diff --git a/README.md b/README.md index 8f01deb..f85231d 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ Note that certigo requires Go 1.6 or later to build. ### Develop -We use [glide][1] for managing vendored dependencies. +We use [glide][1] for managing vendored dependencies. [1]: https://glide.sh @@ -28,46 +28,12 @@ Currently supported formats are DER, PEM, JCEKS and PKCS12. It's a one-stop shop For example (from stdin): - $ certigo dump < certificate.pem - ** CERTIFICATE 1 ** - Serial: 11578389349061131131 - Not Before: 2016-05-27 21:15:31 +0000 UTC - Not After : 2017-10-09 21:15:31 +0000 UTC - Signature algorithm: SHA1-RSA - Subject Info: - CommonName: ApertureScience - Organization: [Aperture Science] - OrganizationalUnit: [Research and Development] - Country: [US] - Locality: [San Francisco] - Issuer Info: - CommonName: ApertureScience - Organization: [Aperture Science] - OrganizationalUnit: [Research and Development] - Country: [US] - Locality: [San Francisco] + Or from a file: - $ certigo dump keystore.jceks - Enter password: some-password - ** CERTIFICATE 1 ** - Alias: trusted-cert-some-alias - Serial: 15734933907626610346 - Not Before: 2014-03-14 14:10:45 +0000 UTC - Not After : 2015-03-14 14:10:45 +0000 UTC - Signature algorithm: SHA1-RSA - Subject Info: - CommonName: Test User - Organization: [Test Organization] - Country: [US] - Issuer Info: - CommonName: Test User - Organization: [Test Organization] - Country: [US] - -To dump a cert chain from a TLS server: + - openssl s_client -connect squareup.com:443 -showcerts < /dev/null | certigo dump - -Unlike `openssl x509 -text`, certigo will dump the entire chain, not just the first certificate. +You can dump a cert chain from a TLS server. Unlike `openssl x509 -text`, certigo will dump the entire chain, not just the first certificate: + + diff --git a/output_1.svg b/output_1.svg new file mode 100644 index 0000000..6d5ea1a --- /dev/null +++ b/output_1.svg @@ -0,0 +1,51 @@ + + + + + $ cat certs/cert.pem | ./certigo dump + ** CERTIFICATE 1 ** + Serial: 11578389349061131131 + Not Before: 2016-05-27 21:15:31 +0000 UTC + Not After : 2017-10-09 21:15:31 +0000 UTC + Signature : SHA1-RSA + Subject Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Issuer Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Warnings: +         Certificate is not in X509v3 format (version is 2) +         Using SHA1-RSA, which is an outdated signature algorithm +   + ** CERTIFICATE 2 ** + Serial: 11578389349061131131 + Not Before: 2016-05-27 21:15:31 +0000 UTC + Not After : 2017-10-09 21:15:31 +0000 UTC + Signature : SHA1-RSA + Subject Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Issuer Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Warnings: +         Certificate is not in X509v3 format (version is 2) +         Using SHA1-RSA, which is an outdated signature algorithm + + diff --git a/output_2.svg b/output_2.svg new file mode 100644 index 0000000..883842a --- /dev/null +++ b/output_2.svg @@ -0,0 +1,54 @@ + + + + + $ ./certigo dump certs/cert.jks + Enter password: + ** CERTIFICATE 1 ** + Alias: second-key + Serial: 11578389349061131131 + Not Before: 2016-05-27 21:15:31 +0000 UTC + Not After : 2017-10-09 21:15:31 +0000 UTC + Signature : SHA1-RSA + Subject Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Issuer Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Warnings: +         Certificate is not in X509v3 format (version is 2) +         Using SHA1-RSA, which is an outdated signature algorithm +   + ** CERTIFICATE 2 ** + Alias: mykey + Serial: 11578389349061131131 + Not Before: 2016-05-27 21:15:31 +0000 UTC + Not After : 2017-10-09 21:15:31 +0000 UTC + Signature : SHA1-RSA + Subject Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Issuer Info: +         CommonName: ApertureScience +         Organization: [Aperture Science] +         OrganizationalUnit: [Research and Development] +         Country: [US] +         Locality: [San Francisco] + Warnings: +         Certificate is not in X509v3 format (version is 2) +         Using SHA1-RSA, which is an outdated signature algorithm + + diff --git a/output_3.svg b/output_3.svg new file mode 100644 index 0000000..a64a192 --- /dev/null +++ b/output_3.svg @@ -0,0 +1,96 @@ + + + + + $ openssl s_client -connect squareup.com:443 -showcerts < /dev/null | ./certigo dump + depth=2 /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 + verify error:num=20:unable to get local issuer certificate + verify return:0 + DONE + ** CERTIFICATE 1 ** + Serial: 1413474646 + Not Before: 2014-12-22 20:28:37 +0000 UTC + Not After : 2016-08-01 00:41:40 +0000 UTC + Signature : SHA256-RSA + Subject Info: +         CommonName: www.squareup.com +         Organization: [Square, Inc.] +         Country: [US] +         Locality: [San Francisco] + Issuer Info: +         CommonName: Entrust Certification Authority - L1M +         Organization: [Entrust, Inc.] +         OrganizationalUnit: [See www.entrust.net/legal-terms (c) 2014 Entrust, Inc. - for authorized use only] +         Country: [US] + Subject Key ID : 6B:06:E5:5C:8A:AA:92:42:28:1F:0F:FF:15:61:A6:28:2B:0A:DE:85 + Authority Key ID : C3:F7:D0:B5:2A:30:AD:AF:0D:91:21:70:39:54:DD:BC:89:70:C7:3A + Basic Constraints: CA:false + Key Usage: +         Key Encipherment +         Digital Signature + Extended Key Usage: +         Server Auth +         Client Auth + Alternate DNS Names: +         www.squareup.com +         squareup.com +         account.squareup.com +         mkt.com +         www.mkt.com +         market.squareup.com +         gosq.com +         www.gosq.com +         gosq.co +         www.gosq.co +   + ** CERTIFICATE 2 ** + Serial: 30215777750102225331854468774 + Not Before: 2014-12-15 15:25:03 +0000 UTC + Not After : 2030-10-15 15:55:03 +0000 UTC + Signature : SHA256-RSA + Subject Info: +         CommonName: Entrust Certification Authority - L1M +         Organization: [Entrust, Inc.] +         OrganizationalUnit: [See www.entrust.net/legal-terms (c) 2014 Entrust, Inc. - for authorized use only] +         Country: [US] + Issuer Info: +         CommonName: Entrust Root Certification Authority - G2 +         Organization: [Entrust, Inc.] +         OrganizationalUnit: [See www.entrust.net/legal-terms (c) 2009 Entrust, Inc. - for authorized use only] +         Country: [US] + Subject Key ID : C3:F7:D0:B5:2A:30:AD:AF:0D:91:21:70:39:54:DD:BC:89:70:C7:3A + Authority Key ID : 6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB + Basic Constraints: CA:true, pathlen:0 + Key Usage: +         CRL Sign +         Cert Sign + Extended Key Usage: +         Client Auth +         Server Auth +   + ** CERTIFICATE 3 ** + Serial: 1372799044 + Not Before: 2014-09-22 17:14:57 +0000 UTC + Not After : 2024-09-23 01:31:53 +0000 UTC + Signature : SHA256-RSA + Subject Info: +         CommonName: Entrust Root Certification Authority - G2 +         Organization: [Entrust, Inc.] +         OrganizationalUnit: [See www.entrust.net/legal-terms (c) 2009 Entrust, Inc. - for authorized use only] +         Country: [US] + Issuer Info: +         CommonName: Entrust Root Certification Authority +         Organization: [Entrust, Inc.] +         OrganizationalUnit: [www.entrust.net/CPS is incorporated by reference (c) 2006 Entrust, Inc.] +         Country: [US] + Subject Key ID : 6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB + Authority Key ID : 68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D + Basic Constraints: CA:true, pathlen:1 + Key Usage: +         Cert Sign +         CRL Sign + +