Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-08-03 21:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve handling of short-lived certificates (#3097)

Browse Source 
Certificates with a short validity period (e.g. Let's Encrypt's 6-day
"shortlived" profile, now GA) always tripped the days2warn expiry
thresholds and were shown in red on the "Certificate Validity (UTC)"
line, even seconds after issuance. That red is misleading for a cert
that is intentionally short-lived.

Detect short-lived certificates by their validity period (notAfter -
notBefore) using a new DAYS_VALID_SHORTLIVED threshold (default 10 days,
per the CA/Browser Forum BR 1.6.1 "Short-lived Subscriber Certificate"
definition, which also covers the LE 6-day profile). For such certs:

  - show them as good (not red) with a "short-lived cert (N days)" remark
    so the short lifespan reads as intended rather than as an error, and
  - warn (HIGH) only when less than 24h of validity is left, and only for
    certificates whose total lifetime exceeds 24h (a cert whose whole
    life is under 24h stays good until it expires rather than being
    flagged the entire time).

Regular certificates are unaffected and keep the existing days2warn
behaviour. The threshold is overridable via the DAYS_VALID_SHORTLIVED
env var (documented in doc/testssl.1.md next to DAYS2WARN1/2) and added
to CHANGELOG.md.

Verified end-to-end with local openssl s_server: 5-day fresh (green),
5-day with <24h left (red, "expires < 24h"), 12h fresh (green), 12h
nearly expired (green), and 90-day (unchanged ">= days").
This commit is contained in:
Eric Gu
2026-07-14 21:49:03 -04:00
parent 2f37eb069c
commit 26a75cf764
3 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/testssl.1.md
+1
View File
@@ -407,6 +407,7 @@ Except the environment variables mentioned above which can replace command line
* HPKP_MIN is preset to 30 (days). If you want warnings sooner or later for HTTP Public Key Pinning you can change this
* DAYS2WARN1 is the first threshold when you'll be warning of a certificate expiration of a host, preset to 60 (days). For Let's Encrypt this value will be divided internally by 2.
* DAYS2WARN2 is the second threshold when you'll be warning of a certificate expiration of a host, preset to 30 (days). For Let's Encrypt this value will be divided internally by 2.
* DAYS_VALID_SHORTLIVED is preset to 10 (days). Certificates with a total validity period (notAfter - notBefore) of this many days or fewer are treated as intentionally short-lived (see "Short-lived Subscriber Certificate" in the CA/Browser Forum Baseline Requirements, e.g. Let's Encrypt's 6-day profile). They are not being warned of for their short lifespan. A warning is issued only when less than 24 hours of validity are left, and only for certificates whose total validity period is more than 24 hours.
* TESTSSL_INSTALL_DIR is the derived installation directory of testssl.sh. Relatively to that the `bin` and mandatory `etc` directory will be looked for.
* CA_BUNDLES_PATH: If you have an own set of CA bundles or you want to point testssl.sh to a specific location of a CA bundle, you can use this variable to set the directory which testssl.sh will use. Please note that it overrides completely the builtin path of testssl.sh which means that you will only test against the bundles you point to. Also you might want to use `~/utils/create_ca_hashes.sh` to create the hashes for HPKP.
* MAX_SOCKET_FAIL: A number which tells testssl.sh how often a TCP socket connection may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like *Fatal error: repeated TCP connect problems, giving up*.