check_certificate_chain 2.3.2 → 2.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/bin/check_certificate_chain +25 -5
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 1ae0cbbfe9f20b30e36746f9b019af48d638ccd979af3e57dce7cc4ded02c832
|
|
4
|
+
data.tar.gz: c6602eaf11b1f68c4788d1253d017de33fb26f1675109e4d7e19e083931382e1
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 12a9741a5a89407e47adf30949fb77ecebe3ca314b4311ea949db59aae0489c075e0a719a277bfa00a4a162c736c7b43feb965507ccd3045e881589c20bea68f
|
|
7
|
+
data.tar.gz: 2c08e9568ed2bbdc8085865db545e3b95cfede6a6a826526a1e6ed7ac83d459d8039ed8ab983bcdbeaa630f5ea4ebb4b2b8d51416414595ceb5b9f49e9bdd5dd
|
data/bin/check_certificate_chain
CHANGED
|
@@ -6,6 +6,20 @@ require 'socket'
|
|
|
6
6
|
require 'net/http'
|
|
7
7
|
require 'pastel'
|
|
8
8
|
|
|
9
|
+
class OpenSSL::X509::Certificate
|
|
10
|
+
def exceptionless_verify(public_key)
|
|
11
|
+
begin
|
|
12
|
+
self.verify(public_key)
|
|
13
|
+
rescue OpenSSL::X509::CertificateError => e
|
|
14
|
+
if e.message == "wrong public key type"
|
|
15
|
+
return false
|
|
16
|
+
else
|
|
17
|
+
raise OpenSSL::X509::CertificateError, "OpenSSL::X509::CertificateError"
|
|
18
|
+
end
|
|
19
|
+
end
|
|
20
|
+
end
|
|
21
|
+
end
|
|
22
|
+
|
|
9
23
|
servername = ""
|
|
10
24
|
host = ""
|
|
11
25
|
port = ""
|
|
@@ -33,7 +47,6 @@ host = argument_match_result[:ip02] || argument_match_result[:domain02]
|
|
|
33
47
|
servername = (argument_match_result[:ip01] || argument_match_result[:domain01]) || host
|
|
34
48
|
port = argument_match_result[:port] || "443"
|
|
35
49
|
|
|
36
|
-
|
|
37
50
|
pastel = Pastel.new(eachline: "\n")
|
|
38
51
|
|
|
39
52
|
good = pastel.green.detach
|
|
@@ -47,7 +60,14 @@ warning = pastel.yellow.detach
|
|
|
47
60
|
|
|
48
61
|
openssl_context = OpenSSL::SSL::SSLContext.new
|
|
49
62
|
|
|
50
|
-
|
|
63
|
+
begin
|
|
64
|
+
tcp_socket = TCPSocket.new(host, port.to_i)
|
|
65
|
+
rescue SocketError => e
|
|
66
|
+
abort bad[e.message]
|
|
67
|
+
rescue Errno::ECONNREFUSED => e
|
|
68
|
+
abort bad[e.message]
|
|
69
|
+
end
|
|
70
|
+
|
|
51
71
|
ip = tcp_socket.peeraddr(false).last
|
|
52
72
|
|
|
53
73
|
chain = nil
|
|
@@ -77,7 +97,7 @@ output[:issues] = []
|
|
|
77
97
|
output[:ocsp_check] = []
|
|
78
98
|
|
|
79
99
|
def is_root?(certificate)
|
|
80
|
-
self_signed = certificate.
|
|
100
|
+
self_signed = certificate.exceptionless_verify certificate.public_key
|
|
81
101
|
|
|
82
102
|
basic_constraints = certificate.extensions.find do |extension|
|
|
83
103
|
extension.oid.eql?("basicConstraints")
|
|
@@ -126,7 +146,7 @@ end
|
|
|
126
146
|
### OCSP Check
|
|
127
147
|
authority_info_access = certificate.extensions.find{|ext| ext.oid.eql?("authorityInfoAccess")}
|
|
128
148
|
if check_certificate_hostname && not_expired && authority_info_access
|
|
129
|
-
if issuer = chain.find{|chain_certificate| certificate.
|
|
149
|
+
if issuer = chain.find{|chain_certificate| certificate.exceptionless_verify(chain_certificate.public_key)}
|
|
130
150
|
digest = OpenSSL::Digest::SHA1.new
|
|
131
151
|
certificate_id = OpenSSL::OCSP::CertificateId.new certificate, issuer, digest
|
|
132
152
|
|
|
@@ -238,7 +258,7 @@ chain.each_with_index do |chain_certificate, index|
|
|
|
238
258
|
if chain_check_status
|
|
239
259
|
check_status = chain.any? do |possible_issuer|
|
|
240
260
|
unless possible_issuer.eql?(chain_certificate) && is_root?(chain_certificate)
|
|
241
|
-
if chain_certificate.
|
|
261
|
+
if chain_certificate.exceptionless_verify possible_issuer.public_key
|
|
242
262
|
output[:issues] << bad[" Certificate is self-signed"] if chain_certificate.eql?(possible_issuer)
|
|
243
263
|
if chain.index(possible_issuer) - chain.index(chain_certificate) > 1
|
|
244
264
|
chain_order_status = false
|