From ecc6cd81603191d117154b8d3b36900d59f31265 Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Tue, 18 Aug 2020 21:52:59 +0200 Subject: [PATCH] Allow dir with PEM files for --add-CA Idea which popped up while following #1700 --- CHANGELOG.md | 1 + doc/testssl.1 | 2 +- doc/testssl.1.html | 5 +++-- doc/testssl.1.md | 5 +++-- testssl.sh | 8 ++++++-- 5 files changed, 14 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1bc49ec..6cf5c47 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,7 @@ * Rating (SSL Labs, not complete) * Don't penalize missing trust in rating when CA not in Java store * Added support for certificates with EdDSA signatures and pubilc keys +* --add-ca can also now be a directory with \*.pem files ### Features implemented / improvements in 3.0 diff --git a/doc/testssl.1 b/doc/testssl.1 index 2f4fea5..916b5b7 100644 --- a/doc/testssl.1 +++ b/doc/testssl.1 @@ -179,7 +179,7 @@ Please note that \fBfname\fR has to be in Unix format\. DOS carriage returns won \fB\-\-phone\-out\fR Checking for revoked certificates via CRL and OCSP is not done per default\. This switch instructs testssl\.sh to query external \-\- in a sense of the current run \-\- URIs\. By using this switch you acknowledge that the check might have privacy issues, a download of several megabytes (CRL file) may happen and there may be network connectivity problems while contacting the endpoint which testssl\.sh doesn\'t handle\. PHONE_OUT is the environment variable for this which needs to be set to true if you want this\. . .P -\fB\-\-add\-ca \fR enables you to add your own CA(s) for trust chain checks\. \fBcafile\fR can be a single path or multiple paths as a comma separated list of root CA files\. Internally they will be added during runtime to all CA stores\. This is (only) useful for internal hosts whose certificates is issued by internal CAs\. Alternatively ADDTL_CA_FILES is the environment variable for this\. +\fB\-\-add\-ca \fR enables you to add your own CA(s) in PEM format for trust chain checks\. \fBCAfile\fR can be a directory containing files with a \.pem extension, a single file or multiple files as a comma separated list of root CAs\. Internally they will be added during runtime to all CA stores\. This is (only) useful for internal hosts whose certificates are issued by internal CAs\. Alternatively ADDTL_CA_FILES is the environment variable for this\. . .SS "SINGLE CHECK OPTIONS" Any single check switch supplied as an argument prevents testssl\.sh from doing a default run\. It just takes this and if supplied other options and runs them \- in the order they would also appear in the default run\. diff --git a/doc/testssl.1.html b/doc/testssl.1.html index 2d66208..484eef6 100644 --- a/doc/testssl.1.html +++ b/doc/testssl.1.html @@ -220,8 +220,9 @@ in /etc/hosts. The use of the switch is only useful if you either

--phone-out Checking for revoked certificates via CRL and OCSP is not done per default. This switch instructs testssl.sh to query external -- in a sense of the current run -- URIs. By using this switch you acknowledge that the check might have privacy issues, a download of several megabytes (CRL file) may happen and there may be network connectivity problems while contacting the endpoint which testssl.sh doesn't handle. PHONE_OUT is the environment variable for this which needs to be set to true if you want this.

-

--add-ca <cafile> enables you to add your own CA(s) for trust chain checks. cafile can be a single path or multiple paths as a comma separated list of root CA files. Internally they will be added during runtime to all CA stores. This is (only) useful for internal hosts whose certificates is issued by internal CAs. Alternatively -ADDTL_CA_FILES is the environment variable for this.

+

--add-ca <CAfile> enables you to add your own CA(s) in PEM format for trust chain checks. CAfile can be a directory +containing files with a .pem extension, a single file or multiple files as a comma separated list of root CAs. Internally they will be added during runtime to all CA stores. This is (only) useful for internal hosts whose certificates are issued by internal CAs. Alternatively ADDTL_CA_FILES is the environment variable for this.

+

SINGLE CHECK OPTIONS

diff --git a/doc/testssl.1.md b/doc/testssl.1.md index 42f8c7e..4e21868 100644 --- a/doc/testssl.1.md +++ b/doc/testssl.1.md @@ -145,8 +145,9 @@ in `/etc/hosts`. The use of the switch is only useful if you either can't or ar `--phone-out` Checking for revoked certificates via CRL and OCSP is not done per default. This switch instructs testssl.sh to query external -- in a sense of the current run -- URIs. By using this switch you acknowledge that the check might have privacy issues, a download of several megabytes (CRL file) may happen and there may be network connectivity problems while contacting the endpoint which testssl.sh doesn't handle. PHONE_OUT is the environment variable for this which needs to be set to true if you want this. -`--add-ca ` enables you to add your own CA(s) for trust chain checks. `cafile` can be a single path or multiple paths as a comma separated list of root CA files. Internally they will be added during runtime to all CA stores. This is (only) useful for internal hosts whose certificates is issued by internal CAs. Alternatively ADDTL_CA_FILES is the environment variable for this. - +`--add-ca ` enables you to add your own CA(s) in PEM format for trust chain checks. `CAfile` can be a directory containing files with a \.pem extension, a single file or multiple files as a comma separated list of root CAs. Internally they will be added during runtime to all CA stores. This is (only) useful for internal hosts whose certificates are issued by internal CAs. Alternatively ADDTL_CA_FILES is the environment variable for this. +. +.SS "SINGLE CHECK OPTIONS" ### SINGLE CHECK OPTIONS diff --git a/testssl.sh b/testssl.sh index ed93ca8..9be25f3 100755 --- a/testssl.sh +++ b/testssl.sh @@ -18882,7 +18882,7 @@ tuning / connect options (most also can be preset via environment variables): --sneaky leave less traces in target logs: user agent, referer --ids-friendly skips a few vulnerability checks which may cause IDSs to block the scanning IP --phone-out allow to contact external servers for CRL download and querying OCSP responder - --add-ca path to or a comma separated list of CA files enables test against additional CAs. + --add-ca path to with *.pem or a comma separated list of CA files to include in trust check --basicauth provide HTTP basic auth information. output options (can also be preset via environment variables): @@ -21844,7 +21844,11 @@ parse_cmd_line() { "$do_mx_all_ips" && [[ "$NODNS" == none ]] && fatal "\"--mx\" and \"--nodns=none\" don't work together" $ERR_CMDLINE [[ -n "$CONNECT_TIMEOUT" ]] && [[ "$MASS_TESTING_MODE" == parallel ]] && fatal "Parallel mass scanning and specifying connect timeouts currently don't work together" $ERR_CMDLINE - ADDTL_CA_FILES="${ADDTL_CA_FILES//,/ }" + if [[ -d $ADDTL_CA_FILES ]]; then + ADDTL_CA_FILES="$ADDTL_CA_FILES/*.pem" + else + ADDTL_CA_FILES="${ADDTL_CA_FILES//,/ }" + fi for fname in $ADDTL_CA_FILES; do [[ -s "$fname" ]] || fatal "CA file \"$fname\" does not exist" $ERR_RESOURCE grep -q "BEGIN CERTIFICATE" "$fname" || fatal "\"$fname\" is not CA file in PEM format" $ERR_RESOURCE