From 9d292358bcb0e79c8e03b7f1eec1c45e2f2132d3 Mon Sep 17 00:00:00 2001 From: David Cooper Date: Mon, 18 Jul 2016 15:13:52 -0400 Subject: [PATCH] Fix case where query fails without SNI Fix for case in which `$OPENSSL s_client` fails without SNI. --- testssl.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/testssl.sh b/testssl.sh index a792617..f60c4dd 100755 --- a/testssl.sh +++ b/testssl.sh @@ -3839,7 +3839,7 @@ certificate_info() { local ocsp_response=$5 local ocsp_response_status=$6 local cert_sig_algo cert_sig_hash_algo cert_key_algo - local expire days2expire secs2warn ocsp_uri crl startdate enddate issuer_C issuer_O issuer sans san cn cn_nosni + local expire days2expire secs2warn ocsp_uri crl startdate enddate issuer_C issuer_O issuer sans san cn cn_nosni="" local cert_fingerprint_sha1 cert_fingerprint_sha2 cert_fingerprint_serial local policy_oid local spaces="" @@ -4079,8 +4079,10 @@ certificate_info() { # no cipher suites specified here. We just want the default vhost subject $OPENSSL s_client $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $OPTIMAL_PROTO 2>>$ERRFILE $HOSTCERT.nosni - cn_nosni="$(get_cn_from_cert "$HOSTCERT.nosni")" - [[ -z "$cn_nosni" ]] && cn_nosni="no CN field in subject" + if grep -q "\-\-\-\-\-BEGIN" "$HOSTCERT.nosni"; then + cn_nosni="$(get_cn_from_cert "$HOSTCERT.nosni")" + [[ -z "$cn_nosni" ]] && cn_nosni="no CN field in subject" + fi #FIXME: check for SSLv3/v2 and look whether it goes to a different CN (probably not polite)