-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathssl_check_chain.1
278 lines (278 loc) · 11.3 KB
/
ssl_check_chain.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
.\" Automatically generated by Pod::Man 4.09 (Pod::Simple 3.35)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings. \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
. ds -- \(*W-
. ds PI pi
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
. ds L" ""
. ds R" ""
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds -- \|\(em\|
. ds PI \(*p
. ds L" ``
. ds R" ''
. ds C`
. ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.if !\nF .nr F 0
.if \nF>0 \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. if !\nF==2 \{\
. nr % 0
. nr F 2
. \}
.\}
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear. Run. Save yourself. No user-serviceable parts.
. \" fudge factors for nroff and troff
.if n \{\
. ds #H 0
. ds #V .8m
. ds #F .3m
. ds #[ \f1
. ds #] \fP
.\}
.if t \{\
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
. ds #V .6m
. ds #F 0
. ds #[ \&
. ds #] \&
.\}
. \" simple accents for nroff and troff
.if n \{\
. ds ' \&
. ds ` \&
. ds ^ \&
. ds , \&
. ds ~ ~
. ds /
.\}
.if t \{\
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
. \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
. \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
. \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
. ds : e
. ds 8 ss
. ds o a
. ds d- d\h'-1'\(ga
. ds D- D\h'-1'\(hy
. ds th \o'bp'
. ds Th \o'LP'
. ds ae ae
. ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "SSL_CHECK_CHAIN 1"
.TH SSL_CHECK_CHAIN 1 "08-Mar-2025" "" "Certificate Tools"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "SSL_CHECK_CHAIN"
.IX Header "SSL_CHECK_CHAIN"
ssl_check_chain \- check the certificate chain for hosts
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
ssl_check_chain [options] [host[:port] ...] [file:FILE] [@file...]
.PP
.Vb 11
\& Options:
\& \-\-CAfile=file Specify bundle file of trusted CA certificates for verification
\& \-\-CApath=dir Specify a hashed directory containing trusted CA certificates for verification.
\& \-\-ipversion=n Restrict connection to IP version 4 or 6
\& \-\-starttls=proto Specify that STARTTLS should be used in the connection.
\& \-\-timeout=secs Specify timeout for TLS connections
\& \-\-tlsversion=ver Specify the version TLS to connect with
\& \-\-type=type Specify the certificate type desired from the server
\& \-\-[no\-]warnings Display or suppress warnings
\& \-\-help brief help message
\& \-\-man full documentation
.Ve
.SH "OPTIONS"
.IX Header "OPTIONS"
The short options take the same argument as the corresponding long options, and are provided
for compatibility with \fIssl_info\fR
.IP "\fB\-\-CAfile\fR=\fIfile\fR \fB\-C\fR" 8
.IX Item "--CAfile=file -C"
Specify a file containing one or more trusted \s-1CA\s0 certificates to verify the host's certificate chain.
.Sp
If not specified, the environment variables \s-1SSL_CERT_FILE\s0 and \s-1CURL_CA_BUNDLE\s0 will be tried, and if neither of them is set, OpenSSL's default will be used.
.IP "\fB\-\-CApath\fR=\fIfile\fR \fB\-\-CAdir\fR=\fIfile\fR" 8
.IX Item "--CApath=file --CAdir=file"
Specify a directory containing hashed links to one or more trusted \s-1CA\s0 certificates to verify the host's certificate chain.
.Sp
If not specified, the environment variable \s-1SSL_CERT_DIR\s0 will be tried. If it is not set, OpenSSL's default will be used.
.IP "\fB\-\-ipversion\fR\-\fI4|6\fR \fB\-i\fR" 8
.IX Item "--ipversion-4|6 -i"
Allows connection to only use the specified \s-1IP\s0 version.
.IP "\fB\-\-starttls\fR=\fIprotocol\fR \fB\-s\fR" 8
.IX Item "--starttls=protocol -s"
Specifies that \s-1STARTTLS\s0 is required to make the \s-1TLS\s0 connection.
.Sp
\&\fIprotocol\fR is one of the following: \*(L"smtp\*(R", \*(L"pop3\*(R", \*(L"imap\*(R", \*(L"ftp\*(R", \*(L"xmpp\*(R",
\*(L"xmpp-server\*(R", \*(L"irc\*(R", \*(L"postgres\*(R", \*(L"mysql\*(R", \*(L"lmtp\*(R", \*(L"nntp\*(R", \*(L"sieve\*(R", or \*(L"ldap\*(R"
.IP "\fB\-\-timeout\fR=\fIsecs\fR \fI\f(CI@file\fI\fR" 8
.IX Item "--timeout=secs @file"
Speciries the maximum amount of time that \fIssl_check_chain\fR will wait for a \s-1TLS\s0 connection.
.Sp
The default is 120 seconds.
.IP "\fB\-\-tlsversion\fR=\fIversion\fR" 8
.IX Item "--tlsversion=version"
Specify the \s-1TLS\s0 protocol version to use: 1.1, 1.2, or 1.3.
.IP "\fB\-\-type\fR=\fItype\fR \fB\-c\fR" 8
.IX Item "--type=type -c"
Specify that an \fIec\fR (\fIecdsa\fR) or \fIrsa\fR certificate is desired.
.IP "\fB\-\-[no\-]warnings\fR" 8
.IX Item "--[no-]warnings"
Controls whether warning messages are displayed. The default is \fB\-\-warnings\fR.
.Sp
Warnings include duplicated files and hosts, which are skipped, and other recoverable conditions.
.IP "\fB\-\-help\fR" 8
.IX Item "--help"
Print a brief help message and exits.
.IP "\fB\-\-man\fR" 8
.IX Item "--man"
Prints the manual page and exits.
.PP
When options require keyword values, the keyword may be abbreviated providing that the abbreviation is unique.
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
\&\fBssl_check_chain\fR will connect to each host specified and obtain its certificate and any intermediate certificate chain.
.PP
Port can be numeric, or a service name (e.g. from /etc/services).
.PP
If a port is not specified: if \-\-starttls is specified, the default port for the \s-1STARTTLS\s0 protocol is used, otherwise 443 (https) is assumed.
.PP
If the port is specified as \fI\s-1FILE\s0\fR, \fBssl_check_chain\fR will open the specified file and process it as if the certificates were received from a server.
The certificate chain must be in \s-1PEM\s0 format. If a filename begins with '.', '/', or '~', or if it contains a '/', the \fI:FILE\fR is inferred, since
no \s-1DNS\s0 hostname or \s-1IP\s0 address can have those forms.
.PP
If an argument is of the form \fI\f(CI@file\fI\fR, the file is processed as a list of arguments, one per line, in any of the forms described previously.
\&\fI\f(CI@file\fI\fRs can be nested, but attempting to process the same file more than once is an error. In an \fI\f(CI@file\fI\fR, blank lines and lines beginning with \fI#\fR are ignored.
.PP
\&\fI\s-1FILE\s0\fR and \fI\f(CI@file\fI\fR names support tilde expansion, but not wildcards.
.PP
The validity dates of each certificate returned will be verified, as will its chain.
.PP
To request the desired certificate from dual-certificate servers, you can specify \fB\-\-type\fR=\fIec\fR or \fB\-\-type\fR=\fIrsa\fR.
This is done by providing a list of acceptable signature algorithms; the connecion will fail if the server doesn't have a matching certificate.
.PP
You can also specify \fB\-\-tlsversion\fR=\fI1.1\fR, \fB\-\-tlsversion\fR=\fI1.2\fR, or \fB\-\-tlsversion\fR=\fI1.3\fR to select the protocol version.
.PP
Each certificate is analyzed in the order received from the server or contained in the file, which should be from leaf (the server) toward the root (trusted \s-1CA\s0).
The trust root is not sent by the server, but is located by OpenSSL via \-CAfile or \-CApath.
.PP
Any date or verification errors will be reported.
.PP
Note that if a trusted (root) certificate has expired, only the root name is available.
.PP
This automates the manual process of determining where and why a certificate chain is broken.
.SH "BUGS"
.IX Header "BUGS"
Report any bugs, feature requests and/or patches on the issue tracker,
located at \fIhttps://github.com/tlhackque/certtools/issues\fR. In the
event that the project moves, contact the author directly.
.SH "AUTHOR"
.IX Header "AUTHOR"
Timothe Litt <[email protected]>
.SH "COPYRIGHT and LICENSE"
.IX Header "COPYRIGHT and LICENSE"
Copyright (c) 2021\-2025 Timothe Litt
.PP
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the \*(L"Software\*(R"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
.PP
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
.PP
\&\s-1THE SOFTWARE IS PROVIDED \*(L"AS IS\*(R", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.\s0
.PP
Except as contained in this notice, the name of the author shall not be
used in advertising or otherwise to promote the sale, use or other dealings
in this Software without prior written authorization from the author.
.PP
Any modifications to this software must be clearly documented by and
attributed to their author, who is responsible for their effects.
.PP
Bug reports, suggestions and patches are welcomed by the original author.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fI\fIopenssl\fI\|(1)\fR \fIssl_info\fR
.PP
\&\fI\s-1POD\s0 version \f(CI$Id$\fR