Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-03 23:39:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Speed up intermediate certificate extraction

Browse Source 
This commit speeds up extraction of intermediate certificates by using Bash commands rather than awk.
This commit is contained in:
David Cooper 2020-07-15 11:53:49 -04:00
parent 851cd564e6
commit 17ee0245b5
1 changed files with 20 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
testssl.sh
View File

@ -8303,15 +8303,16 @@ certificate_info() {
local -i certificate_number=$1 local -i certificate_number=$1
local -i number_of_certificates=$2 local -i number_of_certificates=$2
local cert_txt="$3" local cert_txt="$3"
local cipher=$4 local intermediate_certs="$4"
local cert_keysize=$5 local cipher=$5
local cert_type="$6" local cert_keysize=$6
local ocsp_response_binary="$7" local cert_type="$7"
local ocsp_response=$8 local ocsp_response_binary="$8"
local ocsp_response_status=$9 local ocsp_response=$9
local sni_used="${10}" local ocsp_response_status=${10}
local ct="${11}" local sni_used="${11}"
local certificate_list_ordering_problem="${12}" local ct="${12}"
local certificate_list_ordering_problem="${13}"
local cert_sig_algo cert_sig_hash_algo cert_key_algo cert_spki_info local cert_sig_algo cert_sig_hash_algo cert_key_algo cert_spki_info
local common_primes_file="$TESTSSL_INSTALL_DIR/etc/common-primes.txt" local common_primes_file="$TESTSSL_INSTALL_DIR/etc/common-primes.txt"
local -i lineno_matched=0 local -i lineno_matched=0
@ -8320,7 +8321,7 @@ certificate_info() {
local expire days2expire secs2warn ocsp_uri crl local expire days2expire secs2warn ocsp_uri crl
local startdate enddate issuer_CN issuer_C issuer_O issuer sans san all_san="" cn local startdate enddate issuer_CN issuer_C issuer_O issuer sans san all_san="" cn
local issuer_DC issuerfinding cn_nosni="" local issuer_DC issuerfinding cn_nosni=""
local cert_fingerprint_sha1 cert_fingerprint_sha2 cert_serial cert local cert_fingerprint_sha1 cert_fingerprint_sha2 cert_serial intermediates cert
local policy_oid local policy_oid
local spaces="" local spaces=""
local -i trust_sni=0 trust_nosni=0 diffseconds=0 local -i trust_sni=0 trust_nosni=0 diffseconds=0
@ -8979,13 +8980,14 @@ certificate_info() {
#FIXME: We just raise the flag saying the chain is bad w/o naming the intermediate #FIXME: We just raise the flag saying the chain is bad w/o naming the intermediate
# cert to blame. # cert to blame.
awk -v n=-1 "{start=1} intermediates="$intermediate_certs"
/-----BEGIN CERTIFICATE-----/{ if (start) {inc=1; n++} } while true; do
inc { print > (\"$TEMPDIR/intermediatecert\" n \".crt\") } [[ "$intermediates" =~ \-\-\-\-\-\BEGIN\ CERTIFICATE\-\-\-\-\- ]] || break
/---END CERTIFICATE-----/{ inc=0 }" "$TEMPDIR/intermediatecerts.pem" intermediates="${intermediates#*-----BEGIN CERTIFICATE-----}"
cert="${intermediates%%-----END CERTIFICATE-----*}"
for cert in $TEMPDIR/intermediatecert?.crt; do intermediates="${intermediates#${cert}-----END CERTIFICATE-----}"
cert_ext_keyusage="$($OPENSSL x509 -in "$cert" -text -noout 2>/dev/null | awk '/X509v3 Extended Key Usage:/ { getline; print $0 }')" cert="-----BEGIN CERTIFICATE-----${cert}-----END CERTIFICATE-----"
cert_ext_keyusage="$($OPENSSL x509 -text -noout 2>/dev/null <<< "$cert" | awk '/X509v3 Extended Key Usage:/ { getline; print $0 }')"
[[ "$cert_ext_keyusage" =~ OCSP\ Signing ]] && badocsp=0 && break [[ "$cert_ext_keyusage" =~ OCSP\ Signing ]] && badocsp=0 && break
done done
if [[ $badocsp -eq 0 ]]; then if [[ $badocsp -eq 0 ]]; then
@ -9712,7 +9714,7 @@ run_server_defaults() {
echo "${previous_hostcert[i]}" > $HOSTCERT echo "${previous_hostcert[i]}" > $HOSTCERT
echo "${previous_intermediates[i]}" > $TEMPDIR/intermediatecerts.pem echo "${previous_intermediates[i]}" > $TEMPDIR/intermediatecerts.pem
echo "${previous_hostcert_issuer[i]}" > $TEMPDIR/hostcert_issuer.pem echo "${previous_hostcert_issuer[i]}" > $TEMPDIR/hostcert_issuer.pem
certificate_info "$i" "$certs_found" "${previous_hostcert_txt[i]}" \ certificate_info "$i" "$certs_found" "${previous_hostcert_txt[i]}" "${previous_intermediates[i]}" \
"${tested_cipher[i]}" "${keysize[i]}" "${previous_hostcert_type[i]}" \ "${tested_cipher[i]}" "${keysize[i]}" "${previous_hostcert_type[i]}" \
"${ocsp_response_binary[i]}" "${ocsp_response[i]}" \ "${ocsp_response_binary[i]}" "${ocsp_response[i]}" \
"${ocsp_response_status[i]}" "${sni_used[i]}" "${ct[i]}" \ "${ocsp_response_status[i]}" "${sni_used[i]}" "${ct[i]}" \