This commit updates zlint to the latest version. The new version's
`e_key_usage_and_extended_key_usage_inconsistent` linter contains a
bug, so this commit disables it. The new version also correctly
identifies an error with some of the test certificates, so the
commit adds the error to the expected output (rather than
regenerating the certificates with modern policies).
`github.com/go-ldap/ldap/v3` now supports the two features that we
previously added to a local fork: extracting the TLS connection
state, and defining a connection timeout. This commit deletes the
fork and uses the upstream dependency.
This commit also adjusts the `certigo connect` TLS configuration to
support every cipher suite supported by `crypto/tls`, including
insecure ones. This improves the ability to extract certificates
from servers with poor cipher suite support. This limitation was
uncovered while testing LDAP connectivity.
This commit upgrades the language version to Go 1.24.4 and upgrades
the Sprig templating dependency from v2 to v3 in order to resolve
an indirect dependency issue. The major upgrade of Sprig changes
the behavior of some functions, but not in a significant way.
Go 1.23 introduced a change that rejects X.509 certificates with
negative serial numbers, due to Go's focus on the Web PKI
(see golang/go#71606). We continue to support negative serials by
setting a go:debug option for the main certigo binary, but other
users of certigo packages will need to set their own GODEBUG
settings appropriately to support this feature. If Go eventually
drops support, then we will, too.
This commit adds an explicit `golangci-lint` configuration that
simply matches the default linters previously in use, and then
fixes all current linter findings.
Aside from tweaking error message strings, this commit introduces
one externally visible behavior change: PEM data generated from
PKCS#12 files now correctly identifies private key blocks as
`RSA PRIVATE KEY` or `EC PRIVATE KEY`, whereas previously it
generated invalid `PRIVATE KEY` blocks with non-PKCS#8 data.
This commit lays the groundwork for more aggressive linting in the
future, and identifies some additional issues via TODOs.
Fixes#272. The root of the problem is that we're asking the wrong OCSP servers. The current code does something like:
leaf, issuers := chain[0], chain[1:]
for _, issuer := range issuers {
// check for revocation of leaf via issuer.OCSPServer
}
The main problem is that OCSPServer is the URI of the OCSP server for that certificate, and by asking issuer.OCSPServer about leaf, we're requesting OCSP responses from the wrong server. We should be checking leaf.OCSPServer in this example instead of issuer.OCSPServer.
The second problem is that the loop makes no sense. One would not expect any OCSP server in a given chain to be authoritative for a given leaf.
If you do certigo connect google.com, you'll see
Certificate has OCSP extension, but was unable to check status:
ocsp: error from server: unauthorized
The "unauthorized" means the OCSP server we asked doesn't know anything about the cert we asked about.
Add support for verifying server certs against SPIFFE IDs
This adds support to "certigo connect" to verify that the
server presented a certificate for a specific hostname or
SPIFFE ID. This name can now be unrelated to the hostname
to connect to and the Server Name Indication (SNI) to send
to the server during the TLS handshake.
Prior to this commit, the name expected in the certificate
could only be a hostname, specified either via --name (SNI)
or the hostname to connect to. SPIFFE IDs -- URLs with
"spiffe" as the scheme -- are not useful as hostnames or
SNIs. As a result, this commit adds a new --expected-name
switch to certigo connect. This override provides full
control over what name to expect in the server certificate
presented during the TLS handshake. For example, this name
can now be different from the hostname connected to and the
name specified in Server Name Indication (SNI). Moreover,
if --expected-name is a URL with "spiffe" scheme, it is
only matched against Subject Alternative Names of type URI,
as per the SPIFFE spec.
Error when no valid certs are found when verifying instead of accessing oob.
Warn when CSRs are found instead of silently ignoring them.
Co-authored-by: Mat Byczkowski <mbyczkowski@gmail.com>
This splits the logic into a cli, which handles parsing command line args and
reading files, and a terminal abstraction for handling user input and ouput.
All uses of os.Exit are removed in favor of returning errors.
Overall this enables better testing and reuse of code. Previously we had to
rely on external unit testing for CLI tests, which are harder to write tests.
I found TP-LINK routers submit some kind of logging to
n-devs.tplinkcloud.com:50443 and the CA that signed the certificate
for that domain had DCs in its subject
With this change we now get:
Issuer:
DC=cn, DC=com, DC=tp-link, CN=TP-LINK CA P1
Todo: Right now it doesn't support any truststore password other than changeit.
That's what Java ships. A follow-up commit will add better password handling
Nik Unger