4 ms·
It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the
by theossuary 9y ago
It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the site a failing grade if the Wosign cert is found/invalid) [2].
Note, I haven't been able to test that script on an actually broken site with a Wosign certificate
[1]: https://pastebin.com/ZVMM3PJZ https://pastebin.com/ZVMM3PJZ
[2]: https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hi...
- ivanr 9y agoFor what it's worth, SSL Labs also has a command-line tool that enables you to scan in bulk https://github.com/ssllabs/ssllabs-scan https://github.com/ssllabs/ssllabs-scan However, although they don't trust WoSign and StartCom any more, it's possible that there is a cross-signed certificate to another CA, in which case the problem is not going to be detected. I seem to recollect that such cross-signed certs exist, but I haven't looked for them recently. Will do.