Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-02-04 14:51:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix Two CRL and/or two OCSP URLs

Browse Source 
This PR fixes issue #601.

The fix for OCSP URLs was easy. I don't entirely understand the first `awk` command in the line to extract the CRL URLs, but I tested it on several certificates and it seems to work correctly (ensuring that the only "URI" lines in the input to the second `awk` command are from the CRL Distribution Points extension).
This commit is contained in:
David Cooper 2017-02-02 13:04:49 -05:00 committed by GitHub
parent ec7aa2481a
commit e9d6ac8ad1
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
testssl.sh
View File

@ -6188,7 +6188,8 @@ certificate_info() {
fileout "${json_prefix}certcount" "INFO" "# of certificates provided : $certificates_provided"
# Get both CRL and OCSP URL upfront. If there's none, this is not good. And we need to penalize this in the output
crl="$($OPENSSL x509 -in $HOSTCERT -noout -text 2>>$ERRFILE | awk '/CRL Distribution/,/URI/ { print $0 }' | awk -F'URI:' '/URI/ { print $2 }')"
crl="$($OPENSSL x509 -in $HOSTCERT -noout -text 2>>$ERRFILE | grep -A 50 "X509v3 CRL Distribution Points:" | \
tail -n +2 | awk '/^$/,/^ [a-zA-Z0-9]+|^ Signature Algorithm:/' | awk -F'URI:' '/URI/ { print $2 }')"
ocsp_uri=$($OPENSSL x509 -in $HOSTCERT -noout -ocsp_uri 2>>$ERRFILE)
out "$indent"; pr_bold " Certificate Revocation List "
@ -6218,7 +6219,11 @@ certificate_info() {
outln "--"
fileout "${json_prefix}ocsp_uri" "INFO" "OCSP URI : --"
else
if [[ $(count_lines "$ocsp_uri") -eq 1 ]]; then
outln "$ocsp_uri"
else
out_row_aligned "$ocsp_uri" "$spaces"
fi
fileout "${json_prefix}ocsp_uri" "INFO" "OCSP URI : $ocsp_uri"
fi