%s%s\n' "${SHORTNAME}" "${tmp}" "$1" "${PERFORMANCE_DATA}" "${LONG_OUTPUT}"
-    exit 2
-}
-
-################################################################################
-# Exits with a warning message
-# Param
-#   $1 warning message
-warning() {
-    if [ -n "${CN}" ] ; then
-        tmp=" ${CN}"
-    fi
-    printf '%s WARN%s: %s%s%s\n' "${SHORTNAME}" "${tmp}" "$1" "${PERFORMANCE_DATA}" "${LONG_OUTPUT}"
-    exit 1
-}
-
-################################################################################
-# Exits with an 'unkown' status
-# Param
-#   $1 message
-unknown() {
-    if [ -n "${CN}" ] ; then
-        tmp=" ${CN}"
-    fi
-    printf '%s UNKNOWN%s: %s\n' "${SHORTNAME}" "${tmp}" "$1"
-    exit 3
-}
-
-################################################################################
-# Executes command with a timeout
-# Params:
-#   $1 timeout in seconds
-#   $2 command
-# Returns 1 if timed out 0 otherwise
-exec_with_timeout() {
-
-    time=$1
-
-    # start the command in a subshell to avoid problem with pipes
-    # (spawn accepts one command)
-    command="/bin/sh -c \"$2\""
-
-    if [ -n "${DEBUG}" ] ; then
-        echo "[DBG] executing with timeout (${time}s): $2"
-    fi
-
-    if [ -n "${TIMEOUT_BIN}" ] ; then
-
-        if [ -n "${DEBUG}" ] ; then
-            echo "[DBG]   ${TIMEOUT_BIN} $time $command"
-        fi
-
-        eval "${TIMEOUT_BIN} $time $command" > /dev/null 2>&1
-
-        if [ $? = 137 ] ; then
-            critical "Timeout after ${time} seconds"
-        fi
-
-    elif [ -n "${EXPECT}" ] ; then
-
-        expect -c "set echo \"-noecho\"; set timeout $time; spawn -noecho $command; expect timeout { exit 1 } eof { exit 0 }"
-
-        if [ $? = 1 ] ; then
-            critical "Timeout after ${time} seconds"
-        fi
-
-    else
-
-        eval "${command}"
-
-    fi
-
-}
-
-################################################################################
-# Checks if a given program is available and executable
-# Params
-#   $1 program name
-# Returns 1 if the program exists and is executable
-check_required_prog() {
-
-    PROG=$(which "$1" 2> /dev/null)
-
-    if [ -z "$PROG" ] ; then
-        critical "cannot find $1"
-    fi
-
-    if [ ! -x "$PROG" ] ; then
-        critical "$PROG is not executable"
-    fi
-
-}
-
-################################################################################
-# Converts SSL Labs grades to a numeric value
-#   (see https://www.ssllabs.com/downloads/SSL_Server_Rating_Guide.pdf)
-# Params
-#   $1 program name
-# Sets NUMERIC_SSL_LAB_GRADE
-convert_ssl_lab_grade() {
-
-    GRADE="$1"
-
-    unset NUMERIC_SSL_LAB_GRADE
-
-    case "${GRADE}" in
-        'A+'|'a+')
-            # Value not in documentation
-            NUMERIC_SSL_LAB_GRADE=85
-            shift
-            ;;
-        A|a)
-            NUMERIC_SSL_LAB_GRADE=80
-            shift
-            ;;
-        'A-'|'a-')
-            # Value not in documentation
-            NUMERIC_SSL_LAB_GRADE=75
-            shift
-            ;;
-        B|b)
-            NUMERIC_SSL_LAB_GRADE=65
-            shift
-            ;;
-        C|c)
-            NUMERIC_SSL_LAB_GRADE=50
-            shift
-            ;;
-        D|d)
-            NUMERIC_SSL_LAB_GRADE=35
-            shift
-            ;;
-        E|e)
-            NUMERIC_SSL_LAB_GRADE=20
-            shift
-            ;;
-        F|f)
-            NUMERIC_SSL_LAB_GRADE=0
-            shift
-            ;;
-        T|t)
-            # No trust: value not in documentation
-            NUMERIC_SSL_LAB_GRADE=0
-            shift
-            ;;
-        M|m)
-            # Certificate name mismatch: value not in documentation
-            NUMERIC_SSL_LAB_GRADE=0
-            shift
-            ;;
-        *)
-            unknown "Connot convert SSL Lab grade ${GRADE}"
-            ;;
-    esac
-
-}
-
-################################################################################
-# Tries to fetch the certificate
-
-fetch_certificate() {
-
-    RET=0
-    
-    # Check if a protocol was specified (if not HTTP switch to TLS)
-    if [ -n "${PROTOCOL}" ] && [ "${PROTOCOL}" != "http" ] && [ "${PROTOCOL}" != "https" ] ; then
-
-        case "${PROTOCOL}" in
-            smtp)
-                exec_with_timeout "$TIMEOUT" "echo -e 'QUIT\r' | $OPENSSL s_client ${CLIENT} ${CLIENTPASS} -starttls ${PROTOCOL} -connect $HOST:$PORT ${SERVERNAME} -verify 6 ${ROOT_CA} ${SSL_VERSION} ${SSL_VERSION_DISABLED} ${SSL_AU} 2> ${ERROR} 1> ${CERT}"
-		RET=$?
-                ;;
-            irc)
-                exec_with_timeout "$TIMEOUT" "echo -e 'QUIT\r' | $OPENSSL s_client ${CLIENT} ${CLIENTPASS} -connect $HOST:$PORT ${SERVERNAME} -verify 6 ${ROOT_CA} ${SSL_VERSION} ${SSL_VERSION_DISABLED} ${SSL_AU} 2> ${ERROR} 1> ${CERT}"
-		RET=$?
-                ;;
-            pop3|imap|ftp|xmpp)
-                exec_with_timeout "$TIMEOUT" "echo 'Q' | $OPENSSL s_client ${CLIENT} ${CLIENTPASS} -starttls ${PROTOCOL} -connect $HOST:$PORT ${SERVERNAME} -verify 6 ${ROOT_CA} ${SSL_VERSION} ${SSL_VERSION_DISABLED} ${SSL_AU} 2> ${ERROR} 1> ${CERT}"
-		RET=$?
-                ;;
-            *)
-                unknown "Error: unsupported protocol ${PROTOCOL}"
-                ;;
-        esac
-
-    elif [ -n "${FILE}" ] ; then
-
-        if [ "${HOST}" = "localhost" ] ; then
-            exec_with_timeout "$TIMEOUT" "/bin/cat '${FILE}' 2> ${ERROR} 1> ${CERT}"
-	    RET=$?
-        else
-            unknown "Error: option 'file' works with -H localhost only"
-        fi
-
-    else
-
-        exec_with_timeout "$TIMEOUT" "echo 'Q' | $OPENSSL s_client ${CLIENT} ${CLIENTPASS} -connect $HOST:$PORT ${SERVERNAME} -verify 6 ${ROOT_CA} ${SSL_VERSION} ${SSL_VERSION_DISABLED} ${SSL_AU} 2> ${ERROR} 1> ${CERT}"
-	RET=$?
-
-    fi
-
-    if [ -n "${DEBUG}" ] ; then
-        echo "[DBG] storing a copy of the retrieved certificate in ${HOST}.crt"
-        cp "${CERT}" "${HOST}.crt"
-        echo "[DBG] storing a copy of the OpenSSL errors in ${HOST}.error"
-        cp "${ERROR}" "${HOST}.error"
-    fi
-
-    if [ "${RET}" -ne 0 ] ; then
-
-        if [ -n "${DEBUG}" ] ; then
-            sed 's/^/[DBG] SSL error: /' "${ERROR}"
-        fi
-
-        # s_client could verify the server certificate because the server requires a client certificate
-        if grep -q '^Acceptable client certificate CA names' "${CERT}" ; then
-
-            if [ -n "${VERBOSE}" ] ; then
-                echo "The server requires a client certificate"
-            fi
-
-        else
-
-            # Try to clean up the error message
-            #     Remove the 'verify and depth' lines
-            #     Take the 1st line (seems OK with the use cases I tested)
-            ERROR_MESSAGE=$(
-                grep -v '^depth' "${ERROR}" \
-                    | grep -v '^verify' \
-                    | head -n 1
-                 )
-            critical "SSL error: ${ERROR_MESSAGE}"
-
-        fi
-
-    fi
-
-}
-
-################################################################################
-# Adds metric to performance data
-# Params
-#   $1 performance data in nagios plugin format,
-#      see https://nagios-plugins.org/doc/guidelines.html#AEN200
-add_performance_data() {
-    if [ -z "${PERFORMANCE_DATA}" ]; then
-        PERFORMANCE_DATA="|${1}"
-    else 
-        PERFORMANCE_DATA="${PERFORMANCE_DATA} $1"
-    fi
-}
-
-################################################################################
-# Main
-################################################################################
-main() {
-
-    # Default values
-    DEBUG=""
-    OPENSSL=""
-    FILE_BIN=""
-    IGNORE_SSL_LABS_CACHE=""
-    PORT="443"
-    TIMEOUT="15"
-    VERBOSE=""
-    OCSP="1" # enabled by default
-
-    # Set the default temp dir if not set
-    if [ -z "${TMPDIR}" ] ; then
-        TMPDIR="/tmp"
-    fi
-
-    ################################################################################
-    # Process command line options
-    #
-    # We do no use getopts since it is unable to process long options
-
-    while true; do
-
-        case "$1" in
-            ########################################
-            # Options without arguments
-            -A|--noauth)
-                NOAUTH=1
-                shift
-                ;;
-            --altnames)
-                ALTNAMES=1
-                shift
-                ;;
-            -d|--debug)
-                DEBUG=1
-                VERBOSE=1
-                shift
-                ;;
-            -h|--help|-\?)
-                usage
-                exit 0
-                ;;
-            --ignore-exp)
-                NOEXP=1
-                shift
-                ;;
-            --ignore-sig-alg)
-                NOSIGALG=1
-                shift
-                ;;
-            --ignore-ssl-labs-cache)
-                IGNORE_SSL_LABS_CACHE="&startNew=on"
-                shift
-                ;;
-            --no_ssl2)
-                SSL_VERSION_DISABLED="${SSL_VERSION_DISABLED} -no_ssl2"
-                shift
-                ;;
-            --no_ssl3)
-                SSL_VERSION_DISABLED="${SSL_VERSION_DISABLED} -no_ssl3"
-                shift
-                ;;
-            --no_tls1)
-                SSL_VERSION_DISABLED="${SSL_VERSION_DISABLED} -no_tls1"
-                shift
-                ;;
-            --no_tls1_1)
-                SSL_VERSION_DISABLED="${SSL_VERSION_DISABLED} -no_tls1_1"
-                shift
-                ;;
-            --no_tls1_2)
-                SSL_VERSION_DISABLED="${SSL_VERSION_DISABLED} -no_tls1_2"
-                shift
-                ;;
-            -N|--host-cn)
-                COMMON_NAME="__HOST__"
-                shift
-                ;;
-            -s|--selfsigned)
-                SELFSIGNED=1
-                shift
-                ;;
-	    --rsa)
-		SSL_AU="-cipher aRSA"
-		shift
-		;;
-	    --ecdsa)
-		SSL_AU="-cipher aECDSA"
-		shift
-		;;
-            --ssl2)
-                SSL_VERSION="-ssl2"
-                shift
-                ;;
-            --ssl3)
-                SSL_VERSION="-ssl3"
-                shift
-                ;;
-            --tls1)
-                SSL_VERSION="-tls1"
-                shift
-                ;;
-            --tls1_1)
-                SSL_VERSION="-tls1_1"
-                shift
-                ;;
-            --tls1_2)
-                SSL_VERSION="-tls1_2"
-                shift
-                ;;
-	    --ocsp)
-		# deprecated
-		shift
-		;;
-            --ignore-ocsp)
-                OCSP=""
-                shift
-                ;;
-            -v|--verbose)
-                VERBOSE=1
-                shift
-                ;;
-            -V|--version)
-                echo "check_ssl_cert version ${VERSION}"
-                exit 3
-                ;;
-            ########################################
-            # Options with arguments
-            -c|--critical)
-                if [ $# -gt 1 ]; then
-                    CRITICAL="$2"
-                    shift 2
-                else
-                   unknown "-c,--critical requires an argument"
-                fi
-                ;;
-            # Deprecated option: used to be as --warning
-            -d|--days)
-                if [ $# -gt 1 ]; then
-                    WARNING="$2"
-                    shift 2
-                else
-                    unknown "-d,--days requires an argument"
-                fi
-                ;;
-            -e|--email)
-                if [ $# -gt 1 ]; then
-                    ADDR="$2"
-                    shift 2
-                else
-                    unknown "-e,--email requires an argument"
-                fi
-                ;;
-            -f|--file)
-                if [ $# -gt 1 ]; then
-                    FILE="$2"
-                    shift 2
-                else
-                    unknown "-f,--file requires an argument"
-                fi
-                ;;
-            --file-bin)
-                if [ $# -gt 1 ]; then
-                    FILE_BIN="$2"
-                    shift 2
-                else
-                    unknown "--file-bin requires an argument"
-                fi
-                ;;
-            -H|--host)
-                if [ $# -gt 1 ]; then
-                    HOST="$2"
-                    shift 2
-                else
-                    unknown "-H,--host requires an argument"
-                fi
-                ;;
-            -i|--issuer)
-                if [ $# -gt 1 ]; then
-                    ISSUER="$2"
-                    shift 2
-                else
-                    unknown "-i,--issuer requires an argument"s
-                fi
-                ;;
-            -L|--check-ssl-labs)
-                if [ $# -gt 1 ]; then
-                    SSL_LAB_ASSESTMENT="$2"
-                    shift 2
-                else
-                    unknown "-L|--check-ssl-labs requires an argument"
-                fi
-                ;;
-            --serial)
-                if [ $# -gt 1 ]; then
-                    SERIAL_LOCK="$2"
-                    shift 2
-                else
-                    unknown "-i,--issuer requires an argument"
-                fi
-                ;;
-            --long-output)
-                if [ $# -gt 1 ]; then
-                    LONG_OUTPUT_ATTR="$2"
-                    shift 2
-               else
-                    unknown "--long-output requires an argument"
-               fi
-               ;;
-            -n|--cn)
-                if [ $# -gt 1 ]; then
-		    if [ -n "${COMMON_NAME}" ]; then
-		      COMMON_NAME="${COMMON_NAME} ${2}"
-		    else
-                      COMMON_NAME="${2}"
-		    fi
-                    shift 2
-                else
-                    unknown "-n,--cn requires an argument"
-                fi
-                ;;
-            -o|--org)
-                if [ $# -gt 1 ]; then
-                  ORGANIZATION="$2"
-                  shift 2
-                else
-                    unknown "-o,--org requires an argument"
-                fi
-                ;;
-            --openssl)
-                if [ $# -gt 1 ]; then
-                    OPENSSL="$2"
-                    shift 2
-                else
-                    unknown "--openssl requires an argument"
-                fi
-                ;;
-            -p|--port)
-                if [ $# -gt 1 ]; then
-                    PORT="$2"
-                    shift 2
-                else
-                    unknown "-p,--port requires an argument"
-                fi
-                ;;
-            -P|--protocol)
-                if [ $# -gt 1 ]; then
-                    PROTOCOL="$2"
-                    shift 2
-                else
-                    unknown "-P,--protocol requires an argument"
-                fi
-                ;;
-            -r|--rootcert)
-                if [ $# -gt 1 ]; then
-                    ROOT_CA="$2"
-                    shift 2
-                else
-                    unknown "-r,--rootcert requires an argument"
-                fi
-                ;;
-            -C|--clientcert)
-                if [ $# -gt 1 ]; then
-                    CLIENT_CERT="$2"
-                    shift 2
-                else
-                    unknown "-c,--clientcert requires an argument"
-                fi
-                ;;
-            --clientpass)
-                if [ $# -gt 1 ]; then
-                    CLIENT_PASS="$2"
-                    shift 2
-                else
-                    unknown "--clientpass requires an argument"
-                fi
-                ;;
-            -S|--ssl)
-                if [ $# -gt 1 ]; then
-
-                    if [ "$2" = "2" ] || [ "$2" = "3" ] ; then
-                        SSL_VERSION="-ssl${2}"
-                        shift 2
-                    else
-                        unknown "invalid argument for --ssl"
-                    fi
-
-                else
-
-                    unknown "--ssl requires an argument"
-
-                fi
-                ;;
-            -t|--timeout)
-                if [ $# -gt 1 ]; then
-                    TIMEOUT="$2"
-                    shift 2
-                else
-                    unknown "-t,--timeout requires an argument"
-                fi
-                ;;
-            --temp)
-                if [ $# -gt 1 ] ; then
-                    # Override TMPDIR
-                    TMPDIR="$2"
-                    shift 2
-                else
-                    unknown "--temp requires an argument"
-                fi
-                ;;
-            -w|--warning)
-                if [ $# -gt 1 ]; then
-                    WARNING="$2"
-                    shift 2
-                else
-                    unknown "-w,--warning requires an argument"
-                fi
-                ;;
-            ########################################
-            # Special
-            --)
-                shift
-                break
-                ;;
-            -*)
-                unknown "invalid option: ${1}"
-                ;;
-            *)
-                break
-                ;;
-        esac
-
-    done
-
-    ################################################################################
-    # Set COMMON_NAME to hostname if -N was given as argument
-    if [ "$COMMON_NAME" = "__HOST__" ] ; then
-        COMMON_NAME="${HOST}"
-    fi
-
-    ################################################################################
-    # Sanity checks
-
-    ###############
-    # Check options
-    if [ -z "${HOST}" ] ; then
-        usage "No host specified"
-    fi
-
-    if [ -n "${ALTNAMES}" ] && [ -z "${COMMON_NAME}" ] ; then
-        unknown "--altnames requires a common name to match (--cn or --host-cn)"
-    fi
-
-    if [ -n "${ROOT_CA}" ] ; then
-
-        if [ ! -r "${ROOT_CA}" ] ; then
-            unknown "Cannot read root certificate ${ROOT_CA}"
-        fi
-
-        if [ -d "${ROOT_CA}" ] ; then
-            ROOT_CA="-CApath ${ROOT_CA}"
-        elif [ -f "${ROOT_CA}" ] ; then
-            ROOT_CA="-CAfile ${ROOT_CA}"
-        else
-            unknown "Root certificate of unknown type $(file "${ROOT_CA}" 2> /dev/null)"
-        fi
-
-    fi
-
-    if [ -n "${CLIENT_CERT}" ] ; then
-
-        if [ ! -r "${CLIENT_CERT}" ] ; then
-            unknown "Cannot read client certificate ${CLIENT_CERT}"
-        fi
-
-    fi
-
-    if [ -n "${CRITICAL}" ] ; then
-
-        if ! echo "${CRITICAL}" | grep -q '[0-9][0-9]*' ; then
-            unknown "invalid number of days ${CRITICAL}"
-        fi
-
-    fi
-
-    if [ -n "${WARNING}" ] ; then
-
-        if ! echo "${WARNING}" | grep -q '[0-9][0-9]*' ; then
-            unknown "invalid number of days ${WARNING}"
-        fi
-
-    fi
-
-    if [ -n "${CRITICAL}" ] && [ -n "${WARNING}" ] ; then
-
-        if [ "${WARNING}" -le "${CRITICAL}" ] ; then
-            unknown "--warning (${WARNING}) is less than or equal to --critical (${CRITICAL})"
-        fi
-
-    fi
-
-    if [ -n "${TMPDIR}" ] ; then
-
-        if [ ! -d "${TMPDIR}" ] ; then
-            unknown "${TMPDIR} is not a directory";
-        fi
-
-        if [ ! -w "${TMPDIR}" ] ; then
-            unknown "${TMPDIR} is not writable";
-        fi
-
-    fi
-
-    if [ -n "${OPENSSL}" ] ; then
-
-        if [ ! -x "${OPENSSL}" ] ; then
-            unknown "${OPENSSL} ist not an executable"
-        fi
-
-        if ! "${OPENSSL}" list-standard-commands | grep -q s_client ; then
-            unknown "${OPENSSL} ist not an openssl executable"
-        fi
-
-    fi
-
-    if [ -n "${SSL_LAB_ASSESTMENT}" ] ; then
-        convert_ssl_lab_grade "${SSL_LAB_ASSESTMENT}"
-        SSL_LAB_ASSESTMENT_NUMERIC="${NUMERIC_SSL_LAB_GRADE}"
-    fi
-
-    if [ -n "${DEBUG}" ] ; then
-        echo "[DBG] ROOT_CA = ${ROOT_CA}"
-    fi
-
-    #######################
-    # Check needed programs
-
-    # OpenSSL
-    if [ -z "${OPENSSL}" ] ; then
-        check_required_prog openssl
-        OPENSSL=$PROG
-    fi
-
-    # file
-    if [ -z "${FILE_BIN}" ] ; then
-        check_required_prog file
-        FILE_BIN=$PROG
-    fi
-
-    # Expect (optional)
-    EXPECT="$(which expect 2> /dev/null)"
-    test -x "${EXPECT}" || EXPECT=""
-    if [  -n "${VERBOSE}" ] ; then
-        if [ -z "${EXPECT}" ] ; then
-            echo "expect not available"
-        else
-            echo "expect available (${EXPECT})"
-        fi
-    fi
-
-    # Timeout (optional)
-    TIMEOUT_BIN="$(which timeout 2> /dev/null)"
-    test -x "${TIMEOUT_BIN}" || TIMEOUT_BIN=""
-    if [  -n "${VERBOSE}" ] ; then
-
-        if [ -z "${TIMEOUT_BIN}" ] ; then
-            echo "timeout not available"
-        else
-            echo "timeout available (${TIMEOUT_BIN})"
-        fi
-
-    fi
-
-    if [ -z "${TIMEOUT_BIN}" ] && [ -z "${EXPECT}" ] && [ -n "${VERBOSE}" ] ; then
-        echo "disabling timeouts"
-    fi
-
-    PERL="$(which perl 2> /dev/null)"
-
-    if [ -n "${DEBUG}" ] && [ -n "${PERL}" ] ; then
-	echo "[DBG] perl available: ${PERL}"
-    fi
-    
-    DATEBIN="$(which date 2> /dev/null)"
-    
-    if [ -n "${DEBUG}" ] && [ -n "${DATEBIN}" ] ; then
-	echo "[DBG] date available: ${DATEBIN}"
-    fi
-
-    DATETYPE=""
-
-    if ! "${DATEBIN}" +%s >/dev/null 2>&1  ;  then
-		
-        # Perl with Date::Parse (optional)
-        test -x "${PERL}" || PERL=""
-        if [ -z "${PERL}" ] && [ -n "${VERBOSE}" ] ; then
-            echo "Perl not found: disabling date computations"
-        fi
-
-        if ! ${PERL} -e "use Date::Parse;" > /dev/null 2>&1 ; then
-
-            if [ -n "${VERBOSE}" ] ; then
-                echo "Perl module Date::Parse not installed: disabling date computations"
-            fi
-
-	    PERL=""
-
-        else
-
-            if [ -n "${VERBOSE}" ] ; then
-                echo "Perl module Date::Parse installed: enabling date computations"
-            fi	   
-
-            DATETYPE="PERL"
-
-        fi
-
-    else
-
-	if $DATEBIN --version >/dev/null 2>&1 ; then
-            DATETYPE="GNU"
-	else
-            DATETYPE="BSD"
-	fi
-
-	if [ -n "${VERBOSE}" ] ; then
-            echo "found ${DATETYPE} date with timestamp support: enabling date computations"
-	fi
-
-    fi
-
-    if [ -n "${DEBUG}" ] ; then
-        echo "[DBG] check_ssl_version: ${VERSION}"
-        echo "[DBG] OpenSSL binary: ${OPENSSL}"
-        echo "[DBG] OpenSSL version: $( ${OPENSSL} version )"
-        echo "[DBG] System info: $( uname -a )"
-    fi
-
-    ################################################################################
-    # Check if openssl s_client supports the -servername option
-    #
-    #   openssl s_client does not have a -help option
-    #   => We supply an invalid command line option to get the help
-    #      on standard error
-    #
-    SERVERNAME=
-    if ${OPENSSL} s_client not_a_real_option 2>&1 | grep -q -- -servername ; then
-	
-        if [ -n "${COMMON_NAME}" ] && [ "${COMMON_NAME}" = "$(echo "${COMMON_NAME}" | tr -d ' ')" ] ; then
-            SERVERNAME="-servername ${COMMON_NAME}"
-        else
-            SERVERNAME="-servername ${HOST}"
-        fi
-
-	if [ -n "${DEBUG}" ] ; then
-            echo "[DBG] '${OPENSSL} s_client' supports '-servername': using ${SERVERNAME}"
-	fi
-
-	
-    else
-
-        if [ -n "${VERBOSE}" ] ; then
-            echo "'${OPENSSL} s_client' does not support '-servername': disabling virtual server support"
-        fi
-
-    fi
-
-    ################################################################################
-    # Fetch the X.509 certificate
-
-    # Temporary storage for the certificate and the errors
-    CERT="$( mktemp -t "${0##*/}XXXXXX" 2> /dev/null )"
-    if [ -z "${CERT}" ] || [ ! -w "${CERT}" ] ; then
-        unknown 'temporary file creation failure.'
-    fi
-
-    ERROR="$( mktemp -t "${0##*/}XXXXXX" 2> /dev/null )"
-    if [ -z "${ERROR}" ] || [ ! -w "${ERROR}" ] ; then
-        unknown 'temporary file creation failure.'
-    fi
-
-    if [ -n "${OCSP}" ] ; then
-
-        ISSUER_CERT="$( mktemp -t "${0##*/}XXXXXX" 2> /dev/null )"
-        if [ -z "${ISSUER_CERT}" ] || [ ! -w "${ISSUER_CERT}" ] ; then
-            unknown 'temporary file creation failure.'
-        fi
-
-    fi
-
-    if [ -n "${VERBOSE}" ] ; then
-        echo "downloading certificate to ${TMPDIR}"
-    fi
-
-    CLIENT=""
-    if [ -n "${CLIENT_CERT}" ] ; then
-        CLIENT="-cert ${CLIENT_CERT}"
-    fi
-
-    CLIENTPASS=""
-    if [ -n "${CLIENT_PASS}" ] ; then
-        CLIENTPASS="-pass pass:${CLIENT_PASS}"
-    fi
-
-    # Cleanup before program termination
-    # Using named signals to be POSIX compliant
-    trap 'rm -f $CERT $ERROR $ISSUER_CERT' EXIT HUP INT QUIT TERM
-
-    fetch_certificate
-
-    if grep -q 'sslv3\ alert\ unexpected\ message' "${ERROR}" ; then
-
-        if [ -n "${SERVERNAME}" ] ; then
-
-            # Some OpenSSL versions have problems with the -servername option
-            # We try without
-            if [ -n "${VERBOSE}" ] ; then
-                echo "'${OPENSSL} s_client' returned an error: trying without '-servername'"
-            fi
-
-            SERVERNAME=""
-            fetch_certificate
-
-        fi
-
-        if grep -q 'sslv3\ alert\ unexpected\ message' "${ERROR}" ; then
-
-            critical "cannot fetch certificate: OpenSSL got an unexpected message"
-
-        fi
-
-    fi
-
-    if ! grep -q "CERTIFICATE" "${CERT}" ; then
-
-        if [ -n "${FILE}" ] ; then
-            critical "'${FILE}' is not a valid certificate file"
-        else
-            # See
-            # http://stackoverflow.com/questions/1251999/sed-how-can-i-replace-a-newline-n
-            #
-            # - create a branch label via :a
-            # - the N command appends a newline and and the next line of the input
-            #   file to the pattern space
-            # - if we are before the last line, branch to the created label $!ba
-            #   ($! means not to do it on the last line (as there should be one final newline))
-            # - finally the substitution replaces every newline with a space on
-            #   the pattern space
-            ERROR_MESSAGE="$(sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/; /g' "${ERROR}")"
-            if [ -n "${VERBOSE}" ] ; then
-                echo "Error: ${ERROR_MESSAGE}"
-            fi
-            critical "No certificate returned"
-        fi
-
-    fi
-
-    if [ -n "${VERBOSE}" ] ; then
-        echo "parsing the certificate file"
-    fi
-
-    ################################################################################
-    # Parse the X.509 certificate
-    DATE="$($OPENSSL x509 -in "${CERT}" -enddate -noout | sed -e "s/^notAfter=//")"
-
-    # we need to remove everything before 'CN = ', to remove an eventual email supplied with / and additional elements (after ', ')
-    CN="$($OPENSSL x509 -in "${CERT}" -subject -noout -nameopt utf8,oneline,-esc_msb |
-        sed -e "s/^.*[[:space:]]CN[[:space:]]=[[:space:]]//"  -e "s/\/[[:alpha:]][[:alpha:]]*=.*\$//" -e "s/,.*//" )"
-
-    CA_O="$($OPENSSL x509 -in "${CERT}" -issuer -noout | sed -e "s/^.*\/O=//" -e "s/\/[A-Z][A-Z]*=.*\$//")"
-    CA_CN="$($OPENSSL x509 -in "${CERT}" -issuer -noout  | sed -e "s/^.*\/CN=//" -e "s/\/[A-Za-z][A-Za-z]*=.*\$//")"
-
-    SERIAL="$($OPENSSL x509 -in "${CERT}" -serial -noout  | sed -e "s/^serial=//")"
-
-    OCSP_URI="$($OPENSSL x509 -in "${CERT}" -ocsp_uri -noout)"
-
-    ISSUER_URI="$($OPENSSL x509 -in "${CERT}" -text -noout | grep "CA Issuers" | sed -e "s/^.*CA Issuers - URI://")"
-
-    if [ -z "${ISSUER_URI}" ] ; then
-	if [ -n "${VERBOSE}" ] ; then
-	    echo "cannot find the CA Issuers in the certificate: disabling OCSP checks"
-	fi
-	OCSP=""
-    fi
-
-    SIGNATURE_ALGORITHM="$($OPENSSL x509 -in "${CERT}" -text -noout | grep 'Signature Algorithm' | head -n 1)"
-
-    if [ -n "${DEBUG}" ] ; then
-	echo "[DBG] " "$($OPENSSL x509 -in "${CERT}" -subject -noout -nameopt utf8,oneline,-esc_msb)"
-	echo "[DBG] CN         = ${CN}"
-	echo "[DBG] CA_O       = ${CA_O}"
-	echo "[DBG] CA_CN      = ${CA_CN}"
-	echo "[DBG] SERIAL     = ${SERIAL}"
-	echo "[DBG] OCSP_URI   = ${OCSP_URI}"
-	echo "[DBG] ISSUER_URI = ${ISSUER_URI}"
-	echo "[DBG] ${SIGNATURE_ALGORITHM}"
-    fi
-    
-    if echo "${SIGNATURE_ALGORITHM}" | grep -q "sha1" ; then
-
-        if [ -n "${NOSIGALG}" ] ; then
-
-            if [ -n "${VERBOSE}" ] ; then
-                echo 'Certificate is signed with SHA-1'
-            fi
-
-        else
-
-            critical 'Certificate is signed with SHA-1'
-
-        fi
-
-    fi
-
-    if echo "${SIGNATURE_ALGORITHM}" | grep -qi "md5" ; then
-
-        if [ -n "${NOSIGALG}" ] ; then
-
-            if [ -n "${VERBOSE}" ] ; then
-                echo 'Certificate is signed with MD5'
-            fi
-
-        else
-
-            critical 'Certificate is signed with MD5'
-
-        fi
-
-    fi
-
-    ################################################################################
-    # Generate the long output
-    if [ -n "${LONG_OUTPUT_ATTR}" ] ; then
-
-        check_attr() {
-            ATTR="$1"
-            if ! echo "${VALID_ATTRIBUTES}" | grep -q ",${ATTR}," ; then
-                unknown "Invalid certificate attribute: ${ATTR}"
-            else
-                value="$(${OPENSSL} x509 -in "${CERT}" -noout -nameopt utf8,oneline,-esc_msb  -"${ATTR}" | sed -e "s/.*=//")"
-                LONG_OUTPUT="${LONG_OUTPUT}\n${ATTR}: ${value}"
-           fi
-
-        }
-
-        # Split on comma
-        if [ "${LONG_OUTPUT_ATTR}" = "all" ] ; then
-            LONG_OUTPUT_ATTR="${VALID_ATTRIBUTES}"
-        fi
-        attributes=$( echo ${LONG_OUTPUT_ATTR} | tr ',' "\n" )
-        for attribute in $attributes ; do
-            check_attr "${attribute}"
-        done
-
-    fi
-
-    ################################################################################
-    # Compute for how many days the certificate will be valid
-    if [ -n "${DATETYPE}" ]; then
-
-        CERT_END_DATE=$($OPENSSL x509 -in "${CERT}" -noout -enddate | sed -e "s/.*=//")
-
-        OLDLANG=$LANG
-        LANG=en_US
-
-	if [ -n "${DEBUG}" ] ; then
-	    echo "[DBG] Date computations: ${DATETYPE}"
-	fi
-
-        case "${DATETYPE}" in
-            "BSD")
-                DAYS_VALID=$(( ( $(${DATEBIN} -jf "%b %d %T %Y %Z" "${CERT_END_DATE}" +%s) - $(${DATEBIN} +%s) ) / 86400 ))
-                ;;
-
-            "GNU")
-                DAYS_VALID=$(( ( $(${DATEBIN} -d "${CERT_END_DATE}" +%s) - $(${DATEBIN} +%s) ) / 86400 ))
-                ;;
-
-            "PERL")
-				DAYS_VALID=$(perl - "${CERT_END_DATE}" <<-"EOF"
-					use strict;
-					use warnings;
-					use Date::Parse;
-					my $cert_date = str2time( $ARGV[0] );
-					my $days = int (( $cert_date - time ) / 86400 + 0.5);
-					print "$days\n";
-				EOF
-				)
-				;;
-        esac
-
-        LANG=$OLDLANG
-
-        if [ -n "${VERBOSE}" ] ; then
-
-            if [ "${DAYS_VALID}" -ge 0 ] ; then
-                echo "The certificate will expire in ${DAYS_VALID} day(s)"
-            else
-                echo "The certificate expired "$((- DAYS_VALID))" day(s) ago"
-            fi
-
-        fi
-        add_performance_data "days=$DAYS_VALID;${WARNING};${CRITICAL};;"
-
-    fi
-
-    ################################################################################
-    # Check the CN
-    if [ -n "$COMMON_NAME" ] ; then
-	
-        ok=""
-
-        if [ -n "${DEBUG}" ] ; then
-            echo "[DBG] check CN: ${CN}"
-        fi
-
-	# Common name is case insensitive: using grep for comparison (and not 'case' with 'shopt -s nocasematch' as not defined in POSIX
-	
-        if echo "${CN}" | grep -q -i "^\*\." ; then
-
-            # Match the domain
-            if [ -n "${DEBUG}" ] ; then
-                echo "[DBG] the common name ${CN} begins with a '*'"
-		echo "[DBG] checking if the common name matches ^$(echo "${CN}" | cut -c 3-)\$"
-            fi	    
-            if echo "${COMMON_NAME}" | grep -q -i "^$(echo "${CN}" | cut -c 3-)\$" ; then
-                if [ -n "${DEBUG}" ] ; then
-                    echo "[DBG] the common name ${COMMON_NAME} matches ^$( echo "${CN}" | cut -c 3- )\$"
-                fi
-                ok="true"
-
-            fi
-
-            # Or the literal with the wildcard
-            if [ -n "${DEBUG}" ] ; then
-		echo "[DBG] checking if the common name matches ^$(echo "${CN}" | sed -e 's/[.]/[.]/g' -e 's/[*]/[A-Za-z0-9\-]*/' )\$"
-            fi
-            if echo "${COMMON_NAME}" | grep -q -i "^$(echo "${CN}" | sed -e 's/[.]/[.]/g' -e 's/[*]/[A-Za-z0-9\-]*/' )\$" ; then
-                if [ -n "${DEBUG}" ] ; then
-                    echo "[DBG] the common name ${COMMON_NAME} matches ^$(echo "${CN}" | sed -e 's/[.]/[.]/g' -e 's/[*]/[A-Za-z0-9\-]*/' )\$"
-                fi
-                ok="true"
-            fi
-
-	    # Or if both are exactly the same
-            if [ -n "${DEBUG}" ] ; then
-		echo "[DBG] checking if the common name matches ^${CN}\$"
-            fi
-	    if echo "${COMMON_NAME}" | grep -q -i "^${CN}\$" ; then
-                if [ -n "${DEBUG}" ] ; then
-                    echo "[DBG] the common name ${COMMON_NAME} matches ^${CN}\$"
-                fi
-                ok="true"
-            fi	    
-
-        else
-
-	    if echo "${COMMON_NAME}" | grep -q -i "^${CN}$" ; then
-                ok="true"
-	    fi
-	    
-        fi
-
-        # Check alterante names
-        if [ -n "${ALTNAMES}" ] ; then
-
-            for cn in ${COMMON_NAME} ; do
-
-                ok=""
-
-                if [ -n "${DEBUG}" ] ; then
-                    echo "[DBG] checking altnames against ${cn}"
-                fi
-
-                for alt_name in $($OPENSSL x509 -in "${CERT}" -text \
-                    | grep --after-context=1 "509v3 Subject Alternative Name:" \
-                    | tail -n 1 | sed -e "s/DNS://g" | sed -e "s/,//g") ; do
-
-                    if [ -n "${DEBUG}" ] ; then
-                        echo "[DBG]   ${alt_name}"
-                    fi
-
-		    if echo "${cn}" | grep -q -i "^${alt_name}$" ; then
-                        ok="true"
-		    fi
-
-                done
-
-                if [ -z "$ok" ] ; then
-                    fail=$cn
-                    break;
-                fi
-
-            done
-
-        fi
-
-        if [ -n "$fail" ] ; then
-           critical "invalid CN ('$CN' does not match '$fail')"
-        fi
-
-        if [ -z "$ok" ] ; then
-            critical "invalid CN ('$CN' does not match '$COMMON_NAME')"
-        fi
-
-        if [ -n "${DEBUG}" ] ; then
-            echo "[DBG] CN check finished"
-        fi
-
-    fi
-
-    ################################################################################
-    # Check the issuer
-    if [ -n "$ISSUER" ] ; then
-
-        if [ -n "${DEBUG}" ] ; then
-            echo "[DBG] check ISSUER: ${ISSUER}"
-        fi
-
-        ok=""
-        CA_ISSUER_MATCHED=""
-
-        if echo "$CA_CN" | grep -q "^${ISSUER}\$" ; then
-            ok="true"
-            CA_ISSUER_MATCHED="${CA_CN}"
-        fi
-
-        if echo "$CA_O" | grep -q "^${ISSUER}\$" ; then
-            ok="true"
-            CA_ISSUER_MATCHED="${CA_O}"
-        fi
-
-        if [ -z "$ok" ] ; then
-            critical "invalid CA ('$ISSUER' does not match '$CA_O' or '$CA_CN')"
-        fi
-
-    else
-
-        CA_ISSUER_MATCHED="${CA_CN}"
-
-    fi
-
-    ################################################################################
-    # Check the serial number
-    if [ -n "$SERIAL_LOCK" ] ; then
-
-        ok=""
-
-        if echo "$SERIAL" | grep -q "^${SERIAL_LOCK}\$" ; then
-            ok="true"
-        fi
-
-        if [ -z "$ok" ] ; then
-            critical "invalid serial number ('$SERIAL' does not match '$SERIAL_LOCK')"
-        fi
-
-    fi
-
-    ################################################################################
-    # Check the validity
-    if [ -z "${NOEXP}" ] ; then
-
-        # We always check expired certificates
-        if ! $OPENSSL x509 -in "${CERT}" -noout -checkend 0 ; then
-            critical "certificate is expired (was valid until $DATE)"
-        fi
-
-        if [ -n "${CRITICAL}" ] ; then
-
-            if [ -n "${DEBUG}" ] ; then
-                echo "[DBG] executing: $OPENSSL x509 -in ${CERT} -noout -checkend $(( CRITICAL * 86400 ))"
-            fi
-
-            if ! $OPENSSL x509 -in "${CERT}" -noout -checkend $(( CRITICAL * 86400 )) ; then
-                critical "certificate will expire on $DATE"
-            fi
-
-        fi
-
-        if [ -n "${WARNING}" ] ; then
-
-            if [ -n "${DEBUG}" ] ; then
-                echo "[DBG] executing: $OPENSSL x509 -in ${CERT} -noout -checkend $(( WARNING * 86400 ))"
-            fi
-
-            if ! $OPENSSL x509 -in "${CERT}" -noout -checkend $(( WARNING * 86400 )) ; then
-                warning "certificate will expire on $DATE"
-            fi
-
-        fi
-
-    fi
-
-    ################################################################################
-    # Check SSL Labs
-    if [ -n "${SSL_LAB_ASSESTMENT}" ] ; then
-
-        if [ -n "${VERBOSE}" ] ; then
-            echo "Checking SSL Labs assestment"
-        fi
-
-        while true; do
-
-            JSON="$(curl --silent "https://api.ssllabs.com/api/v2/analyze?host=${HOST}${IGNORE_SSL_LABS_CACHE}")"
-            CURL_RETURN_CODE=$?
-
-            if [ ${CURL_RETURN_CODE} -ne 0 ] ; then
-
-                if [ -n "${DEBUG}" ] ; then
-                    echo "[DBG] curl returned ${CURL_RETURN_CODE}: curl --silent \"https://api.ssllabs.com/api/v2/analyze?host=${HOST}${IGNORE_SSL_LABS_CACHE}\""
-                fi
-
-                unknown "Error checking SSL Labs: curl returned ${CURL_RETURN_CODE}, see 'man curl' for details"
-
-            fi
-
-            JSON="$(printf '%s' "${JSON}" | tr '\n' ' ' )"
-
-            if [ -n "${DEBUG}" ] ; then
-                echo "[DBG] Checking SSL Labs: curl --silent \"https://api.ssllabs.com/api/v2/analyze?host=${HOST}\""
-                echo "[DBG] SSL Labs JSON: ${JSON}"
-            fi
-
-            # We clear the cache only on the first run
-            IGNORE_SSL_LABS_CACHE=""
-
-            SSL_LABS_HOST_STATUS=$(echo "${JSON}" \
-                | sed 's/.*"status":[ ]*"\([^"]*\)".*/\1/')
-
-            if [ -n "${DEBUG}" ] ; then
-                echo "[DBG] SSL Labs status: ${SSL_LABS_HOST_STATUS}"
-            fi
-
-            case "${SSL_LABS_HOST_STATUS}" in
-                'ERROR')
-                    SSL_LABS_STATUS_MESSAGE=$(echo "${JSON}" \
-                        | sed 's/.*"statusMessage":[ ]*"\([^"]*\)".*/\1/')
-                    critical "Error checking SSL Labs: ${SSL_LABS_STATUS_MESSAGE}"
-                    ;;
-                'READY')
-                    if ! echo "${JSON}" | grep -q "grade" ; then
-
-                        # Something went wrong
-                        SSL_LABS_STATUS_MESSAGE=$(echo "${JSON}" \
-                            | sed 's/.*"statusMessage":[ ]*"\([^"]*\)".*/\1/')
-                        critical "SSL Labs error: ${SSL_LABS_STATUS_MESSAGE}"
-
-                    else
-
-                        SSL_LABS_HOST_GRADE=$(echo "${JSON}" \
-                            | sed 's/.*"grade":[ ]*"\([^"]*\)".*/\1/')
-
-                        if [ -n "${DEBUG}" ] ; then
-                            echo "[DBG] SSL Labs grade: ${SSL_LABS_HOST_GRADE}"
-                        fi
-
-                        if [ -n "${VERBOSE}" ] ; then
-                            echo "SSL Labs grade: ${SSL_LABS_HOST_GRADE}"
-                        fi
-
-                        convert_ssl_lab_grade "${SSL_LABS_HOST_GRADE}"
-                        SSL_LABS_HOST_GRADE_NUMERIC="${NUMERIC_SSL_LAB_GRADE}"
-
-                        add_performance_data "ssllabs=${SSL_LABS_HOST_GRADE_NUMERIC}%;;${SSL_LAB_ASSESTMENT_NUMERIC}"
-
-                        # Check the grade
-                        if [ "${SSL_LABS_HOST_GRADE_NUMERIC}" -lt "${SSL_LAB_ASSESTMENT_NUMERIC}" ] ; then
-                            critical "SSL Labs grade is ${SSL_LABS_HOST_GRADE} (instead of ${SSL_LAB_ASSESTMENT})"
-                        fi
-
-                        if [ -n "${DEBUG}" ] ; then
-                            echo "[DBG] SSL Labs grade (converted): ${SSL_LABS_HOST_GRADE_NUMERIC}"
-                        fi
-
-                        # We have a result: exit
-                        break
-
-                    fi
-                    ;;
-                'IN_PROGRESS')
-                    # Data not yet available: warn and continue
-                    if [ -n "${VERBOSE}" ] ; then
-                        echo "Warning: no cached data by SSL Labs, check initiated"
-                    fi
-                    ;;
-                'DNS')
-                    if [ -n "${VERBOSE}" ] ; then
-                        echo 'SSL Labs cannot resolve the domain name'
-                    fi
-                    ;;
-                *)
-                    # Try to extract a message
-                    SSL_LABS_ERROR_MESSAGE=$(echo "${JSON}" \
-                        | sed 's/.*"message":[ ]*"\([^"]*\)".*/\1/')
-
-                    if [ -z "${SSL_LABS_ERROR_MESSAGE}" ] ; then
-                        SSL_LABS_ERROR_MESSAGE="${JSON}"
-                    fi
-
-                    critical "Cannot check status on SSL Labs: ${SSL_LABS_ERROR_MESSAGE}"
-            esac
-
-            WAIT_TIME=60
-            if [ -n "${VERBOSE}" ] ; then
-                echo "Waiting ${WAIT_TIME} seconds"
-            fi
-
-            sleep "${WAIT_TIME}"
-
-        done
-
-    fi
-
-    ################################################################################
-    # Check revocation via OCSP
-    if [ -n "${OCSP}" ]; then
-
-	if [ -n "${DEBUG}" ] ; then
-	    echo "[DBG] OCSP: fetching issuer certificate ${ISSUER_URI} to ${ISSUER_CERT}"
-	fi
-	
-        curl --silent "${ISSUER_URI}" > "${ISSUER_CERT}"
-
-	if [ -n "${DEBUG}" ] ; then
-	    echo "[DBG] OCSP: issuer certificate type: $(${FILE_BIN} "${ISSUER_CERT}" | sed 's/.*://' )"
-	fi
-	
-	# check the result
-	if ! "${FILE_BIN}" "${ISSUER_CERT}" | grep -q ': (ASCII|PEM)' ; then
-	
-            if "${FILE_BIN}" "${ISSUER_CERT}" | grep -q ': data' ; then
-		
-		if [ -n "${DEBUG}" ] ; then
-		    echo "[DBG] OCSP: converting issuer certificate from DER to PEM"
-		fi
-		
-		openssl x509 -inform DER -outform PEM -in "${ISSUER_CERT}" -out "${ISSUER_CERT}"
-
-	    else
-
-		unknown "Unable to fetch OCSP issuer certificate."
-
-	    fi
-		
-		
-        fi
-
-	if [ -n "${DEBUG}" ] ; then
-
-	    # remove trailing /
-	    FILE_NAME=${ISSUER_URI%/}
-
-	    # remove everything up to the last slash
-	    FILE_NAME=${FILE_NAME##*/}
-	    
-	    echo "[DBG] OCSP: storing a copy of the retrieved issuer certificate to ${FILE_NAME}"
-	    
-	    cp "${ISSUER_CERT}" "${FILE_NAME}"
-	fi
-	
-        OCSP_HOST="$(echo "${OCSP_URI}" | sed -e "s@.*//\([^/]\+\)\(/.*\)\?\$@\1@g" | sed 's/^http:\/\///' | sed 's/\/.*//' )"
-
-	if [ -n "${DEBUG}" ] ; then
-	    echo "[DBG] OCSP: host = ${OCSP_HOST}"
-	fi
-
-	# check if -header is supported
-	OCSP_HEADER=""
-
-	# oscp -header is supported in OpenSSL versions from 1.0.0, but not documented until 1.1.0
-	# so we check if the major version is greater than 0
-	if [ "$( ${OPENSSL} version | sed -e 's/OpenSSL \([0-9]\).*/\1/g' )"  -gt 0 ]; then
-
-	    if [ -n "${DEBUG}" ] ; then
-		echo "[DBG] openssl ocsp support the -header option"
-	    fi
-	    
-	    # http_proxy is sometimes lower- and sometimes uppercase. Programs usually check both
-	    # shellcheck disable=SC2154
-	    if [ -n "${http_proxy}" ] ; then
-		HTTP_PROXY="${http_proxy}"
-	    fi
-
-            if [ -n "${HTTP_PROXY:-}" ] ; then
-		
-		if [ -n "${DEBUG}" ] ; then
-		    echo "[DBG] executing $OPENSSL ocsp -no_nonce -issuer ${ISSUER_CERT} -cert ${CERT} -host ${HTTP_PROXY#*://} -path ${OCSP_URI} -header HOST ${OCSP_HOST}"
-		fi
-
-                OCSP_RESP="$($OPENSSL ocsp -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT}" -host "${HTTP_PROXY#*://}" -path "${OCSP_URI}" -header HOST "${OCSP_HOST}" 2>&1 | grep -i "ssl_cert")"
-
-            else
-		
-		if [ -n "${DEBUG}" ] ; then
-		    echo "[DBG] executing $OPENSSL ocsp -no_nonce -issuer ${ISSUER_CERT} -cert ${CERT}  -url ${OCSP_URI} ${OCSP_HEADER} -header HOST ${OCSP_HOST}"
-		fi
-
-                OCSP_RESP="$($OPENSSL ocsp -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT}" -url "${OCSP_URI}" -header HOST "${OCSP_HOST}" 2>&1 | grep -i "ssl_cert")"
-
-
-            fi
-	    
-	    if [ -n "${DEBUG}" ] ; then
-		echo "[DBG] OCSP: response = ${OCSP_RESP}"	
-	    fi
-	    
-            if echo "${OCSP_RESP}" | grep -qi "revoked" ; then
-		critical "certificate is revoked"
-            elif ! echo "${OCSP_RESP}" | grep -qi "good" ; then	    
-	    
-                if [ -n "${HTTP_PROXY:-}" ] ; then
-                    OCSP_RESP="$($OPENSSL ocsp -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT}" -host "${HTTP_PROXY#*://}" -path "${OCSP_URI}" "${OCSP_HEADER}" 2>&1 )"
-                else
-                    OCSP_RESP="$($OPENSSL ocsp -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT}" -url "${OCSP_URI}" "${OCSP_HEADER}" 2>&1 )"
-                fi
-		critical "${OCSP_RESP}"
-	    
-	    fi
-	    
-	else
-	    
-	    if [ -n "${VERBOSE}" ] ; then
-		echo "openssl ocsp does not support the -header option: disabling OCSP checks"
-	    fi
-
-	fi
-
-
-    fi
-
-    ################################################################################
-    # Check the organization
-    if [ -n "$ORGANIZATION" ] ; then
-
-        ORG=$($OPENSSL x509 -in "${CERT}" -subject -noout | sed -e "s/.*\/O=//" -e "s/\/.*//")
-
-        if ! echo "$ORG" | grep -q "^$ORGANIZATION" ; then
-            critical "invalid organization ('$ORGANIZATION' does not match '$ORG')"
-        fi
-
-    fi
-
-    ################################################################################
-    # Check the organization
-    if [ -n "$ADDR" ] ; then
-
-        EMAIL=$($OPENSSL x509 -in "${CERT}" -email -noout)
-
-        if [ -n "${VERBOSE}" ] ; then
-            echo "checking email (${ADDR}): ${EMAIL}"
-        fi
-
-        if [ -z "${EMAIL}" ] ; then
-            critical "the certificate does not contain an email address"
-        fi
-
-        if ! echo "$EMAIL" | grep -q "^$ADDR" ; then
-            critical "invalid email ($ADDR does not match $EMAIL)"
-        fi
-
-    fi
-
-    ################################################################################
-    # Check if the certificate was verified
-    if [ -z "${NOAUTH}" ] && grep -q '^verify\ error:' "${ERROR}" ; then
-
-        if grep -q '^verify\ error:num=[0-9][0-9]*:self\ signed\ certificate' "${ERROR}" ; then
-
-            if [ -z "${SELFSIGNED}" ] ; then
-                critical "Cannot verify certificate, self signed certificate"
-            else
-                SELFSIGNEDCERT="self signed "
-            fi
-
-        else
-
-            if [ -n "${DEBUG}" ] ; then
-                sed 's/^/[DBG] Error: /' "${ERROR}"
-            fi
-
-            # Process errors
-            details=$( grep  '^verify\ error:' "${ERROR}" | sed 's/verify\ error:num=[0-9]*://' | sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/, /g' )
-            critical "Cannot verify certificate: ${details}"
-
-        fi
-
-    fi
-
-    ################################################################################
-    # If we get this far, assume all is well. :)
-
-    # If --altnames was specified we show the specified CN instead of
-    # the certificate CN
-    if [ -n "${ALTNAMES}" ] && [ -n "${COMMON_NAME}" ] ; then
-        CN=${COMMON_NAME}
-    fi
-
-    if [ -n "${DAYS_VALID}" ] ; then
-        # nicer formatting
-        if [ "${DAYS_VALID}" -gt 1 ] ; then
-            DAYS_VALID=" (expires in ${DAYS_VALID} days)"
-        elif [ "${DAYS_VALID}" -eq 1 ] ; then
-            DAYS_VALID=" (expires tomorrow)"
-        elif [ "${DAYS_VALID}" -eq 0 ] ; then
-            DAYS_VALID=" (expires today)"
-        elif [ "${DAYS_VALID}" -eq -1 ] ; then
-            DAYS_VALID=" (expired yesterday)"
-        else
-            DAYS_VALID=" (expired ${DAYS_VALID} days ago)"
-        fi
-    fi
-
-    if [ -n "${SSL_LABS_HOST_GRADE}" ] ; then
-        SSL_LABS_HOST_GRADE=", SSL Labs grade: ${SSL_LABS_HOST_GRADE}"
-    fi
-
-    echo "${SHORTNAME} OK - X.509 ${SELFSIGNEDCERT}certificate for '${CN}' from '${CA_ISSUER_MATCHED}' valid until ${DATE}${DAYS_VALID}${SSL_LABS_HOST_GRADE}${PERFORMANCE_DATA}${LONG_OUTPUT}"
-
-    exit 0
-
-}
-
-if [ -z "${SOURCE_ONLY}" ]; then
-    main "${@}"
-fi
diff --git a/check_ssl_cert/control b/check_ssl_cert/control
deleted file mode 100644
index ac88e59..0000000
--- a/check_ssl_cert/control
+++ /dev/null
@@ -1,9 +0,0 @@
-Homepage: https://github.com/matteocorti/check_ssl_cert/blob/master/check_ssl_cert
-Watch: https://raw.githubusercontent.com/matteocorti/check_ssl_cert/master/check_ssl_cert VERSION=([0-9.]+)
-Recommends: ca-certificates, expect, libtimedate-perl, openssl
-Version: 1.37.0
-Uploaders: Jan Wagner <waja@cyconet.org>
-Description: plugin checking an X.509 certificate
- - checks if the server is running and delivers a valid certificate
- - checks if the CA matches a given pattern
- - checks the validity
diff --git a/check_ssl_cert/copyright b/check_ssl_cert/copyright
deleted file mode 100644
index 6e61fa6..0000000
--- a/check_ssl_cert/copyright
+++ /dev/null
@@ -1,8 +0,0 @@
-Copyright (c) 2007-2013 ETH Zurich
-Copyright (c) 2007-2016 Matteo Corti
-
-License: GPL v3
-
-  On Debian systems, the complete text of the GNU General
-  Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
-