--check-chain failure results in CRITICAL

[dnmvisser]

Describe the bug

When using --check-chain, and there is indeed a root cert present, this will raise a CRITICAL.

To Reproduce

check_ssl_cert --check-chain -H host.with.root.cert.org

Expected behavior

Having an additional root cert will almost never cause real problems for browsers. So it would seem more appropriate to have this emit a WARNING.

[cmasopust]

I second the idea but I would suggest to not treat this as a bug, instead one could think about adding a switch that does not even report an error or warning when the root ca cert is in the chain.

e.g. when using an apache httpd and having the certs signed by in internal CA and relying on apache httpd to create the chain, you always will find the root ca cert added.

so an option would be to have a switch something like "--allow-root-in-chain" or something like "--status-when-root-in-chain "

[matteocorti]

What happens with --ignore-incomplete-chain?

[cmasopust]

What happens with --ignore-incomplete-chain?

Same result:

$ ./check_ssl_cert --host atowh-distr3-install.xxxx.lan --port 443 --protocol https --warning 30 --critical 15 --ignore-sct --ignore-tls-renegotiation --ignore-host-cn --maximum-validity 5000 --no-proxy-s_client --no-proxy-curl --check-chain --ignore-incomplete-chain
SSL_CERT CRITICAL atowh-distr3-install.xxxx.lan:443: The root certificate is unnecessarily present in the delivered certificate chain|days_chain_elem1=312;30;15;; days_chain_elem2=3277;30;15;; days_chain_elem3=3641;30;15;;