SSL証明書の自動更新設定を『Cloudflare』管理下で実施した話

<?php
namespace App\Console\Commands;

use Illuminate\Console\Command;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Facades\Log;
use Carbon\Carbon;
use Illuminate\Support\Facades\Mail;
use App\Mail\SslCheckMail;

class BatchSslCheck extends Command {
    protected $signature = 'app:batch-sslCheck';
    protected $description = 'Command description';
    
    // バッチ実行
    public function handle() {
        // ドメイン
        $domain = "reixxxxx.net";
        // IPアドレス
        $originIp = "xxx.xxx.xx.xxx";
        Log::info("【BatchSslCheck】実行（対象ドメイン：{$domain}、対象IP：{$originIp}）", []);
                 // 証明書確認通信を２回実施する
        $subject_list = [0 => 'さくら', 1 => 'クラウドフレア'];
        foreach ($subject_list as $idx => $val) {
            // cURLの基本設定
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL, "https://{$domain}:443");
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            // ヘッダーのみ（通信削減）
            curl_setopt($ch, CURLOPT_NOBODY, true);
            // 証明書情報を取得
            curl_setopt($ch, CURLOPT_CERTINFO, true);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
            curl_setopt($ch, CURLOPT_TIMEOUT, 5);
            // [curl_setopt]の再利用を禁止する
            curl_setopt($ch, CURLOPT_FRESH_CONNECT, true);
            curl_setopt($ch, CURLOPT_FORBID_REUSE, true);
            if ($idx == 0) {
                // 自身のサーバで発行した証明書を参照
                curl_setopt($ch, CURLOPT_RESOLVE, ["{$domain}:443:{$originIp}"]);
            } else {
                // クラウドフレア側の証明書を参照
                curl_setopt($ch, CURLOPT_RESOLVE, ["-{$domain}:443"]);
            }
            // 通信実行
            curl_exec($ch);
            $certInfo = curl_getinfo($ch, CURLINFO_CERTINFO);
            curl_close($ch);
            // 通信結果を整理して格納
            $certList = $certInfo[0] ?? [];
            $pem = null;
            // 配列の中から『PEM形式』の証明書テキストを探す
            foreach ($certList as $item) {
                if (str_contains($item, '-----BEGIN CERTIFICATE-----')) {
                    $pem = $item;
                    break;
                }
            }
            $parsedCert = "";
            $sslLimit = "";
            $countDay = "";
            // 証明書テキストが見つかった場合
            if ($pem) {
                // OpenSSL関数で直接証明書を解析
                $parsedCert = openssl_x509_parse($pem);
                $validTo = \Carbon\Carbon::createFromTimestamp($parsedCert['validTo_time_t'])->timezone('Asia/Tokyo');
                $daysRemaining = (int) \Carbon\Carbon::now('Asia/Tokyo')->diffInDays($validTo, false);
                $parsedCert = $parsedCert['issuer']['O'] ?? 'Unknown';
                $sslLimit = $validTo->toDateTimeString();
                $countDay = $daysRemaining;
                
                Log::info("【証明書発行元】" . $parsedCert, []);
                Log::info("【SSL有効期限】" . $sslLimit, []);
                Log::info("【SSL残日数】" . $countDay, []);
            } else {
                Log::warn("{$domain} の証明書を取得できませんでした。", []);
                return;
            }
            // メール送信設定
            $mail_flg = false;
            switch ($countDay) {
            case '90':
            case '30':
            case '20':
            case '10':
                $mail_flg = true;
                break;
            default:
                if ($countDay < 10) {
                    $mail_flg = true;
                }
            }
            // 該当しない残日数の場合はメール送信しない
            if (!$mail_flg) {
                continue;
            }
            // メール送信
            $mailTo = config('mail.from.address');
            $content = [
                'mailTo' => $mailTo,
                'subject' => $val . ' SSL通信有効期限確認',
                'parsedCert' => $parsedCert,
                'sslLimit' => $sslLimit,
                'countDay' => $countDay,
                'view' => 'sslCheck',
            ];
            try {
                Mail::to($mailTo)->send(new SslCheckMail($content));
            } catch(Exception $e) {
                throw new CustomException(
                    ['code'=>'xxxx-xxxxx-xxxxx', 'message'=>'メールの送信に失敗しました。', 'status'=>500]
                );
            }
        }
    }
}