4 ms·

Is there a tool that we can use to tell if we have these certs?

ivanr 9y ago
Are you asking because you have a large number of hosts and can't check them all manually? (Edit: Because the obvious answer is to use your browser or a tool such as SSL Labs or Hardenize to see who issued the certificate.) Out of curiosity, how many hosts are you looking after?
Rjevski 9y ago
A script running openssl s_client would do the trick.
theossuary 9y ago
It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the site a failing grade if the Wosign cert is found/invalid) [2]. Note, I haven't been able to test that script on an actually broken site with a Wosign certificate [1]: https://pastebin.com/ZVMM3PJZ https://pastebin.com/ZVMM3PJZ [2]: https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hi...
- ivanr 9y ago
  For what it's worth, SSL Labs also has a command-line tool that enables you to scan in bulk https://github.com/ssllabs/ssllabs-scan https://github.com/ssllabs/ssllabs-scan However, although they don't trust WoSign and StartCom any more, it's possible that there is a cross-signed certificate to another CA, in which case the problem is not going to be detected. I seem to recollect that such cross-signed certs exist, but I haven't looked for them recently. Will do.
dom0 9y ago
echo | openssl s_client -connect somewhere.net:443 -servername somewhere.net | grep -qE "(WoSign)|(StartCom)"
- schoen 9y ago
  For more accurate browser-like results, you might want to add "-servername somewhere" so that you get the response associated with the "somewhere" virtual host rather than the default response.
- ivanr 9y ago
  That's a bit simplistic. For example, you at the very least want to have a "-servername" there to account for SNI-only hosts. You'll then need to worry about prefixed and non-prefixed hosts (e.g., www.example.com and example.com). Then, what do you do if your web site relies on a third-party sites that uses WoSign? Yes, now you have to parse the HTML response, extract all links, and check those too. Then there's also a question of servers other than HTTP, so you need to throw in a port scanner in there. And a tool to actively follow protocols, to discover MX hosts, maybe even look at SRV records, and so on.
- aaronmdjones 9y ago
  No need to prefix the command with `echo | '. If you want OpenSSL to have no standard input (so it closes its connection), just redirect standard input from /dev/null. $ openssl ... </dev/null | grep ... EDIT: This also avoids OpenSSL sending its only input character (the newline that echo produces) to the server, which will throw it away anyway.
svenfaw 9y ago
Something to be aware of: on Windows, certain third-party executables are signed with a WoSign cert. One popular example being the npcap library (part of nmap). If you distrust WoSign roots, side effects may occur upon using nmap.
jwilk 9y ago
https://github.com/jwilk/skeptica https://github.com/jwilk/skeptica

Are you asking because you have a large number of hosts and can't check them all manually? (Edit: Because the obvious answer is to use your browser or a tool such as SSL Labs or Hardenize to see who issued the certificate.) Out of curiosity, how many hosts are you looking after?

Rjevski 9y ago

A script running openssl s_client would do the trick.

theossuary 9y ago

It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the site a failing grade if the Wosign cert is found/invalid) [2]. Note, I haven't been able to test that script on an actually broken site with a Wosign certificate [1]: https://pastebin.com/ZVMM3PJZ https://pastebin.com/ZVMM3PJZ [2]: https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hi...

ivanr 9y ago
For what it's worth, SSL Labs also has a command-line tool that enables you to scan in bulk https://github.com/ssllabs/ssllabs-scan https://github.com/ssllabs/ssllabs-scan However, although they don't trust WoSign and StartCom any more, it's possible that there is a cross-signed certificate to another CA, in which case the problem is not going to be detected. I seem to recollect that such cross-signed certs exist, but I haven't looked for them recently. Will do.

dom0 9y ago

echo | openssl s_client -connect somewhere.net:443 -servername somewhere.net | grep -qE "(WoSign)|(StartCom)"

schoen 9y ago
For more accurate browser-like results, you might want to add "-servername somewhere" so that you get the response associated with the "somewhere" virtual host rather than the default response.
ivanr 9y ago
That's a bit simplistic. For example, you at the very least want to have a "-servername" there to account for SNI-only hosts. You'll then need to worry about prefixed and non-prefixed hosts (e.g., www.example.com and example.com). Then, what do you do if your web site relies on a third-party sites that uses WoSign? Yes, now you have to parse the HTML response, extract all links, and check those too. Then there's also a question of servers other than HTTP, so you need to throw in a port scanner in there. And a tool to actively follow protocols, to discover MX hosts, maybe even look at SRV records, and so on.
aaronmdjones 9y ago
No need to prefix the command with `echo | '. If you want OpenSSL to have no standard input (so it closes its connection), just redirect standard input from /dev/null. $ openssl ... </dev/null | grep ... EDIT: This also avoids OpenSSL sending its only input character (the newline that echo produces) to the server, which will throw it away anyway.

svenfaw 9y ago

Something to be aware of: on Windows, certain third-party executables are signed with a WoSign cert. One popular example being the npcap library (part of nmap). If you distrust WoSign roots, side effects may occur upon using nmap.

jwilk 9y ago

https://github.com/jwilk/skeptica https://github.com/jwilk/skeptica