| 1 | n/a | #!/usr/bin/env python3 |
|---|
| 2 | n/a | # |
|---|
| 3 | n/a | # fetch the certificate that the server(s) are providing in PEM form |
|---|
| 4 | n/a | # |
|---|
| 5 | n/a | # args are HOST:PORT [, HOST:PORT...] |
|---|
| 6 | n/a | # |
|---|
| 7 | n/a | # By Bill Janssen. |
|---|
| 8 | n/a | |
|---|
| 9 | n/a | import re |
|---|
| 10 | n/a | import os |
|---|
| 11 | n/a | import sys |
|---|
| 12 | n/a | import tempfile |
|---|
| 13 | n/a | |
|---|
| 14 | n/a | |
|---|
| 15 | n/a | def fetch_server_certificate (host, port): |
|---|
| 16 | n/a | |
|---|
| 17 | n/a | def subproc(cmd): |
|---|
| 18 | n/a | from subprocess import Popen, PIPE, STDOUT |
|---|
| 19 | n/a | proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True) |
|---|
| 20 | n/a | status = proc.wait() |
|---|
| 21 | n/a | output = proc.stdout.read() |
|---|
| 22 | n/a | return status, output |
|---|
| 23 | n/a | |
|---|
| 24 | n/a | def strip_to_x509_cert(certfile_contents, outfile=None): |
|---|
| 25 | n/a | m = re.search(br"^([-]+BEGIN CERTIFICATE[-]+[\r]*\n" |
|---|
| 26 | n/a | br".*[\r]*^[-]+END CERTIFICATE[-]+)$", |
|---|
| 27 | n/a | certfile_contents, re.MULTILINE | re.DOTALL) |
|---|
| 28 | n/a | if not m: |
|---|
| 29 | n/a | return None |
|---|
| 30 | n/a | else: |
|---|
| 31 | n/a | tn = tempfile.mktemp() |
|---|
| 32 | n/a | fp = open(tn, "wb") |
|---|
| 33 | n/a | fp.write(m.group(1) + b"\n") |
|---|
| 34 | n/a | fp.close() |
|---|
| 35 | n/a | try: |
|---|
| 36 | n/a | tn2 = (outfile or tempfile.mktemp()) |
|---|
| 37 | n/a | status, output = subproc(r'openssl x509 -in "%s" -out "%s"' % |
|---|
| 38 | n/a | (tn, tn2)) |
|---|
| 39 | n/a | if status != 0: |
|---|
| 40 | n/a | raise RuntimeError('OpenSSL x509 failed with status %s and ' |
|---|
| 41 | n/a | 'output: %r' % (status, output)) |
|---|
| 42 | n/a | fp = open(tn2, 'rb') |
|---|
| 43 | n/a | data = fp.read() |
|---|
| 44 | n/a | fp.close() |
|---|
| 45 | n/a | os.unlink(tn2) |
|---|
| 46 | n/a | return data |
|---|
| 47 | n/a | finally: |
|---|
| 48 | n/a | os.unlink(tn) |
|---|
| 49 | n/a | |
|---|
| 50 | n/a | if sys.platform.startswith("win"): |
|---|
| 51 | n/a | tfile = tempfile.mktemp() |
|---|
| 52 | n/a | fp = open(tfile, "w") |
|---|
| 53 | n/a | fp.write("quit\n") |
|---|
| 54 | n/a | fp.close() |
|---|
| 55 | n/a | try: |
|---|
| 56 | n/a | status, output = subproc( |
|---|
| 57 | n/a | 'openssl s_client -connect "%s:%s" -showcerts < "%s"' % |
|---|
| 58 | n/a | (host, port, tfile)) |
|---|
| 59 | n/a | finally: |
|---|
| 60 | n/a | os.unlink(tfile) |
|---|
| 61 | n/a | else: |
|---|
| 62 | n/a | status, output = subproc( |
|---|
| 63 | n/a | 'openssl s_client -connect "%s:%s" -showcerts < /dev/null' % |
|---|
| 64 | n/a | (host, port)) |
|---|
| 65 | n/a | if status != 0: |
|---|
| 66 | n/a | raise RuntimeError('OpenSSL connect failed with status %s and ' |
|---|
| 67 | n/a | 'output: %r' % (status, output)) |
|---|
| 68 | n/a | certtext = strip_to_x509_cert(output) |
|---|
| 69 | n/a | if not certtext: |
|---|
| 70 | n/a | raise ValueError("Invalid response received from server at %s:%s" % |
|---|
| 71 | n/a | (host, port)) |
|---|
| 72 | n/a | return certtext |
|---|
| 73 | n/a | |
|---|
| 74 | n/a | |
|---|
| 75 | n/a | if __name__ == "__main__": |
|---|
| 76 | n/a | if len(sys.argv) < 2: |
|---|
| 77 | n/a | sys.stderr.write( |
|---|
| 78 | n/a | "Usage: %s HOSTNAME:PORTNUMBER [, HOSTNAME:PORTNUMBER...]\n" % |
|---|
| 79 | n/a | sys.argv[0]) |
|---|
| 80 | n/a | sys.exit(1) |
|---|
| 81 | n/a | for arg in sys.argv[1:]: |
|---|
| 82 | n/a | host, port = arg.split(":") |
|---|
| 83 | n/a | sys.stdout.buffer.write(fetch_server_certificate(host, int(port))) |
|---|
| 84 | n/a | sys.exit(0) |
|---|
