Support for custom CA bundle files via new command line option --ca#440
Closed
okoeroo wants to merge 3 commits intotestssl:masterfrom
Closed
Support for custom CA bundle files via new command line option --ca#440okoeroo wants to merge 3 commits intotestssl:masterfrom
okoeroo wants to merge 3 commits intotestssl:masterfrom
Conversation
… For robustness reasons, all CA bundle files can now also contain spaces in their path.
Collaborator
|
Cool, thank you @okoeroo. Two obstacles: 1st: It's feature freeze. 2nd: the solution I had in mind was one like described in #230 i.e. throwing all private CAs into the etc dir with a different extension (here: 'pem' in caps) and automagically test them. It has two advantages: 1) not yet another cmdline option (minor) 2) mass testing is easier. For 2) it's important how to display the result. Looking at what you did: It appears the right thing to me. So the code is quite useful. Thus my question: Would you mind to change your PR to the solution described? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added support for custom CA bundle files provided via the command line to be part of the test. Dropping the files in the $installdir/etc/ is not always convenient when you need to switch between (internal) CAs for detailed testing.
For robustness reasons, all CA bundle files can now also contain spaces in their path. This is part of the pull request as user-input could cause inconvenient errors and break the script when using files with a space.
Example: The internal CA is provided via the $installdir/etc/ directory and via the --ca flag together with the actual root CA file also provided via the command line option.
Command line:
./testssl.sh -S --ca etc/KPN\ internal.pem --ca 111e6273.0 www.kpn.com
Output:
Testing server defaults (Server Hello)
[...snip...]
Chain of trust NOT ok: KPN internal (chain incomplete) KPN_internal (chain incomplete) KPN_misconfiguration_test (chain incomplete) KPN internal (chain incomplete)
OK: 111e6273.0 Mozilla Microsoft Linux Apple
[...snip...]
Example: When file does not exist
Command line:
bash-3.2$ ./testssl.sh -S --ca foo --ca 111e6273.0 www.kpn.com
Output:
bash-3.2$ ./testssl.sh -S --ca foo www.kpn.com
Provided CA bundle file does not exist or is not readable