ssl-test 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 11a0ae9638ae444932d7eef5c49873e276056235
-  data.tar.gz: 3c9bec83c428f62c6f0e84559b4daf5687d4682e
+SHA256:
+  metadata.gz: 3f6f73059bf9880985e8564282104fa677ecf3016872948d4047d47589f4ff12
+  data.tar.gz: 2c5580091f64589290c5bda90b25172c5d78dab67c9a1a40829e3e2cc35bc98f
 SHA512:
-  metadata.gz: ea7b409ae5b9a83bf1ddfb3cfc844a4d8dd55d2aabbbf943c1f924e868b31ddb8b5aef0ecb6b2875652da476b50149939076f574ca3400ca9251901c2eb6ab56
-  data.tar.gz: dac29c015557a0ecc1470487d441962f2d4fbb6b8b1e458c931bf12b6ff2c2c42fc87070414a6b365febb7d0757808b712243c21f2f652fcc1a1042cfe3c0735
+  metadata.gz: 280ea4637845f7df589dfbc07ea51459a5fefaa36b36bb17614beb6fb809bc71f5d36a70e3ccc7e8fba61383b5ad0ba24e9fd49f066636792968ac6f132e5793
+  data.tar.gz: dc96640201b5098695be42467d052f592a2d3bf59d38e9cfbe1028bf7984226d46ec058ad35381383886cb84e7e348af07bf8429c67eed7d4fcafc8c89c3fe8f

data/.travis.yml

@@ -0,0 +1,5 @@
+language: ruby
+
+rvm:
+  - 2.4.3
+  - 2.5.0

data/README.md

@@ -1,4 +1,4 @@
-# SSLTest
+# SSLTest [![Build Status](https://travis-ci.org/jarthod/ssl-test.svg?branch=master)](https://travis-ci.org/jarthod/ssl-test) [![Depfu](https://badges.depfu.com/badges/0d732c9cbec3fdaaac7c5ba5583269db/overview.svg)](https://depfu.com/github/jarthod/ssl-test)
 
 A small ruby gem to help you test a website's SSL certificate.
 
@@ -58,12 +58,14 @@ Pretty much the same errors `curl` will:
 - Incomplete certificate chain (missing intermediary)
 - Self signed certificates
 - Valid certs used with incorect hostname
+- Untrusted root (if your system is up-to-date)
+- And more...
 
 ### GOTCHA: errors SSLTest will NOT detect
 
 There is a spefic kind or error this code will **NOT** detect: *revoked certificates*. This is much more complex to handle because it needs an up to date database of revoked certs to check with. This is implemented in most modern browsers but the results vary greatly (chrome ignores this for example).
 
-Here is an example of website with a revoked certificate: https://revoked.grc.com/
+Here is an example of website with a revoked certificate: https://revoked.badssl.com/
 
 Any contribution to add this feature is greatly appreciated :)
 

data/lib/ssl-test.rb

@@ -1,7 +1,7 @@
 require "net/https"
 
 module SSLTest
-  VERSION = "1.1.0"
+  VERSION = "1.2.0"
 
   def self.test url, open_timeout: 5, read_timeout: 5
     uri = URI.parse(url)
@@ -15,19 +15,45 @@ module SSLTest
     http.verify_mode = OpenSSL::SSL::VERIFY_PEER
     http.verify_callback = -> (verify_ok, store_context) {
       cert = store_context.current_cert
-      failed_cert_reason =  [store_context.error, store_context.error_string] if !verify_ok
+      failed_cert_reason = [store_context.error, store_context.error_string] if store_context.error != 0
       verify_ok
     }
 
     begin
-      res = http.start { }
+      http.start { }
       return [true, nil, cert]
     rescue OpenSSL::SSL::SSLError => e
       error = e.message
       error = "error code %d: %s" % failed_cert_reason if failed_cert_reason
+      if error =~ /certificate verify failed/
+        domains = cert_domains(cert)
+        if matching_domains(domains, uri.host).none?
+          error = "hostname \"#{uri.host}\" does not match the server certificate (#{domains.join(', ')})"
+        end
+      end
       return [false, error, cert]
     rescue => e
       return [nil, "SSL certificate test failed: #{e.message}"]
     end
   end
+
+  def self.cert_field_to_hash field
+    field.to_a.each.with_object({}) do |v, h|
+      v = v.to_a
+      h[v[0]] = v[1].encode('UTF-8', undef: :replace, invalid: :replace)
+    end
+  end
+
+  def self.cert_domains cert
+    (Array(cert_field_to_hash(cert.subject)['CN']) +
+      cert_field_to_hash(cert.extensions)['subjectAltName'].split(/\s*,\s*/))
+      .compact
+      .map {|s| s.gsub(/^DNS:/, '') }
+      .uniq
+  end
+
+  def self.matching_domains domains, hostname
+    domains.map {|s| Regexp.new("\A#{Regexp.escape(s).gsub('\*', '[^.]+')}\z") }
+      .select {|domain| domain.match?(hostname) }
+  end
 end

data/ssl-test.gemspec

@@ -18,5 +18,6 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_development_dependency "bundler", "~> 1.7"
-  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "minitest"
 end

data/test/ssl-test_test.rb

@@ -11,6 +11,20 @@ describe SSLTest do
       cert.must_be_instance_of OpenSSL::X509::Certificate
     end
 
+    it "returns no error on valid SAN" do
+      valid, error, cert = SSLTest.test("https://1000-sans.badssl.com/")
+      error.must_be_nil
+      valid.must_equal true
+      cert.must_be_instance_of OpenSSL::X509::Certificate
+    end
+
+    it "returns no error when no CN" do
+      valid, error, cert = SSLTest.test("https://no-common-name.badssl.com/")
+      error.must_be_nil
+      valid.must_equal true
+      cert.must_be_instance_of OpenSSL::X509::Certificate
+    end
+
     it "works with websites blocking http requests" do
       valid, error, cert = SSLTest.test("https://obyava.ua")
       error.must_be_nil
@@ -19,21 +33,28 @@ describe SSLTest do
     end
 
     it "returns error on self signed certificate" do
-      valid, error, cert = SSLTest.test("https://kernelcoffee.org")
+      valid, error, cert = SSLTest.test("https://self-signed.badssl.com/")
       error.must_equal "error code 18: self signed certificate"
       valid.must_equal false
       cert.must_be_instance_of OpenSSL::X509::Certificate
     end
 
+    it "returns error on untrusted root" do
+      valid, error, cert = SSLTest.test("https://untrusted-root.badssl.com/")
+      error.must_equal "error code 20: unable to get local issuer certificate"
+      valid.must_equal false
+      cert.must_be_instance_of OpenSSL::X509::Certificate
+    end
+
     it "returns error on invalid host" do
-      valid, error, cert = SSLTest.test("https://web1.updn.io")
-      error.must_equal 'hostname "web1.updn.io" does not match the server certificate'
+      valid, error, cert = SSLTest.test("https://wrong.host.badssl.com/")
+      error.must_equal 'hostname "wrong.host.badssl.com" does not match the server certificate (*.badssl.com, badssl.com)'
       valid.must_equal false
       cert.must_be_instance_of OpenSSL::X509::Certificate
     end
 
     it "returns error on expired cert" do
-      valid, error, cert = SSLTest.test("https://testssl-expire.disig.sk")
+      valid, error, cert = SSLTest.test("https://expired.badssl.com/")
       error.must_equal "error code 10: certificate has expired"
       valid.must_equal false
       cert.must_be_instance_of OpenSSL::X509::Certificate
@@ -55,9 +76,9 @@ describe SSLTest do
 
     # Not implemented yet
     # it "returns error on revoked cert" do
-    #   valid, error, cert = SSLTest.test("https://revoked.grc.com")
-    #   valid.must_equal false
+    #   valid, error, cert = SSLTest.test("https://revoked.badssl.com/")
     #   error.must_equal "error code XX: certificate has been revoked"
+    #   valid.must_equal false
     #   cert.must_be_instance_of OpenSSL::X509::Certificate
     # end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssl-test
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Adrien Jarthon
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-13 00:00:00.000000000 Z
+date: 2018-03-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -28,16 +28,30 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
 description: 
 email:
 - jobs@adrienjarthon.com
@@ -46,6 +60,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
+- ".travis.yml"
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -73,10 +88,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: Test website SSL certificate validity
 test_files:
 - test/ssl-test_test.rb
-has_rdoc: