Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-03 23:39:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add OCSP checking

Browse Source 
This commit adds the option to query the OCSP server(s) specified in a server's certificate for the certificate's revocation status.
This commit is contained in:
David Cooper 2018-05-15 16:50:57 -04:00 committed by GitHub
parent 0851599a4e
commit 79c9536d47
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 55 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
testssl.sh
View File

@ -1493,6 +1493,36 @@ check_revocation_crl() {
return 0
}
check_revocation_ocsp() {
local uri="$1"
local jsonID="$2"
local tmpfile=""
local -i success
"$PHONE_OUT" || return 0
tmpfile=$TEMPDIR/${NODE}-${NODEIP}.${uri##*\/} || exit $ERR_FCREATE
$OPENSSL ocsp -no_nonce -url "$uri" -issuer $TEMPDIR/hostcert_issuer.pem \
-verify_other $TEMPDIR/intermediatecerts.pem \
-CAfile $TEMPDIR/intermediatecerts.pem -cert $HOSTCERT &> "$tmpfile"
if [[ $? -eq 0 ]] && grep -q "Response verify OK" "$tmpfile"; then
if grep -q "$HOSTCERT: good" "$tmpfile"; then
out ", "
pr_svrty_good "not revoked"
fileout "$jsonID" "OK" "not revoked"
elif grep -q "$HOSTCERT: revoked" "$tmpfile"; then
out ", "
pr_svrty_critical "revoked"
fileout "$jsonID" "CRITICAL" "revoked"
elif [[ $DEBUG -ge 2 ]]; then
outln
cat "$tmpfile"
fi
elif [[ $DEBUG -ge 2 ]]; then
outln
cat "$tmpfile"
fi
}
wait_kill(){
local pid=$1 # pid we wait for or kill
local maxsleep=$2 # how long we wait before killing
@ -6452,6 +6482,7 @@ extract_certificates() {
echo "" > $TEMPDIR/intermediatecerts.pem
else
cat level?.crt > $TEMPDIR/intermediatecerts.pem
cp level1.crt $TEMPDIR/hostcert_issuer.pem
rm level?.crt
fi
fi
@ -7510,9 +7541,27 @@ certificate_info() {
fileout "${jsonID}${json_postfix}" "INFO" "--"
else
if [[ $(count_lines "$ocsp_uri") -eq 1 ]]; then
outln "$ocsp_uri"
out "$ocsp_uri"
if [[ "$expfinding" != "expired" ]]; then
check_revocation_ocsp "$ocsp_uri" "cert_ocspRevoked${json_postfix}"
fi
ret=$((ret +$?))
outln
else
out_row_aligned "$ocsp_uri" "$spaces"
first_ocsp=true
while read -r line; do
if "$first_ocsp"; then
first_ocsp=false
else
out "$spaces"
fi
out "$line"
if [[ "$expfinding" != "expired" ]]; then
check_revocation_ocsp "$line" "cert_ocspRevoked${json_postfix}"
ret=$((ret +$?))
fi
outln
done <<< "$ocsp_uri"
fi
fileout "${jsonID}${json_postfix}" "INFO" "$ocsp_uri"
fi
@ -7609,7 +7658,7 @@ run_server_defaults() {
local -i i n
local -i certs_found=0
local -i ret=0
local -a previous_hostcert previous_hostcert_txt previous_hostcert_type previous_intermediates keysize cipher
local -a previous_hostcert previous_hostcert_txt previous_hostcert_type previous_hostcert_issuer previous_intermediates keysize cipher
local -a ocsp_response ocsp_response_status sni_used tls_version ct
local -a ciphers_to_test certificate_type
local -a -i success
@ -7740,6 +7789,8 @@ run_server_defaults() {
previous_hostcert[certs_found]=$newhostcert
previous_hostcert_txt[certs_found]="$($OPENSSL x509 -noout -text 2>>$ERRFILE <<< "$newhostcert")"
previous_intermediates[certs_found]=$(cat $TEMPDIR/intermediatecerts.pem)
previous_hostcert_issuer[certs_found]=""
[[ -n "${previous_intermediates[certs_found]}" ]] && previous_hostcert_issuer[certs_found]=$(cat $TEMPDIR/hostcert_issuer.pem)
[[ $n -ge 10 ]] && sni_used[certs_found]="" || sni_used[certs_found]="$SNI"
tls_version[certs_found]="$DETECTED_TLS_VERSION"
previous_hostcert_type[certs_found]=" ${certificate_type[n]}"
@ -7909,6 +7960,7 @@ run_server_defaults() {
for (( i=1; i <= certs_found; i++ )); do
echo "${previous_hostcert[i]}" > $HOSTCERT
echo "${previous_intermediates[i]}" > $TEMPDIR/intermediatecerts.pem
echo "${previous_hostcert_issuer[i]}" > $TEMPDIR/hostcert_issuer.pem
certificate_info "$i" "$certs_found" "${previous_hostcert_txt[i]}" \
"${cipher[i]}" "${keysize[i]}" "${previous_hostcert_type[i]}" \
"${ocsp_response[i]}" "${ocsp_response_status[i]}" "${sni_used[i]}" "${ct[i]}"