Git
/
testssl.sh
mirror of https://github.com/drwetter/testssl.sh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Addressed comments by @drwetter 

It is OK for a site to pin a CA that is not part of the chain (like github.com does)
This is a provision against a CA compromise (like diginotar) which could lead to a
briked site in case of CA compromise.

GitHub has built in multiple levels of security they have both backup pins for host
certs and back pins for CAs (and I wouldn;t be surprised if they have a backup
intermediate pin too).
This commit is contained in:
Frank Breedijk 2016-07-25 11:02:05 +02:00
parent 9133eddb9a
commit dd10194977
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
testssl.sh
View File

@ -1056,8 +1056,8 @@ run_hpkp() {
nrsaved=$(count_words "$(echo $TEMPDIR/level?.crt 2>/dev/null)")
rm $TEMPDIR/level0.crt 2>/dev/null
echo -n > "$TEMPDIR/intermediate.hashes"
if [[ nrsaved -ge 2 ]]; then
echo -n "" > "$TEMPDIR/intermediate.hashes"
for cert_fname in $TEMPDIR/level?.crt; do
hpkp_key_ca="$($OPENSSL x509 -in "$cert_fname" -pubkey -noout | grep -v PUBLIC | $OPENSSL base64 -d |
$OPENSSL dgst -sha256 -binary | $OPENSSL enc -base64)"
@ -1067,14 +1067,11 @@ run_hpkp() {
echo "$hpkp_key_ca $hpkp_name" >> "$TEMPDIR/intermediate.hashes"
done
fi
rm $TEMPDIR/level*.crt 2>/dev/null
# I'd like to keep all certs retrieved for debugging
# Get keys from Root CAs
# This is where the matching magic happens...
pins_match=false
for hpkp_key in $(echo $pins); do
# exho needed here? ^^^^
has_backup_pin=false
for hpkp_key in $pins; do
key_found=false
# compare pin against the host certificate
if [[ "$hpkp_key_hostcert" == "$hpkp_key" ]] || [[ "$hpkp_key_hostcert" == "$hpkp_key=" ]]; then
@ -1089,7 +1086,6 @@ run_hpkp() {
# Check for intermediate match
if ! $key_found; then
# doesn't work, "grep: /tmp/ssltester.Dp2ovS/intermediate.hashes: No such file or directory" if teested against testss.sh
hpkp_matches=$(grep "$hpkp_key" $TEMPDIR/intermediate.hashes 2>/dev/null)
if [[ -n $hpkp_matches ]]; then
# We have a match
@ -1122,7 +1118,7 @@ run_hpkp() {
out " (part of the chain)"
fileout "hpkp_$hpkp_key" "INFO" "Root CA key matches a key pinned in the HPKP header. Key/OS/CA: $hpkp_matches. The CA is part of the chain"
else
# there's a root CA match for github AND this message.
has_backup_pin=true
out "\n$spaces This CA is not part of the chain and likely a backup PIN"
fileout "hpkp_$hpkp_key" "INFO" "Root CA key matches a key pinned in the HPKP header. Key/OS/CA: $hpkp_matches. The CA is not part of the chain, this is a backup PIN"
fi
@ -1131,6 +1127,7 @@ run_hpkp() {
if ! $key_found; then
# Most likely a backup pin
has_backup_pin=true
out "\n\n$spaces Unmatched key: "
out "$hpkp_key"
out "\n$spaces (This is OK for a backup pin of a host cert)"
@ -1143,6 +1140,11 @@ run_hpkp() {
pr_svrty_high " No matching key for pins found "
fileout "hpkp_keymatch" "NOT ok" "None of the HPKP PINS match your host certificate, intermediate CA or known root CAs. You may have bricked this site"
fi
if ! $has_backup_pin; then
pr_svrty_high " No backup pins found. Loss/compromise of the currently pinned key(s) will lead to bricked site. "
fileout "hpkp_backup" "NOT ok" "No backup pins found. Loss/compromise of the currently pinned key(s) will lead to bricked site."
fi
else
out "--"
fileout "hpkp" "INFO" "No support for HTTP Public Key Pinning"