github/certigo
4
0
Fork 0
mirror of https://github.com/square/certigo.git synced 2026-10-21 05:02:11 +00:00
Code Issues Releases Wiki Activity
513 Commits 16 Branches 35 Tags
jwood/update-go-mod
Commit Graph
513 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
John Wood 0169cf3f86 Move to 1.18 2022-06-29 22:28:12 -07:00
John Wood 37a41318ba Add support for printing SCTs (#277) 
* Address PR comments
 2022-06-29 17:35:59 -07:00
John Wood 3871aa0f39 Update Go version to 1.18 (#276) 
* Update Go version

* Remove unsupported SHA1 cert test
 2022-06-28 17:49:00 -07:00
John Wood 9a1ff6da3d Update to 1.16 (#275) v1.16.0 2022-06-28 14:59:36 -07:00
John Wood 4c8f1c5862 Fix OCSP checking (#274) 
Fixes #272. The root of the problem is that we're asking the wrong OCSP servers. The current code does something like:

leaf, issuers := chain[0], chain[1:]
for _, issuer := range issuers {
  // check for revocation of leaf via issuer.OCSPServer
}

The main problem is that OCSPServer is the URI of the OCSP server for that certificate, and by asking issuer.OCSPServer about leaf, we're requesting OCSP responses from the wrong server. We should be checking leaf.OCSPServer in this example instead of issuer.OCSPServer.

The second problem is that the loop makes no sense. One would not expect any OCSP server in a given chain to be authoritative for a given leaf.

If you do certigo connect google.com, you'll see

Certificate has OCSP extension, but was unable to check status:
	ocsp: error from server: unauthorized

The "unauthorized" means the OCSP server we asked doesn't know anything about the cert we asked about.
 2022-06-28 14:51:03 -07:00
Isaac Semaya f81bda15e6 Merge pull request #273 from square/dependabot/go_modules/github.com/stretchr/testify-1.7.5 
Bump github.com/stretchr/testify from 1.7.2 to 1.7.5
 2022-06-24 16:25:04 -07:00
dependabot[bot] 55b2ec8d5d Bump github.com/stretchr/testify from 1.7.2 to 1.7.5 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.2 to 1.7.5.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.2...v1.7.5)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-06-24 02:11:25 +00:00
Alberto Santos 8772a7a649 Update go command to install certigo (#270) 2022-06-17 12:11:04 -07:00
Isaac Semaya 8fad8a0a92 Merge pull request #269 from square/dependabot/go_modules/github.com/stretchr/testify-1.7.2 
Bump github.com/stretchr/testify from 1.7.1 to 1.7.2
 2022-06-13 22:38:37 +01:00
dependabot[bot] 37265fa5ec Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.1 to 1.7.2.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.1...v1.7.2)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-06-07 02:10:00 +00:00
John Wood b2185d09eb Upgrade yaml.v3 version (#266) 2022-06-06 09:47:52 -07:00
John Wood 7ef0417bde Allow any ciphersuite in TestConnect (#268) 2022-06-06 08:47:20 -07:00
John Wood 5332ac7ca2 Fix TestConnect on macOS (#265) 
@bdd did an excellent writeup of the issue in #264. To fix this, stop relying on stable error messages between platforms and Go versions by performing a successful certigo connect in the test rather than a failed one.

I generated new ECDSA certificates for localhost using https://github.com/square/certstrap.
 2022-06-01 10:20:03 -07:00
dependabot[bot]andJohn Wood 41b5b73f75 Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 (#262) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.0 to 1.7.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.0...v1.7.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Wood <jwood@squareup.com>
 2022-03-24 12:02:18 -07:00
Seth TheriaultandJohn Wood 3a9d341427 Bump version string to 1.15.1 (#263) 
Co-authored-by: John Wood <jwood@squareup.com>
v1.15.1 		2022-03-24 11:31:14 -07:00
John Wood f8a8c1f06a Remove use of the format list in the connect command (#260) v1.15.0 2022-02-24 12:40:07 -08:00
Isaac Semaya d167b5f48d Merge pull request #256 from square/isemaya/add-leaf-flag-first-cert 
Add flag to view the first cert only, including for json and pem
 2022-02-23 16:45:22 -08:00
Isaac Semaya 328db64fa0 Add --leaf flag to view the first cert only, including for json and pem 
added dump-pkcs12-chain-to-pem.t to contrast with dump-pkcs12-chain-to-pem-first-only and show that multiple pem blocks are dumped without the --first flag.t
 2022-02-23 16:44:05 -08:00
John Wood 9e92473320 Set certs explicitly (#259) 2022-02-23 13:02:49 -08:00
John Wood 2027dabecf Upgrade /x/crypto dependency (#257) 2022-02-23 12:20:11 -08:00
John Wood 8f0d49f5b3 Don't check OCSP if there are no OCSP servers in the chain (#255) 2022-02-09 10:07:55 -08:00
John Wood dc9943e20c Bump version string to 1.14.1 (#254) v1.14.1 2022-01-11 10:51:04 -08:00
klyubin 1081a17c66 Add missing flags in usage in README.md (#253) 
This is a follow-up to ba10cd1db7
where I forgot to update the usage in README. This commit adds
not only the new flag introduced in ba10cd1db7
but also the missing flags from older changes.
v1.14.0 		2022-01-11 10:32:01 -08:00
klyubin ba10cd1db7 Add support for verifying server certs against SPIFFE IDs (#252) 
Add support for verifying server certs against SPIFFE IDs

This adds support to "certigo connect" to verify that the
server presented a certificate for a specific hostname or
SPIFFE ID. This name can now be unrelated to the hostname
to connect to and the Server Name Indication (SNI) to send
to the server during the TLS handshake.

Prior to this commit, the name expected in the certificate
could only be a hostname, specified either via --name (SNI)
or the hostname to connect to. SPIFFE IDs -- URLs with
"spiffe" as the scheme -- are not useful as hostnames or
SNIs. As a result, this commit adds a new --expected-name
switch to certigo connect. This override provides full
control over what name to expect in the server certificate
presented during the TLS handshake. For example, this name
can now be different from the hostname connected to and the
name specified in Server Name Indication (SNI). Moreover,
if --expected-name is a URL with "spiffe" scheme, it is
only matched against Subject Alternative Names of type URI,
as per the SPIFFE spec.
v1.14.0-test.1 		2022-01-10 15:57:47 -08:00
Benjamin Kane 2b1f74f2cb Allow certigo -h (#251) 2021-12-04 12:06:09 -08:00
John Wood 4032ab142c Add the Ed25519 algo to the list of known algo names (#250) 2021-11-30 15:19:09 -08:00
Mat Byczkowski 44a8bce78f Merge pull request #249 from square/mbyczkowski-patch-1 
Bump version to 1.13.0
v1.13.0 v1.13.0-rc.1 		2021-11-29 12:09:31 -08:00
Mat Byczkowski 3eead6f4d1 Bump version to 1.13.0 2021-11-29 12:01:35 -08:00
Mat Byczkowski beea3f9bc3 Merge pull request #248 from square/add-release-action 
Add automatic draft releases on tagged builds
 2021-11-29 11:59:46 -08:00
Mat Byczkowski 2d7ca581c2 Add automatic draft releases on tagged builds 
We had these on for Travis CI builds, so this should bring that
functionatliy back to GH Actions builds.
v1.13.0-test.2 		2021-11-29 11:54:24 -08:00
Mat Byczkowski 23e3e9c790 Merge pull request #247 from square/dependabot/go_modules/github.com/mattn/go-colorable-0.1.12 
Bump github.com/mattn/go-colorable from 0.1.11 to 0.1.12
 2021-11-29 11:27:01 -08:00
dependabot[bot] 6de98ab57c Bump github.com/mattn/go-colorable from 0.1.11 to 0.1.12 
Bumps [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) from 0.1.11 to 0.1.12.
- [Release notes](https://github.com/mattn/go-colorable/releases)
- [Commits](https://github.com/mattn/go-colorable/compare/v0.1.11...v0.1.12)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-colorable
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-11-24 02:13:21 +00:00
Mat Byczkowski eb0d9f461b Merge pull request #245 from square/mbyczkowski/add-gha 
Configure GH Actions
 2021-10-11 16:17:39 -07:00
Mat Byczkowski 620ecc63da Merge pull request #246 from square/mbyczkowski-patch-1 
Add CODEOWNERS file
 2021-10-11 16:17:28 -07:00
Mat Byczkowski 2da7d3a554 Add CODEOWNERS file 2021-10-11 15:56:57 -07:00
Mat Byczkowski dd20d54fbb Set-up GH Actions for CI 2021-10-11 15:54:54 -07:00
Mat Byczkowski c0f8ce4c9c Remove Travis CI 2021-10-11 15:54:54 -07:00
Mat Byczkowski 58f1537bd2 Merge pull request #244 from square/dependabot/go_modules/github.com/mattn/go-colorable-0.1.11 
Bump github.com/mattn/go-colorable from 0.1.8 to 0.1.11
 2021-10-11 15:19:06 -07:00
dependabot[bot] 93f7a5986c Bump github.com/mattn/go-colorable from 0.1.8 to 0.1.11 
Bumps [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) from 0.1.8 to 0.1.11.
- [Release notes](https://github.com/mattn/go-colorable/releases)
- [Commits](https://github.com/mattn/go-colorable/compare/v0.1.8...v0.1.11)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-colorable
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-10-11 22:16:12 +00:00
Mat Byczkowski 67d1e70e65 Merge pull request #242 from square/dependabot/go_modules/github.com/fatih/color-1.13.0 
Bump github.com/fatih/color from 1.12.0 to 1.13.0
 2021-10-11 15:15:01 -07:00
dependabot[bot] 1e9d95be5b Bump github.com/fatih/color from 1.12.0 to 1.13.0 
Bumps [github.com/fatih/color](https://github.com/fatih/color) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/fatih/color/releases)
- [Commits](https://github.com/fatih/color/compare/v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/fatih/color
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-09-22 02:10:55 +00:00
Mat Byczkowski ff8636de0a Merge pull request #236 from square/mbyczkowski-patch-1 
Bump Go version
list v1.12.2-rc.1 		2021-07-28 10:27:15 -07:00
Mat Byczkowski c296587ca6 Bump Go version 2021-07-27 18:27:11 -07:00
Mat Byczkowski f28bcb2ecb Merge pull request #232 from square/dependabot/go_modules/github.com/fatih/color-1.12.0 
Bump github.com/fatih/color from 1.10.0 to 1.12.0
 2021-07-27 18:23:38 -07:00
dependabot[bot] 93d5548183 Bump github.com/fatih/color from 1.10.0 to 1.12.0 
Bumps [github.com/fatih/color](https://github.com/fatih/color) from 1.10.0 to 1.12.0.
- [Release notes](https://github.com/fatih/color/releases)
- [Commits](https://github.com/fatih/color/compare/v1.10.0...v1.12.0)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-07-28 01:19:26 +00:00
Mat Byczkowski 214780665e Merge pull request #235 from elyscape/fix-postgres-panic 
Avoid nil deref when using Postgres StartTLS
 2021-07-27 18:18:22 -07:00
Eli Young 1f83e9e088 Add missing module checksum 2021-07-15 13:10:08 -07:00
Eli Young 908eebe3d9 Avoid nil deref when using Postgres StartTLS 
Fixes #234
 2021-07-15 13:04:33 -07:00
Mat Byczkowski aea8d76741 Merge pull request #230 from square/dependabot/add-v2-config-file 
Upgrade to GitHub-native Dependabot
 2021-05-10 14:08:51 -07:00
dependabot-preview[bot] c568ffefff Upgrade to GitHub-native Dependabot 2021-04-29 15:17:50 +00:00