65 files changed, 276 insertions, 622 deletions
diff --git a/.travis.yml b/.travis.yml
index 11cc0611..6af1feef 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,8 +11,10 @@ install:
  - sudo apt-get install -qq --no-install-recommends perl autotools-dev libdbi-dev libldap2-dev libpq-dev libmysqlclient-dev libfreeradius-client-dev libkrb5-dev libnet-snmp-perl procps
  - sudo apt-get install -qq --no-install-recommends libdbi0-dev libdbd-sqlite3 libssl-dev dnsutils snmp-mibs-downloader libsnmp-perl snmpd
  - sudo apt-get install -qq --no-install-recommends fping snmp netcat smbclient fping pure-ftpd apache2 postfix libhttp-daemon-ssl-perl
+  - sudo apt-get install -qq --no-install-recommends libdbd-sybase-perl libnet-dns-perl
  - sudo apt-get install -qq --no-install-recommends slapd ldap-utils
  - sudo apt-get install -qq --no-install-recommends autoconf automake
+  - sudo apt-get install -qq --no-install-recommends faketime
 before_script:
  - tools/setup
diff --git a/NEWS b/NEWS
index 4adc8f8e..a489ee21 100644
--- a/NEWS
+++ b/NEWS
@@ -22,7 +22,11 @@ This file documents the major additions and syntax changes between releases.
        WARNINGS
        The format of the performance data emitted by check_mrtgtraf has been
          changed to comply with the development guidelines
-        check_ssh not returns CRITICAL for protocal/version errors
+        check_ssh now returns CRITICAL for protocol/version errors
+        If a plugin is invoked with -h/--help or -V/--version, the exit status
+          is now UNKNOWN
+        The superseded check_ntp.pl was removed, please use check_ntp_peer or
+          check_ntp_time instead
 2.1.1 2nd December 2014
        FIXES
diff --git a/THANKS.in b/THANKS.in
index 9a9ca3fd..59c90feb 100644
--- a/THANKS.in
+++ b/THANKS.in
@@ -335,3 +335,4 @@ Jonas Genannt
 Nick Peelman
 Sebastian Herbszt
 Christopher Schultz
+Matthias Hähnel
diff --git a/doc/developer-guidelines.sgml b/doc/developer-guidelines.sgml
index d9340285..228d3fa1 100644
--- a/doc/developer-guidelines.sgml
+++ b/doc/developer-guidelines.sgml
@@ -194,13 +194,15 @@
                                        <row>
                                                <entry align="center"><para>3</para></entry>
                                                <entry valign="middle"><para>Unknown</para></entry>
-                                                <entry><para>Invalid command line arguments were supplied to the 
+                                                <entry><para>Invalid command line arguments were supplied to the
                                                plugin or low-level failures internal to the plugin (such as unable to fork,
                                                or open a tcp socket) that prevent it from performing the specified
                                                operation. Higher-level errors (such as name resolution errors,
                                                socket timeouts, etc) are outside of the control of plugins and should
                                                generally NOT be reported as UNKNOWN states.
-                                                </para></entry>
+                                                </para>
+                                                <para>The --help or --version output should also result in Unknown state.</para>
+                                                </entry>
                                        </row>
                                </tbody>
                        </tgroup>
@@ -610,6 +612,9 @@
                <para>The option -v or --verbose should be present in all plugins.
                The user should be allowed to specify -v multiple times to increase
                the verbosity level, as described in <xref linkend="verboselevels">.</para>
+                The exit code for version information or help should be UNKNOWN
+                (3).</para>
    </section>
    <section>
diff --git a/plugins-root/check_dhcp.c b/plugins-root/check_dhcp.c
index b874c555..3723e61a 100644
--- a/plugins-root/check_dhcp.c
+++ b/plugins-root/check_dhcp.c
@@ -1163,11 +1163,11 @@ int call_getopt(int argc, char **argv){
                case 'V': /* version */
                        print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                case 'h': /* help */
                        print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                case 'v': /* verbose */
                        verbose=1;
diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index f4208371..9ed12ba1 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -526,10 +526,10 @@ main(int argc, char **argv)
                                break;
                        case 'V': /* version */
                                print_revision (progname, NP_VERSION);
-                                exit (STATE_OK);
+                                exit (STATE_UNKNOWN);
                        case 'h': /* help */
                                print_help ();
-                                exit (STATE_OK);
+                                exit (STATE_UNKNOWN);
                        }
                }
        }
diff --git a/plugins-scripts/Makefile.am b/plugins-scripts/Makefile.am
index 794a34f8..ea65aed1 100644
--- a/plugins-scripts/Makefile.am
+++ b/plugins-scripts/Makefile.am
@@ -36,6 +36,8 @@ TESTS = @SCRIPT_TEST@
 test:
        perl -I $(top_builddir) -I $(top_srcdir) ../test.pl
        perl -I $(top_builddir) -I $(top_srcdir) ../test.pl t/utils.t   # utils.t is excluded from above, so manually ask to test
+        for SCRIPT in *.pl; do perl -wc $$SCRIPT || exit 1; done
+        set -e; for SCRIPT in *.sh; do sh -n $$SCRIPT || exit 1; done
 test-debug:
        NPTEST_DEBUG=1 HARNESS_VERBOSE=1 perl -I $(top_builddir) -I $(top_srcdir) ../test.pl
diff --git a/plugins-scripts/check_breeze.pl b/plugins-scripts/check_breeze.pl
index 12a60ee6..05b99203 100755
--- a/plugins-scripts/check_breeze.pl
+++ b/plugins-scripts/check_breeze.pl
@@ -28,10 +28,10 @@ GetOptions
 if ($opt_V) {
        print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
-if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
 ($opt_H) || usage("Host name/address not specified\n");
 my $host = $1 if ($opt_H =~ /([-.A-Za-z0-9]+)/);
diff --git a/plugins-scripts/check_disk_smb.pl b/plugins-scripts/check_disk_smb.pl
index 99948a41..98992268 100755
--- a/plugins-scripts/check_disk_smb.pl
+++ b/plugins-scripts/check_disk_smb.pl
@@ -54,10 +54,10 @@ GetOptions
 if ($opt_V) {
        print_revision($PROGNAME,'@NP_VERSION@'); #'
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
-if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
 my $smbclient = $utils::PATH_TO_SMBCLIENT;
 $smbclient    || usage("check requires smbclient, smbclient not set\n");
diff --git a/plugins-scripts/check_file_age.pl b/plugins-scripts/check_file_age.pl
index 15330f71..56b8e97c 100755
--- a/plugins-scripts/check_file_age.pl
+++ b/plugins-scripts/check_file_age.pl
@@ -60,12 +60,12 @@ GetOptions(
 if ($opt_V) {
        print_revision($PROGNAME, '@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 if ($opt_h) {
        print_help();
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 $opt_f = shift unless ($opt_f);
diff --git a/plugins-scripts/check_flexlm.pl b/plugins-scripts/check_flexlm.pl
index 49d674d4..e3fe296f 100755
--- a/plugins-scripts/check_flexlm.pl
+++ b/plugins-scripts/check_flexlm.pl
@@ -58,7 +58,7 @@ GetOptions
 if ($opt_V) {
        print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 unless (defined $opt_t) {
@@ -66,7 +66,7 @@ unless (defined $opt_t) {
 }
-if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
 unless (defined $opt_F) {
        print "Missing license.dat file\n";
diff --git a/plugins-scripts/check_ifoperstatus.pl b/plugins-scripts/check_ifoperstatus.pl
index 1a7fbba4..3eed4bcb 100755
--- a/plugins-scripts/check_ifoperstatus.pl
+++ b/plugins-scripts/check_ifoperstatus.pl
@@ -367,17 +367,17 @@ sub process_arguments() {
        if ($status == 0){
                print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        if ($opt_V) {
                print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        if ($opt_h) {
                print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        if (! utils::is_hostname($hostname)){
diff --git a/plugins-scripts/check_ifstatus.pl b/plugins-scripts/check_ifstatus.pl
index 2c76d0c8..9f2f7c31 100755
--- a/plugins-scripts/check_ifstatus.pl
+++ b/plugins-scripts/check_ifstatus.pl
@@ -119,7 +119,7 @@ $status = process_arguments();
 if ($status != 0)
 {
        print_help() ;
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
@@ -313,17 +313,17 @@ sub process_arguments() {
                
        if ($status == 0){
                print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        if ($opt_V) {
                print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        if ($opt_h) {
                print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        unless (defined $timeout) {
diff --git a/plugins-scripts/check_ircd.pl b/plugins-scripts/check_ircd.pl
index afedfb95..22d21c2e 100755
--- a/plugins-scripts/check_ircd.pl
+++ b/plugins-scripts/check_ircd.pl
@@ -181,10 +181,10 @@ MAIN:
        if ($opt_V) {
                print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
-        if ($opt_h) {print_help(); exit $ERRORS{'OK'};}
+        if ($opt_h) {print_help(); exit $ERRORS{'UNKNOWN'};}
        ($opt_H) || ($opt_H = shift @ARGV) || usage("Host name/address not specified\n");
        my $remotehost = $1 if ($opt_H =~ /([-.A-Za-z0-9]+)/);
diff --git a/plugins-scripts/check_mailq.pl b/plugins-scripts/check_mailq.pl
index 3086e94a..32f498d3 100755
--- a/plugins-scripts/check_mailq.pl
+++ b/plugins-scripts/check_mailq.pl
@@ -573,12 +573,12 @@ sub process_arguments(){
        if ($opt_V) {
                print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        if ($opt_h) {
                print_help();
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        if (defined $opt_v ){
diff --git a/plugins-scripts/check_mssql.pl b/plugins-scripts/check_mssql.pl
index a436a8ff..fb3952d4 100755
--- a/plugins-scripts/check_mssql.pl
+++ b/plugins-scripts/check_mssql.pl
@@ -130,7 +130,7 @@ sub process_arguments {
        if (defined $opt_V) {
                print_revision($PROGNAME,'@NP_VERSION@');
-                exit $ERRORS{'OK'};
+                exit $ERRORS{'UNKNOWN'};
        }
        syntax("Help:") if ($help);
diff --git a/plugins-scripts/check_netdns.pl b/plugins-scripts/check_netdns.pl
index af1456be..38538e56 100755
--- a/plugins-scripts/check_netdns.pl
+++ b/plugins-scripts/check_netdns.pl
@@ -32,6 +32,9 @@ use lib "$FindBin::Bin";
 use utils;
 my $PROGNAME = "check_netdns";
+sub print_help ();
+sub print_version();
+sub print_usage ();
 $ENV{'PATH'}='@TRUSTED_PATH@';
 $ENV{'BASH_ENV'}=''; 
@@ -43,12 +46,12 @@ GetOptions("V" => $opt_V,         "version" => $opt_V,
                                         "t=i" => $opt_t,       "timeout=i" => $opt_t,
                                         "s=s" => $opt_s,       "server=s" => $opt_s,
                                         "H=s" => $opt_H,       "hostname=s" => $opt_H);
-                           
 # -h means display verbose help screen
-if($opt_h){ print_help(); exit 0; }
+if($opt_h){ print_help(); exit 3; }
 # -V means display version number
-if ($opt_V) { print_version(); exit 0; }
+if ($opt_V) { print_version(); exit 3; }
 # -H means host name
 $opt_H = shift unless ($opt_H);
@@ -70,7 +73,7 @@ if ($opt_s) {
                $server = $1;
        } else {
                print "$opt_s is not a valid host name";
-                exit -1;
+                exit 3;
        }
 }
diff --git a/plugins-scripts/check_ntp.pl b/plugins-scripts/check_ntp.pl
deleted file mode 100755
index 13da939c..00000000
--- a/plugins-scripts/check_ntp.pl
+++ /dev/null
@@ -1,471 +0,0 @@
-#!@PERL@ -w
-#
-# (c)1999 Ian Cass, Knowledge Matters Ltd.
-# Read the GNU copyright stuff for all the legalese
-#
-# Check NTP time servers plugin. This plugin requires the ntpdate utility to
-# be installed on the system, however since it's part of the ntp suite, you 
-# should already have it installed.
-#
-#
-# Nothing clever done in this program - its a very simple bare basics hack to
-# get the job done.
-#
-# Things to do...
-# check @words[9] for time differences greater than +/- x secs & return a
-# warning.
-#
-# (c) 1999 Mark Jewiss, Knowledge Matters Limited
-# 22-9-1999, 12:45
-#
-# Modified script to accept 2 parameters or set defaults.
-# Now issues warning or critical alert is time difference is greater than the 
-# time passed.
-#
-# These changes have not been tested completely due to the unavailability of a
-# server with the incorrect time.
-#
-# (c) 1999 Bo Kersey, VirCIO - Managed Server Solutions <bo@vircio.com>
-# 22-10-99, 12:17
-#
-# Modified the script to give useage if no parameters are input.
-#
-# Modified the script to check for negative as well as positive 
-# time differences.
-#
-# Modified the script to work with ntpdate 3-5.93e Wed Apr 14 20:23:03 EDT 1999
-#
-# Modified the script to work with ntpdate's that return adjust or offset...
-#
-#
-# Script modified 2000 June 01 by William Pietri <william@bianca.com>
-#
-# Modified script to handle weird cases:
-#     o NTP server doesn't respond (e.g., has died)
-#     o Server has correct time but isn't suitable synchronization
-#           source. This happens while starting up and if contact
-#           with master has been lost.
-#
-# Modifed to run under Embedded Perl  (sghosh@users.sf.net)
-#   - combined logic some blocks together..
-# 
-# Added ntpdate check for stratum 16 desynch peer (James Fidell) Feb 03, 2003
-#
-# ntpdate - offset is in seconds
-# changed ntpdc to ntpq - jitter/dispersion is in milliseconds
-#
-# Patch for for regex for stratum1 refid.
-require 5.004;
-use POSIX;
-use strict;
-use Getopt::Long;
-use vars qw($opt_V $opt_h $opt_H $opt_t $opt_w $opt_c $opt_O $opt_j $opt_k $verbose $PROGNAME $def_jitter $ipv4 $ipv6);
-use lib utils.pm;
-use utils qw($TIMEOUT %ERRORS &print_revision &support);
-$PROGNAME="check_ntp";
-sub print_help ();
-sub print_usage ();
-$ENV{'PATH'}='@TRUSTED_PATH@';
-$ENV{'BASH_ENV'}='';
-$ENV{'ENV'}='';
-# defaults in sec
-my $DEFAULT_OFFSET_WARN =  60;  # 1 minute
-my $DEFAULT_OFFSET_CRIT = 120;  # 2 minutes
-# default in millisec
-my $DEFAULT_JITTER_WARN =   5000; # 5 sec
-my $DEFAULT_JITTER_CRIT =  10000; # 10 sec
-Getopt::Long::Configure('bundling');
-GetOptions
-        ("V"   => \$opt_V, "version"    => \$opt_V,
-         "h"   => \$opt_h, "help"       => \$opt_h,
-         "v"   => \$verbose, "verbose"  => \$verbose,
-         "4"   => \$ipv4, "use-ipv4"    => \$ipv4,
-         "6"   => \$ipv6, "use-ipv6"    => \$ipv6,
-         "w=f" => \$opt_w, "warning=f"  => \$opt_w,   # offset|adjust warning if above this number
-         "c=f" => \$opt_c, "critical=f" => \$opt_c,   # offset|adjust critical if above this number
-         "O"   => \$opt_O, "zero-offset" => \$opt_O,  # zero-offset  bad
-         "j=s" => \$opt_j, "jwarn=i"    => \$opt_j,   # jitter warning if above this number
-         "k=s" => \$opt_k, "jcrit=i"    => \$opt_k,   # jitter critical if above this number
-         "t=s" => \$opt_t, "timeout=i"  => \$opt_t,
-         "H=s" => \$opt_H, "hostname=s" => \$opt_H);
-if ($opt_V) {
-        print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
-}
-if ($opt_h) {
-        print_help();
-        exit $ERRORS{'OK'};
-}
-# jitter test params specified
-if (defined $opt_j || defined $opt_k ) {
-        $def_jitter = 1;
-}
-$opt_H = shift unless ($opt_H);
-my $host = $1 if ($opt_H && $opt_H =~ m/^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+|[a-zA-Z][-a-zA-Z0-9]+(\.[a-zA-Z][-a-zA-Z0-9]+)*)$/);
-unless ($host) {
-        print "No target host specified\n";
-        print_usage();
-        exit $ERRORS{'UNKNOWN'};
-}
-my ($timeout, $owarn, $ocrit, $jwarn, $jcrit);
-$timeout = $TIMEOUT;
-($opt_t) && ($opt_t =~ /^([0-9]+)$/) && ($timeout = $1);
-$owarn = $DEFAULT_OFFSET_WARN;
-($opt_w) && ($opt_w =~ /^([0-9.]+)$/) && ($owarn = $1);
-$ocrit = $DEFAULT_OFFSET_CRIT;
-($opt_c) && ($opt_c =~ /^([0-9.]+)$/) && ($ocrit = $1);
-$jwarn = $DEFAULT_JITTER_WARN;
-($opt_j) && ($opt_j =~ /^([0-9]+)$/) && ($jwarn = $1);
-$jcrit = $DEFAULT_JITTER_CRIT;
-($opt_k) && ($opt_k =~ /^([0-9]+)$/) && ($jcrit = $1);
-if ($ocrit < $owarn ) {
-        print "Critical offset should be larger than warning offset\n";
-        print_usage();
-        exit $ERRORS{"UNKNOWN"};
-}
-if ($def_jitter) {
-        if ($opt_k < $opt_j) {
-                print "Critical jitter should be larger than warning jitter\n";
-                print_usage();
-                exit $ERRORS{'UNKNOWN'};
-        }
-}
-my $stratum = -1;
-my $ignoreret = 0;
-my $answer = undef;
-my $offset = undef;
-my $jitter = undef;
-my $syspeer = undef;
-my $candidate = 0;
-my @candidates;
-my $msg; # first line of output to print if format is invalid
-my $state = $ERRORS{'UNKNOWN'};
-my $ntpdate_error = $ERRORS{'UNKNOWN'};
-my $jitter_error = $ERRORS{'UNKNOWN'};
-# some systems don't have a proper ntpq  (migrated from ntpdc)
-my $have_ntpq = undef;
-if ($utils::PATH_TO_NTPQ && -x $utils::PATH_TO_NTPQ ) {
-        $have_ntpq = 1;  
-}else{
-        $have_ntpq = 0;
-}
-# Just in case of problems, let's not hang Nagios
-$SIG{'ALRM'} = sub {
-        print ("ERROR: No response from ntp server (alarm)\n");
-        exit $ERRORS{"UNKNOWN"};
-};
-alarm($timeout);
-# Determine protocol to be used for ntpdate and ntpq
-my $ntpdate = $utils::PATH_TO_NTPDATE;
-my $ntpq    = $utils::PATH_TO_NTPQ;
-if ($ipv4) {
-        $ntpdate .= " -4";
-        $ntpq .= " -4";
-}
-elsif ($ipv6) {
-        $ntpdate .= " -6";
-        $ntpq .= " -6";
-}
-# else don't use any flags
-###
-###
-### First, check ntpdate
-###
-###
-if (!open (NTPDATE, $ntpdate . " -q $host 2>&1 |")) {
-        print "Could not open $ntpdate: $!\n";
-        exit $ERRORS{"UNKNOWN"};
-}
-my $out;
-while (<NTPDATE>) {
-        #print if ($verbose);  # noop
-        $msg = $_ unless ($msg);
-        $out .= "$_ ";
-        
-        if (/stratum\s(\d+)/) {
-                $stratum = $1;
-        }
-        
-        if (/(offset|adjust)\s+([-.\d]+)/i) {
-                $offset = $2;
-                # An offset of 0.000000 with an error is probably bogus. Actually,
-                # it's probably always bogus, but let's be paranoid here.
-                # Has been reported that 0.0000 happens in a production environment
-                # on Solaris 8 so this check should be taken out - SF tracker 1150777
-                if (defined $opt_O ) {
-                        if ($offset == 0) { undef $offset;}
-                }
-                $ntpdate_error = defined ($offset) ? $ERRORS{"OK"} : $ERRORS{"CRITICAL"};
-                print "ntperr = $ntpdate_error \n" if $verbose;
-        
-        }
-        if (/no server suitable for synchronization found/) {
-                if ($stratum == 16) {
-                        $ntpdate_error = $ERRORS{"WARNING"};
-                        $msg = "Desynchronized peer server found";
-                        $ignoreret=1;
-                }
-                else {
-                        $ntpdate_error = $ERRORS{"CRITICAL"};
-                        $msg = "No suitable peer server found - ";
-                }
-        }
-}
-$out =~ s/\n//g;
-close (NTPDATE) || 
-    die $! ? "$out - Error closing $ntpdate pipe: $!"
-           : "$out - Exit status: $? from $ntpdate\n";
-# declare an error if we also get a non-zero return code from ntpdate
-# unless already set to critical
-if ( $? && !$ignoreret ) {
-        print "stderr = $? : $! \n" if $verbose;
-        $ntpdate_error = $ntpdate_error == $ERRORS{"CRITICAL"} ? $ERRORS{"CRITICAL"} : $ERRORS{"UNKNOWN"}  ;
-        print "ntperr = $ntpdate_error : $!\n" if $verbose;
-}
-###
-###
-### Then scan xntpq/ntpq if it exists
-### and look in the 11th column for jitter 
-###
-# Field 1: Tally Code ( Space, 'x','.','-','+','#','*','o')
-#           Only match for '*' which implies sys.peer 
-#           or 'o' which implies pps.peer
-#           If both exist, the last one is picked. 
-# Field 2: address of the remote peer
-# Field 3: Refid of the clock (0.0.0.0 if unknown, WWWV/PPS/GPS/ACTS/USNO/PCS/... if Stratum1)
-# Field 4: stratum (0-15)
-# Field 5: Type of the peer: local (l), unicast (u), multicast (m) 
-#          broadcast (b); not sure about multicast/broadcast
-# Field 6: last packet receive (in seconds)
-# Field 7: polling interval
-# Field 8: reachability resgister (octal) 
-# Field 9: delay
-# Field 10: offset
-# Field 11: dispersion/jitter
-# 
-# According to bug 773588 Some solaris xntpd implementations seemto match on
-# "#" even though the docs say it exceeds maximum distance. Providing patch
-# here which will generate a warining.
-if ($have_ntpq) {
-        if ( open(NTPQ, $ntpq . " -np $host 2>&1 |") ) {
-                while (<NTPQ>) {
-                        print $_ if ($verbose);
-                        if ( /timed out/ ){
-                                $have_ntpq = 0 ;
-                                last ;
-                        }
-                        # number of candidates on <host> for sys.peer
-                        if (/^(\*|\+|\#|o])/) {
-                                ++$candidate;
-                                push (@candidates, $_);
-                                print "Candidate count= $candidate\n" if ($verbose);
-                        }
-                        
-                        # match sys.peer or pps.peer
-                        if (/^(\*|o)(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)/) {
-                                $syspeer = $2;
-                                $stratum = $4;
-                                $jitter = $11;
-                                print "match $_ \n" if $verbose;
-                                if ($jitter > $jcrit) {
-                                        print "Jitter_crit = $11 :$jcrit\n" if ($verbose);
-                                        $jitter_error = $ERRORS{'CRITICAL'};
-                                } elsif ($jitter > $jwarn ) {
-                                        print "Jitter_warn = $11 :$jwarn\n" if ($verbose);
-                                        $jitter_error = $ERRORS{'WARNING'};
-                                } else {
-                                        $jitter_error = $ERRORS{'OK'};
-                                }
-                        } else {
-                                print "No match!\n" if $verbose;
-                                $jitter = '(not parsed)';
-                        }
-                        
-                }
-                close NTPQ ||
-            die $! ? "Error closing $ntpq pipe: $!"
-                   : "Exit status: $? from $ntpq\n";
-                # if we did not match sys.peer or pps.peer but matched # candidates only
-                # generate a warning 
-                # based on bug id 773588
-                unless (defined $syspeer) {
-                        if ($#candidates >=0) {
-                                foreach my $c (@candidates) {
-                                        $c =~ /^(#)([-0-9.\s]+)\s+([-0-9A-Za-z_().]+)\s+([-0-9.]+)\s+([lumb-]+)\s+([-0-9m.]+)\s+([-0-9.]+)\s+([-0-9.]+)\s+([-0-9.]+)\s+([-0-9.]+)\s+([-0-9.]+)/;
-                                        $syspeer = $2;
-                                        $stratum = $4;
-                                        $jitter = $11;
-                                        print "candidate match $c \n" if $verbose;
-                                        if ($jitter > $jcrit) {
-                                                print "Candidate match - Jitter_crit = $11 :$jcrit\n" if ($verbose);
-                                                $jitter_error = $ERRORS{'CRITICAL'};
-                                        }elsif ($jitter > $jwarn ) {
-                                                print "Candidate match - Jitter_warn = $11 :$jwarn \n" if ($verbose);
-                                                $jitter_error = $ERRORS{'WARNING'};
-                                        } else {
-                                                $jitter_error = $ERRORS{'WARNING'};
-                                        }
-                                }
-                        }
-                }
-        }
-}
-if ($ntpdate_error != $ERRORS{'OK'}) {
-        $state = $ntpdate_error;
-        if ($ntpdate_error == $ERRORS{'WARNING'} ) {
-                $answer = $msg;
-        }
-        else {
-                $answer = $msg . "Server for ntp probably down";
-        }
-        if (defined($offset) && abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Server Error and offset $offset sec > +/- $ocrit sec";
-        } elsif (defined($offset) && abs($offset) > $owarn) {
-                $answer = "Server error and offset $offset sec > +/- $owarn sec";
-        } elsif (defined($jitter) && abs($jitter) > $jcrit) {
-                $answer = "Server error and jitter $jitter msec > +/- $jcrit msec";
-        } elsif (defined($jitter) && abs($jitter) > $jwarn) {
-                $answer = "Server error and jitter $jitter msec > +/- $jwarn msec";
-        }
-} elsif ($have_ntpq && $jitter_error != $ERRORS{'OK'}) {
-        $state = $jitter_error;
-        $answer = "Jitter $jitter too high";
-        if (defined($offset) && abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Jitter error and offset $offset sec > +/- $ocrit sec";
-        } elsif (defined($offset) && abs($offset) > $owarn) {
-                $answer = "Jitter error and offset $offset sec > +/- $owarn sec";
-        } elsif (defined($jitter) && abs($jitter) > $jcrit) {
-                $answer = "Jitter error and jitter $jitter msec > +/- $jcrit msec";
-        } elsif (defined($jitter) && abs($jitter) > $jwarn) {
-                $answer = "Jitter error and jitter $jitter msec > +/- $jwarn msec";
-        }
-} elsif( !$have_ntpq ) { # no errors from ntpdate and no ntpq or ntpq timed out
-        if (abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Offset $offset sec > +/- $ocrit sec";
-        } elsif (abs($offset) > $owarn) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset sec > +/- $owarn sec";
-        } elsif (( abs($offset) > $owarn) && $def_jitter ) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset sec > +/- $owarn sec, ntpq timed out";
-        } elsif ( $def_jitter ) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset secs, ntpq timed out";
-        } else{
-                $state = $ERRORS{'OK'};
-                $answer = "Offset $offset secs";
-        }
-} else { # no errors from ntpdate or ntpq
-        if (abs($offset) > $ocrit) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Offset $offset sec > +/- $ocrit sec, jitter $jitter msec";
-        } elsif (abs($jitter) > $jcrit ) {
-                $state = $ERRORS{'CRITICAL'};
-                $answer = "Jitter $jitter msec> +/- $jcrit msec, offset $offset sec";
-        } elsif (abs($offset) > $owarn) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Offset $offset sec > +/- $owarn sec, jitter $jitter msec";
-        } elsif (abs($jitter) > $jwarn ) {
-                $state = $ERRORS{'WARNING'};
-                $answer = "Jitter $jitter msec> +/- $jwarn msec, offset $offset sec";
-        } else {
-                $state = $ERRORS{'OK'};
-                $answer = "Offset $offset secs, jitter $jitter msec, peer is stratum $stratum";
-        }
-        
-}
-foreach my $key (keys %ERRORS) {
-        if ($state==$ERRORS{$key}) {
-#               print ("NTP $key: $answer");
-                print ("NTP $key: $answer|offset=$offset, jitter=" . $jitter/1000 .     ",peer_stratum=$stratum\n");
-                last;
-        }
-}
-exit $state;
-####
-#### subs
-sub print_usage () {
-        print "Usage: $PROGNAME -H <host> [-46] [-O] [-w <warn>] [-c <crit>] [-j <warn>] [-k <crit>] [-v verbose]\n";
-}
-sub print_help () {
-        print_revision($PROGNAME,'@NP_VERSION@');
-        print "Copyright (c) 2003 Bo Kersey/Karl DeBisschop\n";
-        print "\n";
-        print_usage();
-        print "
-Checks the local timestamp offset versus <host> with ntpdate
-Checks the jitter/dispersion of clock signal between <host> and its sys.peer with ntpq\n
-O (--zero-offset)
-     A zero offset on \"ntpdate\" will generate a CRITICAL.\n
-w (--warning)
-     Clock offset in seconds at which a warning message will be generated.\n    Defaults to $DEFAULT_OFFSET_WARN.
-c (--critical) 
-     Clock offset in seconds at which a critical message will be generated.\n   Defaults to $DEFAULT_OFFSET_CRIT.
-j (--jwarn)
-     Clock jitter in milliseconds at which a warning message will be generated.\n       Defaults to $DEFAULT_JITTER_WARN.
-k (--jcrit)
-    Clock jitter in milliseconds at which a critical message will be generated.\n       Defaults to $DEFAULT_JITTER_CRIT.
-    
-    If jitter/dispersion is specified with -j or -k and ntpq times out, then a
-    warning is returned.\n
-4 (--use-ipv4)
-    Use IPv4 connection
-6 (--use-ipv6)
-    Use IPv6 connection
-\n";    
-support();
-}
diff --git a/plugins-scripts/check_rpc.pl b/plugins-scripts/check_rpc.pl
index cbdeceb4..47d6e49e 100755
--- a/plugins-scripts/check_rpc.pl
+++ b/plugins-scripts/check_rpc.pl
@@ -63,12 +63,12 @@ GetOptions(
 );
 # -h means display verbose help screen
-if ($opt_h) { print_help(); exit $ERRORS{'OK'}; }
+if ($opt_h) { print_help(); exit $ERRORS{'UNKNOWN'}; }
 # -V means display version number
 if ($opt_V) {
        print_revision($PROGNAME,'@NP_VERSION@');
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 # Hash containing all RPC program names and numbers
diff --git a/plugins-scripts/check_wave.pl b/plugins-scripts/check_wave.pl
index 979416e0..41e15f50 100755
--- a/plugins-scripts/check_wave.pl
+++ b/plugins-scripts/check_wave.pl
@@ -31,12 +31,12 @@ GetOptions
 if ($opt_V) {
        print_revision($PROGNAME,'@NP_VERSION@'); #'
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 if ($opt_h) {
        print_help();
-        exit $ERRORS{'OK'};
+        exit $ERRORS{'UNKNOWN'};
 }
 $opt_H = shift unless ($opt_H);
diff --git a/plugins-scripts/t/check_rpc.t b/plugins-scripts/t/check_rpc.t
index be8ae2f7..c58f7bf7 100644
--- a/plugins-scripts/t/check_rpc.t
+++ b/plugins-scripts/t/check_rpc.t
@@ -15,7 +15,7 @@ my $successOutput = '/^check_rpc/';
 my $t;
-$t += checkCmd( "./check_rpc -V",   0, $successOutput );
+$t += checkCmd( "./check_rpc -V",   3, $successOutput );
 exit(0) if defined($Test::Harness::VERSION);
 exit($tests - $t);
diff --git a/plugins/check_apt.c b/plugins/check_apt.c
index 8747f904..a639a411 100644
--- a/plugins/check_apt.c
+++ b/plugins/check_apt.c
@@ -160,10 +160,10 @@ int process_arguments (int argc, char **argv) {
                switch(c) {
                case 'h':
                        print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                case 'V':
                        print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                case 'v':
                        verbose++;
                        break;
diff --git a/plugins/check_by_ssh.c b/plugins/check_by_ssh.c
index a877f888..04bce38d 100644
--- a/plugins/check_by_ssh.c
+++ b/plugins/check_by_ssh.c
@@ -209,10 +209,10 @@ process_arguments (int argc, char **argv)
                switch (c) {
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'v':                                                                       /* help */
                        verbose = TRUE;
                        break;
diff --git a/plugins/check_cluster.c b/plugins/check_cluster.c
index cf699e1f..b86e501d 100644
--- a/plugins/check_cluster.c
+++ b/plugins/check_cluster.c
@@ -200,7 +200,7 @@ int process_arguments(int argc, char **argv){
                case 'V': /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                        break;
                case 'H': /* help */
diff --git a/plugins/check_dbi.c b/plugins/check_dbi.c
index a3d033f4..826eb8d9 100644
--- a/plugins/check_dbi.c
+++ b/plugins/check_dbi.c
@@ -368,10 +368,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':     /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':     /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'c':     /* critical range */
                        critical_range = optarg;
diff --git a/plugins/check_dig.c b/plugins/check_dig.c
index d899b119..db4b20eb 100644
--- a/plugins/check_dig.c
+++ b/plugins/check_dig.c
@@ -223,10 +223,10 @@ process_arguments (int argc, char **argv)
    switch (c) {
    case 'h':                 /* help */
      print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'V':                 /* version */
      print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'H':                 /* hostname */
      host_or_die(optarg);
      dns_server = optarg;
diff --git a/plugins/check_disk.c b/plugins/check_disk.c
index eb573f5f..9693bad3 100644
--- a/plugins/check_disk.c
+++ b/plugins/check_disk.c
@@ -766,10 +766,10 @@ process_arguments (int argc, char **argv)
      break;
    case 'V':                 /* version */
      print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'h':                 /* help */
      print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case '?':                 /* help */
      usage (_("Unknown argument"));
    }
diff --git a/plugins/check_dns.c b/plugins/check_dns.c
index 22121226..d6bd2c0f 100644
--- a/plugins/check_dns.c
+++ b/plugins/check_dns.c
@@ -395,10 +395,10 @@ process_arguments (int argc, char **argv)
    switch (c) {
    case 'h': /* help */
      print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'V': /* version */
      print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'v': /* version */
      verbose = TRUE;
      break;
diff --git a/plugins/check_dummy.c b/plugins/check_dummy.c
index 3ed68717..212a1344 100644
--- a/plugins/check_dummy.c
+++ b/plugins/check_dummy.c
@@ -52,11 +52,11 @@ main (int argc, char **argv)
    usage4 (_("Could not parse arguments"));
  else if (strcmp (argv[1], "-V") == 0 || strcmp (argv[1], "--version") == 0) {
    print_revision (progname, NP_VERSION);
-    exit (STATE_OK);
+    exit (STATE_UNKNOWN);
  }
  else if (strcmp (argv[1], "-h") == 0 || strcmp (argv[1], "--help") == 0) {
    print_help ();
-    exit (STATE_OK);
+    exit (STATE_UNKNOWN);
  }
  else if (!is_integer (argv[1]))
    usage4 (_("Arguments to check_dummy must be an integer"));
diff --git a/plugins/check_fping.c b/plugins/check_fping.c
index 274dd753..da1ce1a6 100644
--- a/plugins/check_fping.c
+++ b/plugins/check_fping.c
@@ -314,10 +314,10 @@ process_arguments (int argc, char **argv)
      usage5 ();
    case 'h':                 /* help */
      print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'V':                 /* version */
      print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'v':                 /* verbose mode */
      verbose = TRUE;
      break;
diff --git a/plugins/check_game.c b/plugins/check_game.c
index 29e59e2f..709dae1b 100644
--- a/plugins/check_game.c
+++ b/plugins/check_game.c
@@ -196,10 +196,10 @@ process_arguments (int argc, char **argv)
    switch (c) {
    case 'h': /* help */
      print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'V': /* version */
      print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
    case 'v': /* version */
      verbose = TRUE;
      break;
diff --git a/plugins/check_hpjd.c b/plugins/check_hpjd.c
index 5fe06984..f159f5a2 100644
--- a/plugins/check_hpjd.c
+++ b/plugins/check_hpjd.c
@@ -350,10 +350,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case '?':                                                                       /* help */
                        usage5 ();
                }
diff --git a/plugins/check_http.c b/plugins/check_http.c
index b1a69e55..2038f4a1 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -267,11 +267,11 @@ process_arguments (int argc, char **argv)
      break;
    case 'h': /* help */
      print_help ();
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
      break;
    case 'V': /* version */
      print_revision (progname, NP_VERSION);
-      exit (STATE_OK);
+      exit (STATE_UNKNOWN);
      break;
    case 't': /* timeout period */
      if (!is_intnonneg (optarg))
@@ -880,17 +880,42 @@ check_http (void)
  double elapsed_time_transfer = 0.0;
  int page_len = 0;
  int result = STATE_OK;
+  char *force_host_header = NULL;
  /* try to connect to the host at the given port number */
  gettimeofday (&tv_temp, NULL);
  if (my_tcp_connect (server_address, server_port, &sd) != STATE_OK)
    die (STATE_CRITICAL, _("HTTP CRITICAL - Unable to open TCP socket\n"));
  microsec_connect = deltime (tv_temp);
+    /* if we are called with the -I option, the -j method is CONNECT and */
+    /* we received -S for SSL, then we tunnel the request through a proxy*/
+    /* @20100414, public[at]frank4dd.com, http://www.frank4dd.com/howto  */
+    if ( server_address != NULL && strcmp(http_method, "CONNECT") == 0
+      && host_name != NULL && use_ssl == TRUE) {
+    if (verbose) printf ("Entering CONNECT tunnel mode with proxy %s:%d to dst %s:%d\n", server_address, server_port, host_name, HTTPS_PORT);
+    asprintf (&buf, "%s %s:%d HTTP/1.1\r\n%s\r\n", http_method, host_name, HTTPS_PORT, user_agent);
+    asprintf (&buf, "%sProxy-Connection: keep-alive\r\n", buf);
+    asprintf (&buf, "%sHost: %s\r\n", buf, host_name);
+    /* we finished our request, send empty line with CRLF */
+    asprintf (&buf, "%s%s", buf, CRLF);
+    if (verbose) printf ("%s\n", buf);
+    send(sd, buf, strlen (buf), 0);
+    buf[0]='\0';
+    if (verbose) printf ("Receive response from proxy\n");
+    read (sd, buffer, MAX_INPUT_BUFFER-1);
+    if (verbose) printf ("%s", buffer);
+    /* Here we should check if we got HTTP/1.1 200 Connection established */
+  }
 #ifdef HAVE_SSL
  elapsed_time_connect = (double)microsec_connect / 1.0e6;
  if (use_ssl == TRUE) {
    gettimeofday (&tv_temp, NULL);
    result = np_net_ssl_init_with_hostname_version_and_cert(sd, (use_sni ? host_name : NULL), ssl_version, client_cert, client_privkey);
+    if (verbose) printf ("SSL initialized\n");
    if (result != STATE_OK)
      die (STATE_CRITICAL, NULL);
    microsec_ssl = deltime (tv_temp);
@@ -904,29 +929,51 @@ check_http (void)
  }
 #endif /* HAVE_SSL */
-  xasprintf (&buf, "%s %s %s\r\n%s\r\n", http_method, server_url, host_name ? "HTTP/1.1" : "HTTP/1.0", user_agent);
+  if ( server_address != NULL && strcmp(http_method, "CONNECT") == 0
+       && host_name != NULL && use_ssl == TRUE)
+    asprintf (&buf, "%s %s %s\r\n%s\r\n", "GET", server_url, host_name ? "HTTP/1.1" : "HTTP/1.0", user_agent);
+  else
+    asprintf (&buf, "%s %s %s\r\n%s\r\n", http_method, server_url, host_name ? "HTTP/1.1" : "HTTP/1.0", user_agent);
  /* tell HTTP/1.1 servers not to keep the connection alive */
  xasprintf (&buf, "%sConnection: close\r\n", buf);
+  /* check if Host header is explicitly set in options */
+  if (http_opt_headers_count) {
+    for (i = 0; i < http_opt_headers_count ; i++) {
+      if (strncmp(http_opt_headers[i], "Host:", 5) == 0) {
+        force_host_header = http_opt_headers[i];
+      }
+    }
+  }
  /* optionally send the host header info */
  if (host_name) {
-    /*
+    if (force_host_header) {
-     * Specify the port only if we're using a non-default port (see RFC 2616,
+      xasprintf (&buf, "%s%s\r\n", buf, force_host_header);
-     * 14.23).  Some server applications/configurations cause trouble if the
+    }
-     * (default) port is explicitly specified in the "Host:" header line.
+    else {
-     */
+      /*
-    if ((use_ssl == FALSE && server_port == HTTP_PORT) ||
+       * Specify the port only if we're using a non-default port (see RFC 2616,
-        (use_ssl == TRUE && server_port == HTTPS_PORT))
+       * 14.23).  Some server applications/configurations cause trouble if the
-      xasprintf (&buf, "%sHost: %s\r\n", buf, host_name);
+       * (default) port is explicitly specified in the "Host:" header line.
-    else
+       */
-      xasprintf (&buf, "%sHost: %s:%d\r\n", buf, host_name, server_port);
+      if ((use_ssl == FALSE && server_port == HTTP_PORT) ||
+          (use_ssl == TRUE && server_port == HTTPS_PORT) ||
+          (server_address != NULL && strcmp(http_method, "CONNECT") == 0
+         && host_name != NULL && use_ssl == TRUE))
+        xasprintf (&buf, "%sHost: %s\r\n", buf, host_name);
+      else
+        xasprintf (&buf, "%sHost: %s:%d\r\n", buf, host_name, server_port);
+    }
  }
  /* optionally send any other header tag */
  if (http_opt_headers_count) {
    for (i = 0; i < http_opt_headers_count ; i++) {
-      xasprintf (&buf, "%s%s\r\n", buf, http_opt_headers[i]);
+      if (force_host_header != http_opt_headers[i]) {
+        xasprintf (&buf, "%s%s\r\n", buf, http_opt_headers[i]);
+      }
    }
    /* This cannot be free'd here because a redirection will then try to access this and segfault */
    /* Covered in a testcase in tests/check_http.t */
@@ -1508,7 +1555,7 @@ print_help (void)
  printf ("    %s\n", _("URL to GET or POST (default: /)"));
  printf (" %s\n", "-P, --post=STRING");
  printf ("    %s\n", _("URL encoded http POST data"));
-  printf (" %s\n", "-j, --method=STRING  (for example: HEAD, OPTIONS, TRACE, PUT, DELETE)");
+  printf (" %s\n", "-j, --method=STRING  (for example: HEAD, OPTIONS, TRACE, PUT, DELETE, CONNECT)");
  printf ("    %s\n", _("Set HTTP method."));
  printf (" %s\n", "-N, --no-body");
  printf ("    %s\n", _("Don't wait for document body: stop reading after headers."));
@@ -1582,7 +1629,7 @@ print_help (void)
  printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 14 days,"));
  printf (" %s\n", _("a STATE_OK is returned. When the certificate is still valid, but for less than"));
  printf (" %s\n", _("14 days, a STATE_WARNING is returned. A STATE_CRITICAL will be returned when"));
-  printf (" %s\n", _("the certificate is expired."));
+  printf (" %s\n\n", _("the certificate is expired."));
  printf ("\n");
  printf (" %s\n\n", "CHECK CERTIFICATE: check_http -H www.verisign.com -C 30,14");
  printf (" %s\n", _("When the certificate of 'www.verisign.com' is valid for more than 30 days,"));
@@ -1590,6 +1637,13 @@ print_help (void)
  printf (" %s\n", _("30 days, but more than 14 days, a STATE_WARNING is returned."));
  printf (" %s\n", _("A STATE_CRITICAL will be returned when certificate expires in less than 14 days"));
+  printf (" %s\n\n", "CHECK SSL WEBSERVER CONTENT VIA PROXY USING HTTP 1.1 CONNECT: ");
+  printf (" %s\n", _("check_http -I 192.168.100.35 -p 80 -u https://www.verisign.com/ -S -j CONNECT -H www.verisign.com "));
+  printf (" %s\n", _("all these options are needed: -I <proxy> -p <proxy-port> -u <check-url> -S(sl) -j CONNECT -H <webserver>"));
+  printf (" %s\n", _("a STATE_OK will be returned. When the server returns its content but exceeds"));
+  printf (" %s\n", _("the 5-second threshold, a STATE_WARNING will be returned. When an error occurs,"));
+  printf (" %s\n", _("a STATE_CRITICAL will be returned."));
 #endif
  printf (UT_SUPPORT);
diff --git a/plugins/check_ide_smart.c b/plugins/check_ide_smart.c
index 47605e96..8d540ca1 100644
--- a/plugins/check_ide_smart.c
+++ b/plugins/check_ide_smart.c
@@ -234,10 +234,10 @@ main (int argc, char *argv[])
                        break;
                case 'h':
                        print_help ();
-                        return STATE_OK;
+                        return STATE_UNKNOWN;
                case 'V':
                        print_revision (progname, NP_VERSION);
-                        return STATE_OK;
+                        return STATE_UNKNOWN;
                default:
                        usage5 ();
                }
@@ -249,7 +249,7 @@ main (int argc, char *argv[])
        if (!device) {
                print_help ();
-                return STATE_OK;
+                return STATE_UNKNOWN;
        }
        fd = open (device, OPEN_MODE);
diff --git a/plugins/check_ldap.c b/plugins/check_ldap.c
index cfc8222a..e70d6a51 100644
--- a/plugins/check_ldap.c
+++ b/plugins/check_ldap.c
@@ -325,10 +325,10 @@ process_arguments (int argc, char **argv)
                switch (c) {
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 't':                                                                       /* timeout period */
                        if (!is_intnonneg (optarg))
                                usage2 (_("Timeout interval must be a positive integer"), optarg);
diff --git a/plugins/check_load.c b/plugins/check_load.c
index cde63e56..a96435f4 100644
--- a/plugins/check_load.c
+++ b/plugins/check_load.c
@@ -251,10 +251,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case '?':                                                                       /* help */
                        usage5 ();
                }
diff --git a/plugins/check_mrtg.c b/plugins/check_mrtg.c
index cf3fe044..1fda5492 100644
--- a/plugins/check_mrtg.c
+++ b/plugins/check_mrtg.c
@@ -234,10 +234,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case '?':                                                                       /* help */
                        usage5 ();
                }
diff --git a/plugins/check_mrtgtraf.c b/plugins/check_mrtgtraf.c
index 3b038cf1..eb66f622 100644
--- a/plugins/check_mrtgtraf.c
+++ b/plugins/check_mrtgtraf.c
@@ -270,10 +270,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case '?':                                                                       /* help */
                        usage5 ();
                }
diff --git a/plugins/check_mysql.c b/plugins/check_mysql.c
index 216626bc..5773afd9 100644
--- a/plugins/check_mysql.c
+++ b/plugins/check_mysql.c
@@ -444,10 +444,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'v':
                        verbose++;
                        break;
diff --git a/plugins/check_mysql_query.c b/plugins/check_mysql_query.c
index 71ab7768..49a14dd3 100644
--- a/plugins/check_mysql_query.c
+++ b/plugins/check_mysql_query.c
@@ -250,10 +250,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'q':
                        xasprintf(&sql_query, "%s", optarg);
                        break;
diff --git a/plugins/check_nagios.c b/plugins/check_nagios.c
index 791b6dbe..40d68f03 100644
--- a/plugins/check_nagios.c
+++ b/plugins/check_nagios.c
@@ -235,10 +235,10 @@ process_arguments (int argc, char **argv)
                switch (c) {
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'F':                                                                       /* status log */
                        status_log = optarg;
                        break;
diff --git a/plugins/check_nt.c b/plugins/check_nt.c
index f621b0a8..59c135db 100644
--- a/plugins/check_nt.c
+++ b/plugins/check_nt.c
@@ -553,10 +553,10 @@ int process_arguments(int argc, char **argv){
                        usage5 ();
                        case 'h': /* help */
                                print_help();
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                        case 'V': /* version */
                                print_revision(progname, NP_VERSION);
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                        case 'H': /* hostname */
                                server_address = optarg;
                                break;
diff --git a/plugins/check_ntp.c b/plugins/check_ntp.c
index a7d278de..75efc289 100644
--- a/plugins/check_ntp.c
+++ b/plugins/check_ntp.c
@@ -691,11 +691,11 @@ int process_arguments(int argc, char **argv){
                switch (c) {
                case 'h':
                        print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                        break;
                case 'V':
                        print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                        break;
                case 'v':
                        verbose++;
diff --git a/plugins/check_ntp_peer.c b/plugins/check_ntp_peer.c
index 44424af5..c656b0f5 100644
--- a/plugins/check_ntp_peer.c
+++ b/plugins/check_ntp_peer.c
@@ -448,11 +448,11 @@ int process_arguments(int argc, char **argv){
                switch (c) {
                case 'h':
                        print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                        break;
                case 'V':
                        print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                        break;
                case 'v':
                        verbose++;
diff --git a/plugins/check_ntp_time.c b/plugins/check_ntp_time.c
index e344f8b7..295f86f6 100644
--- a/plugins/check_ntp_time.c
+++ b/plugins/check_ntp_time.c
@@ -477,11 +477,11 @@ int process_arguments(int argc, char **argv){
                switch (c) {
                case 'h':
                        print_help();
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                        break;
                case 'V':
                        print_revision(progname, NP_VERSION);
-                        exit(STATE_OK);
+                        exit(STATE_UNKNOWN);
                        break;
                case 'v':
                        verbose++;
diff --git a/plugins/check_nwstat.c b/plugins/check_nwstat.c
index 1a7bfa16..e7e8de05 100644
--- a/plugins/check_nwstat.c
+++ b/plugins/check_nwstat.c
@@ -1354,10 +1354,10 @@ int process_arguments(int argc, char **argv) {
                        usage5 ();
                        case 'h': /* help */
                                print_help();
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                        case 'V': /* version */
                                print_revision(progname, NP_VERSION);
-                                exit(STATE_OK);
+                                exit(STATE_UNKNOWN);
                        case 'H': /* hostname */
                                server_address=optarg;
                                break;
diff --git a/plugins/check_overcr.c b/plugins/check_overcr.c
index af5eb9b9..9a4d25fa 100644
--- a/plugins/check_overcr.c
+++ b/plugins/check_overcr.c
@@ -340,10 +340,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'H':                                                                       /* hostname */
                        server_address = optarg;
                        break;
diff --git a/plugins/check_pgsql.c b/plugins/check_pgsql.c
index 9bad1ec5..2eb699e8 100644
--- a/plugins/check_pgsql.c
+++ b/plugins/check_pgsql.c
@@ -302,10 +302,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':     /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':     /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 't':     /* timeout period */
                        if (!is_integer (optarg))
                                usage2 (_("Timeout interval must be a positive integer"), optarg);
diff --git a/plugins/check_ping.c b/plugins/check_ping.c
index dbc5c3e4..423ecbe5 100644
--- a/plugins/check_ping.c
+++ b/plugins/check_ping.c
@@ -224,11 +224,11 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                        break;
                case 'V':       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                        break;
                case 't':       /* timeout period */
                        timeout_interval = atoi (optarg);
diff --git a/plugins/check_procs.c b/plugins/check_procs.c
index 402aac53..4bcc56bc 100644
--- a/plugins/check_procs.c
+++ b/plugins/check_procs.c
@@ -428,10 +428,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 't':                                                                       /* timeout period */
                        if (!is_integer (optarg))
                                usage2 (_("Timeout interval must be a positive integer"), optarg);
diff --git a/plugins/check_radius.c b/plugins/check_radius.c
index b2943475..03cbb8b0 100644
--- a/plugins/check_radius.c
+++ b/plugins/check_radius.c
@@ -259,10 +259,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (OK);
+                        exit (STATE_UNKNOWN);
                case 'v':                                                                       /* verbose mode */
                        verbose = TRUE;
                        break;
diff --git a/plugins/check_real.c b/plugins/check_real.c
index 00bd4d20..6491e6e9 100644
--- a/plugins/check_real.c
+++ b/plugins/check_real.c
@@ -359,10 +359,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case '?':                                                                       /* usage */
                        usage5 ();
                }
diff --git a/plugins/check_smtp.c b/plugins/check_smtp.c
index 24304534..56040ff2 100644
--- a/plugins/check_smtp.c
+++ b/plugins/check_smtp.c
@@ -623,10 +623,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case '?':                                                                       /* help */
                        usage5 ();
                }
diff --git a/plugins/check_snmp.c b/plugins/check_snmp.c
index 62e6b8b3..28cc44dd 100644
--- a/plugins/check_snmp.c
+++ b/plugins/check_snmp.c
@@ -709,10 +709,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'v': /* verbose */
                        verbose++;
                        break;
diff --git a/plugins/check_ssh.c b/plugins/check_ssh.c
index 3658965e..8ccbd5a7 100644
--- a/plugins/check_ssh.c
+++ b/plugins/check_ssh.c
@@ -128,10 +128,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'v':                                                                       /* verbose */
                        verbose = TRUE;
                        break;
diff --git a/plugins/check_swap.c b/plugins/check_swap.c
index 25e0bacd..4d5a4071 100644
--- a/plugins/check_swap.c
+++ b/plugins/check_swap.c
@@ -470,10 +470,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case '?':                                                                       /* error */
                        usage5 ();
                }
diff --git a/plugins/check_tcp.c b/plugins/check_tcp.c
index a18c37ae..6dc9aa96 100644
--- a/plugins/check_tcp.c
+++ b/plugins/check_tcp.c
@@ -237,7 +237,7 @@ main (int argc, char **argv)
        gettimeofday (&tv, NULL);
        result = np_net_connect (server_address, server_port, &sd, PROTOCOL);
-        if (result == STATE_CRITICAL) return STATE_CRITICAL;
+        if (result == STATE_CRITICAL) return econn_refuse_state;
 #ifdef HAVE_SSL
        if (flags & FLAG_SSL){
@@ -463,10 +463,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':                 /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                 /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'v':                 /* verbose mode */
                        flags |= FLAG_VERBOSE;
                        match_flags |= NP_MATCH_VERBOSE;
diff --git a/plugins/check_time.c b/plugins/check_time.c
index 3943742a..baf8c591 100644
--- a/plugins/check_time.c
+++ b/plugins/check_time.c
@@ -231,10 +231,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'H':                                                                       /* hostname */
                        if (is_host (optarg) == FALSE)
                                usage2 (_("Invalid hostname/address"), optarg);
diff --git a/plugins/check_ups.c b/plugins/check_ups.c
index 099881d0..dc5a348b 100644
--- a/plugins/check_ups.c
+++ b/plugins/check_ups.c
@@ -558,10 +558,10 @@ process_arguments (int argc, char **argv)
                        break;
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                }
        }
diff --git a/plugins/check_users.c b/plugins/check_users.c
index a009f20b..54415a48 100644
--- a/plugins/check_users.c
+++ b/plugins/check_users.c
@@ -210,10 +210,10 @@ process_arguments (int argc, char **argv)
                        usage5 ();
                case 'h':                                                                       /* help */
                        print_help ();
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'V':                                                                       /* version */
                        print_revision (progname, NP_VERSION);
-                        exit (STATE_OK);
+                        exit (STATE_UNKNOWN);
                case 'c':                                                                       /* critical */
                        if (!is_intnonneg (optarg))
                                usage4 (_("Critical threshold must be a positive integer"));
diff --git a/plugins/netutils.c b/plugins/netutils.c
index 83f8942f..705aaf09 100644
--- a/plugins/netutils.c
+++ b/plugins/netutils.c
@@ -161,6 +161,10 @@ process_request (const char *server_address, int server_port, int proto,
 int
 np_net_connect (const char *host_name, int port, int *sd, int proto)
 {
+        /* send back STATE_UNKOWN if there's an error
+           send back STATE_OK if we connect
+           send back STATE_CRITICAL if we can't connect.
+           Let upstream figure out what to send to the user. */
        struct addrinfo hints;
        struct addrinfo *r, *res;
        struct sockaddr_un su;
@@ -250,16 +254,14 @@ np_net_connect (const char *host_name, int port, int *sd, int proto)
        else if (was_refused) {
                switch (econn_refuse_state) { /* a user-defined expected outcome */
                case STATE_OK:
-                case STATE_WARNING:  /* user wants WARN or OK on refusal */
+                case STATE_WARNING:  /* user wants WARN or OK on refusal, or... */
-                        return econn_refuse_state;
+                case STATE_CRITICAL: /* user did not set econn_refuse_state, or wanted critical */
-                        break;
-                case STATE_CRITICAL: /* user did not set econn_refuse_state */
                        if (is_socket)
                                printf("connect to file socket %s: %s\n", host_name, strerror(errno));
                        else
                                printf("connect to address %s and port %d: %s\n",
                                       host_name, port, strerror(errno));
-                        return econn_refuse_state;
+                        return STATE_CRITICAL;
                        break;
                default: /* it's a logic error if we do not end up in STATE_(OK|WARNING|CRITICAL) */
                        return STATE_UNKNOWN;
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index 43b1a5a6..4f9c793c 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -195,7 +195,9 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
 #  ifdef USE_OPENSSL
        X509 *certificate=NULL;
        X509_NAME *subj=NULL;
+        char timestamp[50] = "";
        char cn[MAX_CN_LENGTH]= "";
+        
        int cnlen =-1;
        int status=STATE_UNKNOWN;
@@ -204,7 +206,7 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
        struct tm stamp;
        float time_left;
        int days_left;
-        char timestamp[50] = "";
+        int time_remaining;
        time_t tm_t;
        certificate=SSL_get_peer_certificate(s);
@@ -258,7 +260,8 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
                (tm->data[6 + offset] - '0') * 10 + (tm->data[7 + offset] - '0');
        stamp.tm_min =
                (tm->data[8 + offset] - '0') * 10 + (tm->data[9 + offset] - '0');
-        stamp.tm_sec = 0;
+        stamp.tm_sec =
+                (tm->data[10 + offset] - '0') * 10 + (tm->data[11 + offset] - '0');
        stamp.tm_isdst = -1;
        time_left = difftime(timegm(&stamp), time(NULL));
@@ -269,21 +272,35 @@ int np_net_ssl_check_cert(int days_till_exp_warn, int days_till_exp_crit){
        if (days_left > 0 && days_left <= days_till_exp_warn) {
                printf (_("%s - Certificate '%s' expires in %d day(s) (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, days_left, timestamp);
                if (days_left > days_till_exp_crit)
-                        return STATE_WARNING;
+                        status = STATE_WARNING;
                else
-                        return STATE_CRITICAL;
+                        status = STATE_CRITICAL;
+        } else if (days_left == 0 && time_left > 0) {
+                if (time_left >= 3600)
+                        time_remaining = (int) time_left / 3600;
+                else
+                        time_remaining = (int) time_left / 60;
+                printf (_("%s - Certificate '%s' expires in %u %s (%s)\n"),
+                        (days_left>days_till_exp_crit) ? "WARNING" : "CRITICAL", cn, time_remaining,
+                        time_left >= 3600 ? "hours" : "minutes", timestamp);
+                if ( days_left > days_till_exp_crit)
+                        status = STATE_WARNING;
+                else
+                        status = STATE_CRITICAL;
        } else if (time_left < 0) {
                printf(_("CRITICAL - Certificate '%s' expired on %s.\n"), cn, timestamp);
                status=STATE_CRITICAL;
        } else if (days_left == 0) {
-                printf (_("%s - Certificate '%s' expires today (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, timestamp);
+                printf (_("%s - Certificate '%s' just expired (%s).\n"), (days_left>days_till_exp_crit)?"WARNING":"CRITICAL", cn, timestamp);
                if (days_left > days_till_exp_crit)
-                        return STATE_WARNING;
+                        status = STATE_WARNING;
                else
-                        return STATE_CRITICAL;
+                        status = STATE_CRITICAL;
        } else {
                printf(_("OK - Certificate '%s' will expire on %s.\n"), cn, timestamp);
-                status=STATE_OK;
+                status = STATE_OK;
        }
        X509_free(certificate);
        return status;
diff --git a/plugins/t/check_http.t b/plugins/t/check_http.t
index 2539a289..c2caec60 100644
--- a/plugins/t/check_http.t
+++ b/plugins/t/check_http.t
@@ -6,9 +6,10 @@
 use strict;
 use Test::More;
+use POSIX qw/mktime strftime/;
 use NPTest;
-plan tests => 30;
+plan tests => 42;
 my $successOutput = '/OK.*HTTP.*second/';
@@ -34,6 +35,8 @@ my $host_tcp_http2  = getTestParameter( "NP_HOST_TCP_HTTP2",
            "A host providing an index page containing the string 'monitoring'",
            "test.monitoring-plugins.org" );
+my $faketime = -x '/usr/bin/faketime' ? 1 : 0;
 $res = NPTest->testCmd(
        "./check_http $host_tcp_http -wt 300 -ct 600"
@@ -47,10 +50,10 @@ $res = NPTest->testCmd(
 like( $res->output, '/bob:there\r\ncarl:frown\r\n/', "Got headers with multiple -k options" );
 $res = NPTest->testCmd(
-        "./check_http $host_nonresponsive -wt 1 -ct 2"
+        "./check_http $host_nonresponsive -wt 1 -ct 2 -t 3"
        );
 cmp_ok( $res->return_code, '==', 2, "Webserver $host_nonresponsive not responding" );
-cmp_ok( $res->output, 'eq', "CRITICAL - Socket timeout after 10 seconds", "Output OK");
+cmp_ok( $res->output, 'eq', "CRITICAL - Socket timeout after 3 seconds", "Output OK");
 $res = NPTest->testCmd(
        "./check_http $hostname_invalid -wt 1 -ct 2"
@@ -112,6 +115,40 @@ SKIP: {
        $res = NPTest->testCmd( "./check_http www.verisign.com -C 1" );
        cmp_ok( $res->output, 'eq', $saved_cert_output, "Old syntax for cert checking still works");
+        # run some certificate checks with faketime
+        SKIP: {
+                skip "No faketime binary found", 12 if !$faketime;
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/OK - Certificate 'www.verisign.com' will expire on/, "Catch cert output");
+                is( $res->return_code, 0, "Catch cert output exit code" );
+                my($mon,$day,$hour,$min,$sec,$year) = ($res->output =~ /(\w+)\s+(\d+)\s+(\d+):(\d+):(\d+)\s+(\d+)\./);
+                if(!defined $year) {
+                    die("parsing date failed from: ".$res);
+                }
+                my $months = {'Jan' => 0, 'Feb' => 1, 'Mar' => 2, 'Apr' => 3, 'May' => 4, 'Jun' => 5, 'Jul' => 6, 'Aug' => 7, 'Sep' => 8, 'Oct' => 9, 'Nov' => 10, 'Dec' => 11};
+                my $ts   = mktime($sec, $min, $hour, $day, $months->{$mon}, $year-1900);
+                my $time = strftime("%Y-%m-%d %H:%M:%S", localtime($ts));
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' just expired/, "Output on expire date");
+                is( $res->return_code, 2, "Output on expire date" );
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-1))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expires in 0 minutes/, "cert expires in 1 second output");
+                is( $res->return_code, 2, "cert expires in 1 second exit code" );
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-120))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expires in 2 minutes/, "cert expires in 2 minutes output");
+                is( $res->return_code, 2, "cert expires in 2 minutes exit code" );
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts-7200))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expires in 2 hours/, "cert expires in 2 hours output");
+                is( $res->return_code, 2, "cert expires in 2 hours exit code" );
+                $res = NPTest->testCmd("LC_TIME=C TZ=UTC faketime -f '".strftime("%Y-%m-%d %H:%M:%S", localtime($ts+1))."' ./check_http -C 1 www.verisign.com");
+                like($res->output, qr/CRITICAL - Certificate 'www.verisign.com' expired on/, "Certificate expired output");
+                is( $res->return_code, 2, "Certificate expired exit code" );
+        };
        $res = NPTest->testCmd( "./check_http --ssl www.verisign.com -E" );
        like  ( $res->output, '/time_connect=[\d\.]+/', 'Extended Performance Data Output OK' );
        like  ( $res->output, '/time_ssl=[\d\.]+/', 'Extended Performance Data SSL Output OK' );
diff --git a/plugins/tests/check_http.t b/plugins/tests/check_http.t
index d93a0ecf..e72d243a 100755
--- a/plugins/tests/check_http.t
+++ b/plugins/tests/check_http.t
@@ -186,21 +186,21 @@ SKIP: {
        $result = NPTest->testCmd( "$command -p $port_https -S -C 14" );
        is( $result->return_code, 0, "$command -p $port_https -S -C 14" );
-        is( $result->output, 'OK - Certificate \'Ton Voon\' will expire on Sun Mar  3 21:41:00 2019.', "output ok" );
+        is( $result->output, 'OK - Certificate \'Ton Voon\' will expire on Sun Mar  3 21:41:28 2019.', "output ok" );
        $result = NPTest->testCmd( "$command -p $port_https -S -C 14000" );
        is( $result->return_code, 1, "$command -p $port_https -S -C 14000" );
-        like( $result->output, '/WARNING - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:00 2019\)./', "output ok" );
+        like( $result->output, '/WARNING - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:28 2019\)./', "output ok" );
        # Expired cert tests
        $result = NPTest->testCmd( "$command -p $port_https -S -C 13960,14000" );
        is( $result->return_code, 2, "$command -p $port_https -S -C 13960,14000" );
-        like( $result->output, '/CRITICAL - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:00 2019\)./', "output ok" );
+        like( $result->output, '/CRITICAL - Certificate \'Ton Voon\' expires in \d+ day\(s\) \(Sun Mar  3 21:41:28 2019\)./', "output ok" );
        $result = NPTest->testCmd( "$command -p $port_https_expired -S -C 7" );
        is( $result->return_code, 2, "$command -p $port_https_expired -S -C 7" );
        is( $result->output,
-                'CRITICAL - Certificate \'Ton Voon\' expired on Thu Mar  5 00:13:00 2009.',
+                'CRITICAL - Certificate \'Ton Voon\' expired on Thu Mar  5 00:13:16 2009.',
                "output ok" );
 }
diff --git a/plugins/utils.c b/plugins/utils.c
index 7f49e7be..a864e4aa 100644
--- a/plugins/utils.c
+++ b/plugins/utils.c
@@ -144,8 +144,6 @@ usage5 (void)
 void
 print_revision (const char *command_name, const char *revision)
 {
-        char plugin_revision[STRLEN];
        printf ("%s v%s (%s %s)\n",
                 command_name, revision, PACKAGE, VERSION);
 }