Skip to content

Support for custom CA bundle files via new command line option --ca#440

Closed
okoeroo wants to merge 3 commits intotestssl:masterfrom
okoeroo:master
Closed

Support for custom CA bundle files via new command line option --ca#440
okoeroo wants to merge 3 commits intotestssl:masterfrom
okoeroo:master

Conversation

@okoeroo
Copy link
Copy Markdown

@okoeroo okoeroo commented Aug 7, 2016

Added support for custom CA bundle files provided via the command line to be part of the test. Dropping the files in the $installdir/etc/ is not always convenient when you need to switch between (internal) CAs for detailed testing.

For robustness reasons, all CA bundle files can now also contain spaces in their path. This is part of the pull request as user-input could cause inconvenient errors and break the script when using files with a space.

Example: The internal CA is provided via the $installdir/etc/ directory and via the --ca flag together with the actual root CA file also provided via the command line option.

Command line:
./testssl.sh -S --ca etc/KPN\ internal.pem --ca 111e6273.0 www.kpn.com

Output:
Testing server defaults (Server Hello)
[...snip...]
Chain of trust NOT ok: KPN internal (chain incomplete) KPN_internal (chain incomplete) KPN_misconfiguration_test (chain incomplete) KPN internal (chain incomplete)
OK: 111e6273.0 Mozilla Microsoft Linux Apple
[...snip...]

Example: When file does not exist

Command line:
bash-3.2$ ./testssl.sh -S --ca foo --ca 111e6273.0 www.kpn.com

Output:
bash-3.2$ ./testssl.sh -S --ca foo www.kpn.com

Provided CA bundle file does not exist or is not readable

… For robustness reasons, all CA bundle files can now also contain spaces in their path.
@drwetter
Copy link
Copy Markdown
Collaborator

Cool, thank you @okoeroo.

Two obstacles: 1st: It's feature freeze. 2nd: the solution I had in mind was one like described in #230 i.e. throwing all private CAs into the etc dir with a different extension (here: 'pem' in caps) and automagically test them. It has two advantages: 1) not yet another cmdline option (minor) 2) mass testing is easier.

For 2) it's important how to display the result. Looking at what you did: It appears the right thing to me. So the code is quite useful.

Thus my question: Would you mind to change your PR to the solution described?

@drwetter drwetter added this to the 2.9dev milestone Sep 2, 2016
@drwetter drwetter closed this Apr 3, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants