Skip to content
Snippets Groups Projects
Verified Commit bf260e57 authored by Heiko Reese's avatar Heiko Reese :dizzy_face:
Browse files

fix: better detection of issuing CA

parent 43dae03c
No related branches found
No related tags found
No related merge requests found
Pipeline #420956 failed
Hide whitespace changes
Inline Side-by-side
misc.go
+ 63
− 48
View file @ bf260e57
package websearch
import (
"bytes"
"crypto/x509"
"embed"
_ "embed"
"encoding/asn1"
)
var (
kitcag1 = "kit-ca-g1"
kitcag2 = "kit-ca-g2"
sectigo = "geant-tcs-sectigo"
unknown = "unknown"
// RawIssuerG1 C=DE, ST=Baden-Wuerttemberg, L=Karlsruhe, O=Karlsruhe Institute of Technology, OU=Steinbuch Centre for Computing, CN=KIT-CA/emailAddress=ca@kit.edu
RawIssuerG1 = []byte{
0x30, 0x81, 0xbf, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x44, 0x45,
0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x12, 0x42, 0x61, 0x64, 0x65, 0x6e,
0x2d, 0x57, 0x75, 0x65, 0x72, 0x74, 0x74, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x67, 0x31, 0x12, 0x30,
0x10, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x09, 0x4b, 0x61, 0x72, 0x6c, 0x73, 0x72, 0x75, 0x68,
0x65, 0x31, 0x2a, 0x30, 0x28, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x21, 0x4b, 0x61, 0x72, 0x6c,
0x73, 0x72, 0x75, 0x68, 0x65, 0x20, 0x49, 0x6e, 0x73, 0x74, 0x69, 0x74, 0x75, 0x74, 0x65, 0x20,
0x6f, 0x66, 0x20, 0x54, 0x65, 0x63, 0x68, 0x6e, 0x6f, 0x6c, 0x6f, 0x67, 0x79, 0x31, 0x27, 0x30,
0x25, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x1e, 0x53, 0x74, 0x65, 0x69, 0x6e, 0x62, 0x75, 0x63,
0x68, 0x20, 0x43, 0x65, 0x6e, 0x74, 0x72, 0x65, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x43, 0x6f, 0x6d,
0x70, 0x75, 0x74, 0x69, 0x6e, 0x67, 0x31, 0x0f, 0x30, 0x0d, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
0x06, 0x4b, 0x49, 0x54, 0x2d, 0x43, 0x41, 0x31, 0x19, 0x30, 0x17, 0x06, 0x09, 0x2a, 0x86, 0x48,
0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x0a, 0x63, 0x61, 0x40, 0x6b, 0x69, 0x74, 0x2e, 0x65,
0x64, 0x75,
}
// RawIssuerG2 C=DE, ST=Baden-Wuerttemberg, L=Karlsruhe, O=Karlsruhe Institute of Technology, CN=KIT-CA
RawIssuerG2 = []byte{
0x30, 0x7b, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x44, 0x45, 0x31,
0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x12, 0x42, 0x61, 0x64, 0x65, 0x6e, 0x2d,
0x57, 0x75, 0x65, 0x72, 0x74, 0x74, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x67, 0x31, 0x12, 0x30, 0x10,
0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x09, 0x4b, 0x61, 0x72, 0x6c, 0x73, 0x72, 0x75, 0x68, 0x65,
0x31, 0x2a, 0x30, 0x28, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x21, 0x4b, 0x61, 0x72, 0x6c, 0x73,
0x72, 0x75, 0x68, 0x65, 0x20, 0x49, 0x6e, 0x73, 0x74, 0x69, 0x74, 0x75, 0x74, 0x65, 0x20, 0x6f,
0x66, 0x20, 0x54, 0x65, 0x63, 0x68, 0x6e, 0x6f, 0x6c, 0x6f, 0x67, 0x79, 0x31, 0x0f, 0x30, 0x0d,
0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x06, 0x4b, 0x49, 0x54, 0x2d, 0x43, 0x41,
}
// RawIssuerSectigo CN=GEANT Personal CA 4, O=GEANT Vereniging, C=NL
RawIssuerSectigo = []byte{
0x30, 0x46, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x4e, 0x4c, 0x31,
0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x10, 0x47, 0x45, 0x41, 0x4e, 0x54, 0x20,
0x56, 0x65, 0x72, 0x65, 0x6e, 0x69, 0x67, 0x69, 0x6e, 0x67, 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03,
0x55, 0x04, 0x03, 0x13, 0x13, 0x47, 0x45, 0x41, 0x4e, 0x54, 0x20, 0x50, 0x65, 0x72, 0x73, 0x6f,
0x6e, 0x61, 0x6c, 0x20, 0x43, 0x41, 0x20, 0x34,
}
//go:embed certs/*.der
var CertsFS embed.FS
RawIssuers = map[string][]byte{
kitcag1: RawIssuerG1,
kitcag2: RawIssuerG2,
sectigo: RawIssuerSectigo,
}
var (
CAIdentifierKITCAG1 = "kit-ca-g1"
CAIdentifierKITCAG2 = "kit-ca-g2"
CAIdentifierSectigo = "geant-tcs-sectigo"
CAIdentifierHARICA = "geant-tcs-harica"
CAIdentifierUnknown = "unknown"
)
var (
......@@ -74,3 +37,55 @@ var (
}
oidEmail = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1}
)
var CertificateIssuer = make(map[string][][]byte)
func init() {
certs := map[string][]string{
CAIdentifierKITCAG1: {
"certs/KIT-CA-G1.der",
},
CAIdentifierKITCAG2: {
"certs/KIT-CA-G2.der",
},
CAIdentifierSectigo: {
"certs/GEANT-Personal-CA-4.der",
"certs/GEANT-Personal-ECC-CA-4.der",
"certs/GEANT-eScience-Personal-CA-4.der",
"certs/GEANT-eScience-Personal-ECC-CA-4.der",
},
CAIdentifierHARICA: {
"certs/HARICA-GEANT-SMIME-E1.der",
"certs/HARICA-GEANT-SMIME-R1.der",
"certs/HARICA-Client-Root-2021-ECC.der",
"certs/HARICA-Client-Root-2021-RSA.der",
},
}
// read the certificate subjects from all relevant CAs
for ca, files := range certs {
CertificateIssuer[ca] = make([][]byte, 0, len(files))
for _, filename := range files {
file, err := CertsFS.ReadFile(filename)
if err != nil {
panic(err)
}
c, err := x509.ParseCertificate(file)
if err != nil {
panic(err)
}
CertificateIssuer[ca] = append(CertificateIssuer[ca], c.RawSubject)
}
}
}
// GetCertificateIssuer returns the issuer subject identifier for the given certificate
func GetCertificateIssuer(cert *x509.Certificate) *string {
for ca, subjects := range CertificateIssuer {
for _, subject := range subjects {
if bytes.Contains(cert.RawIssuer, subject) {
return &ca
}
}
}
return &CAIdentifierUnknown
}
redirect.go
+ 3
− 3
View file @ bf260e57
......@@ -35,17 +35,17 @@ func GetIssuer(serial string, ccache *CertCache) (string, error) {
}
// alte CA (kurze nummern, serial kleiner als erstes g2)
if len(serial) == 8 || len(serial) == 14 || sernum.Cmp(&serialG2First) < 1 {
return kitcag1, nil
return CAIdentifierKITCAG1, nil
}
// neue CA (seriennummer größer als letztes g1)
if sernum.Cmp(&serialG1Final) == 1 {
return kitcag2, nil
return CAIdentifierKITCAG2, nil
}
// check certificate cache
fromcache := ccache.Get(serial)
if fromcache == nil {
// don't know? assume G2
return kitcag2, nil
return CAIdentifierKITCAG2, nil
//return "", errorUnknownCA
}
return *fromcache.CAGeneration, nil
......
searchablecert.go
+ 3
− 9
View file @ bf260e57
......@@ -460,15 +460,9 @@ func CertToSearchable(c *x509.Certificate) SearchableCert {
default:
cert.KeyLength = -1
}
if bytes.Compare(c.RawIssuer, RawIssuerG1) == 0 {
cert.CAGeneration = &kitcag1
} else if bytes.Compare(c.RawIssuer, RawIssuerG2) == 0 {
cert.CAGeneration = &kitcag2
} else if bytes.Compare(c.RawIssuer, RawIssuerSectigo) == 0 {
cert.CAGeneration = &sectigo
} else {
cert.CAGeneration = &unknown
}
// find issuing CA
cert.CAGeneration = GetCertificateIssuer(c)
// add serials
cert.FingerprintSHA1 = fmt.Sprintf("0x%x", sha1.Sum(c.Raw))
......
testing/Format/main.go deleted 100644 → 0
+ 0
− 16
View file @ 43dae03c
package main
import (
"flag"
"github.com/k0kubun/pp"
. "gitlab.kit.edu/kit/kit-ca/lib/certificatestats"
)
func main() {
flag.Parse()
all := ReadCertificates(flag.Args()...)
for _, c := range all {
pp.Print(CertToSearchable(c))
}
}
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Help | Imprint | Privacy policy | Accessibility | Contact