Skip to content

Commit 7e60b8e

Browse files
sureshgsureshg
committed
v1.0.1 with many bug fixes and proper TLS debugging.
1 parent d12c7ee commit 7e60b8e

File tree

8 files changed

+463
-172
lines changed

8 files changed

+463
-172
lines changed

‎README.md‎

Lines changed: 165 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# 🏺 Install Certs [ ![version](https://img.shields.io/badge/installcerts-1.0.0-green.svg) ](https://github.com/sureshg/InstallCerts/releases/download/1.0.0/installcerts)
1+
# 🏺 Install Certs [ ![version](https://img.shields.io/badge/installcerts-1.0.1-green.svg) ](https://github.com/sureshg/InstallCerts/releases/download/1.0.1/installcerts)
22

33
`InstallCerts` is a simple cli tool to create [PKCS12](https://en.wikipedia.org/wiki/PKCS_12) trustStore by retrieving server's TLS certificates.
44
You can achieve the same using [OpenSSL](https://en.wikipedia.org/wiki/OpenSSL) and java [Keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) commands, but `InstallCerts` makes it fully automated using a single command.
@@ -7,7 +7,7 @@ You can achieve the same using [OpenSSL](https://en.wikipedia.org/wiki/OpenSSL)
77

88
* Binary
99

10-
[Download (v1.0.0)](https://github.com/sureshg/InstallCerts/releases/download/1.0.0/installcerts)
10+
[Download (v1.0.1)](https://github.com/sureshg/InstallCerts/releases/download/1.0.1/installcerts)
1111

1212
> After download, make sure to set the execute permission (`chmod +x installcerts`). Windows users can run the executable jar.
1313
@@ -20,103 +20,187 @@ You can achieve the same using [OpenSSL](https://en.wikipedia.org/wiki/OpenSSL)
2020
```
2121
> The binary would be located at `build/libs/installcerts`
2222

23-
Inorder to build a new version, change it in the [gradle properties](https://github.com/sureshg/InstallCerts/blob/master/gradle.properties#L6) or pass it to `./gradlew -PappVersion=1.0.0`
23+
Inorder to build a new version, change `appVersion` in the [gradle properties](https://github.com/sureshg/InstallCerts/blob/master/gradle.properties) or pass it to `./gradlew -PappVersion=1.0.1`
2424

2525
### Usage
2626

2727
```ruby
2828
$ installcerts -h
29-
NAME
30-
installcerts - Creates PKCS12 TrustStore by retrieving server certificates
31-
32-
SYNOPSIS
33-
installcerts [(-a | --all)] [(-h | --help)]
34-
[(-p <storePasswd> | --passwd <storePasswd>)] [(-v | --verbose)]
35-
[(-V | --version)] [--] <host>[:port]
36-
37-
OPTIONS
38-
-a, --all
39-
Show all certs and exits.
40-
41-
-h, --help
42-
Display help information
43-
44-
-p <storePasswd>, --passwd <storePasswd>
45-
Trust store password. Default is 'changeit'
46-
47-
-v, --verbose
48-
Verbose mode
49-
50-
-V, --version
51-
Show version
52-
53-
--
54-
This option can be used to separate command-line options from the
55-
list of argument, (useful when arguments might be mistaken for
56-
command-line options
57-
58-
<host>[:port]
59-
Server URL. Default port is 443
29+
NAME
30+
installcerts - Creates PKCS12 TrustStore by retrieving server
31+
certificates
32+
33+
SYNOPSIS
34+
installcerts [(-a | --all)] [(-d | --debug)] [(-h | --help)]
35+
[(-p <storePasswd> | --passwd <storePasswd>)] [(-v | --verbose)]
36+
[(-V | --version)] [--] <host>[:port]
37+
38+
OPTIONS
39+
-a, --all
40+
Show all certs and exits.
41+
42+
-d, --debug
43+
Enable TLS debug tracing.
44+
45+
-h, --help
46+
Display help information
47+
48+
-p <storePasswd>, --passwd <storePasswd>
49+
Trust store password. Default is 'changeit'
50+
51+
-v, --verbose
52+
Verbose mode
53+
54+
-V, --version
55+
Show version
56+
57+
--
58+
This option can be used to separate command-line options from the
59+
list of argument, (useful when arguments might be mistaken for
60+
command-line options
61+
62+
<host>[:port]
63+
Server URL. Default port is 443
6064
```
6165

6266
### Examples
6367

64-
* To list all TLS certificates
68+
* To list all TLS certificates (`-a`)
6569

6670
```ruby
67-
$ installcerts walmart.com -a
68-
Loading default ca truststore...
69-
Opening connection to walmart.com:443...
70-
71-
Starting SSL handshake...
72-
73-
1) Subject - CN=www.walmart.com, O="Wal-Mart Stores, Inc.", L=Bentonville, ST=Arkansas, C=US
74-
Issuer : CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE
75-
SHA1 : DF 3C BB 19 68 95 F7 9A BE 99 44 D1 0D 3A CA A5 C7 21 1A 90
76-
MD5 : CE 58 55 38 BE A5 A8 E4 FA 45 4C 5D 88 7B 98 04
77-
SAN : [2, www.walmart.com, 2, walmart.com]
78-
Expiry : Fri Sep 07 23:10:43 PDT 2018
79-
80-
2) Subject - CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE
81-
Issuer : CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE
82-
SHA1 : 90 2E F2 DE EB 3C 5B 13 EA 4C 3D 51 93 62 93 09 E2 31 AE 55
83-
MD5 : D3 E8 70 6D 82 92 AC E4 DD EB F7 A8 BB BD 56 6B
84-
SAN :
85-
Expiry : Tue Feb 20 02:00:00 PST 2024
86-
87-
3) Subject - CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE
88-
Issuer : CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE
89-
SHA1 : B1 BC 96 8B D4 F4 9D 62 2A A8 9A 81 F2 15 01 52 A4 1D 82 9C
90-
MD5 : 3E 45 52 15 09 51 92 E1 B7 5D 37 9F B1 87 29 8A
91-
SAN :
92-
Expiry : Fri Jan 28 04:00:00 PST 2028
93-
71+
$ installcerts google.com -a
72+
73+
Loading default ca truststore...
74+
Opening connection to google.com:443...
75+
76+
Starting SSL handshake...
77+
78+
1) Subject - CN=*.google.com, O=Google Inc, L=Mountain View, ST=California, C=US
79+
Issuer : CN=Google Internet Authority G2, O=Google Inc, C=US
80+
SHA1 : 5A B6 93 22 33 B7 58 4F D2 BA 42 FE 94 53 65 79 19 E9 7B BC
81+
MD5 : 16 1F 54 D8 3A E9 33 78 DE 68 72 4C 80 5C 98 C4
82+
SAN : *.google.com
83+
*.android.com
84+
*.appengine.google.com
85+
*.cloud.google.com
86+
*.gcp.gvt2.com
87+
*.google-analytics.com
88+
*.googleadapis.com
89+
*.googleapis.cn
90+
*.url.google.com
91+
*.youtube-nocookie.com
92+
*.youtube.com
93+
*.youtubeeducation.com
94+
*.ytimg.com
95+
android.clients.google.com
96+
android.com
97+
developer.android.google.cn
98+
developers.android.google.cn
99+
g.co
100+
goo.gl
101+
google-analytics.com
102+
google.com
103+
googlecommerce.com
104+
source.android.google.cn
105+
urchin.com
106+
www.goo.gl
107+
youtu.be
108+
youtube.com
109+
youtubeeducation.com
110+
Expiry : Fri Jul 14 01:25:00 PDT 2017
111+
112+
2) Subject - CN=Google Internet Authority G2, O=Google Inc, C=US
113+
Issuer : CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
114+
SHA1 : D6 AD 07 C6 67 56 30 F5 7B 92 7F 66 BE 8C E1 F7 68 F8 79 48
115+
MD5 : C5 6F 1A 63 B8 17 B7 31 89 34 C0 6E C5 AB B5 B3
116+
SAN :
117+
Expiry : Sun Dec 31 15:59:59 PST 2017
118+
119+
3) Subject - CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
120+
Issuer : OU=Equifax Secure Certificate Authority, O=Equifax, C=US
121+
SHA1 : 73 59 75 5C 6D F9 A0 AB C3 06 0B CE 36 95 64 C8 EC 45 42 A3
122+
MD5 : 2E 7D B2 A3 1D 0E 3D A4 B2 5F 49 B9 54 2A 2E 1A
123+
SAN :
124+
Expiry : Mon Aug 20 21:00:00 PDT 2018
125+
126+
SSL-Session:
127+
Protocol : TLSv1.2
128+
CipherSuite : TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
129+
Session-ID : 68 3E AD 92 27 59 F6 C2 C5 BF 10 58 04 BF AC 6C 06 DF E9 74 05 A5 39 D2 0E 1F 97 4B 4F 03 81 64
130+
Timeout : 86400
131+
Create Time : Mon Apr 24 11:10:04 PDT 2017
132+
Access Time : Mon Apr 24 11:10:04 PDT 2017
133+
Values :
134+
94135
```
95136

96137
* To create PKCS12 file
97138

98139
```ruby
99-
$ installcerts https://self-signed.badssl.com/
100-
Loading default ca truststore...
101-
Opening connection to self-signed.badssl.com:443...
102-
103-
Starting SSL handshake...
104-
Server sent 1 certificate(s)...
105-
106-
1) Adding certificate to keystore using alias self-signed.badssl.com-1...
107-
Subject - CN=*.badssl.com, O=BadSSL, L=San Francisco, ST=California, C=US
108-
Issuer : CN=*.badssl.com, O=BadSSL, L=San Francisco, ST=California, C=US
109-
SHA1 : 64 14 50 D9 4A 65 FA EB 3B 63 10 28 D8 E8 6C 95 43 1D B8 11
110-
MD5 : 46 10 F4 1F 93 A3 EE 58 E0 CC 69 BE 1C 71 E0 C0
111-
SAN : [2, *.badssl.com, 2, badssl.com]
112-
Expiry : Wed Aug 08 14:17:05 PDT 2018
113-
114-
Starting SSL handshake...
115-
Certificate is trusted. Saving the trustore...
116-
117-
🍺 PKCS12 truststore saved to installcerts/self-signed_badssl_com.p12
140+
$ installcerts https://self-signed.badssl.com
141+
142+
Loading default ca truststore...
143+
Opening connection to self-signed.badssl.com:443...
144+
145+
Starting SSL handshake...
146+
Server sent 1 certificate(s)...
147+
148+
1) Adding certificate to keystore using alias self-signed.badssl.com-1...
149+
Subject - CN=*.badssl.com, O=BadSSL, L=San Francisco, ST=California, C=US
150+
Issuer : CN=*.badssl.com, O=BadSSL, L=San Francisco, ST=California, C=US
151+
SHA1 : 64 14 50 D9 4A 65 FA EB 3B 63 10 28 D8 E8 6C 95 43 1D B8 11
152+
MD5 : 46 10 F4 1F 93 A3 EE 58 E0 CC 69 BE 1C 71 E0 C0
153+
SAN : *.badssl.com
154+
badssl.com
155+
Expiry : Wed Aug 08 14:17:05 PDT 2018
156+
157+
Starting SSL handshake...
158+
Certificate is trusted. Saving the trustore...
159+
160+
🍺 PKCS12 truststore saved to /Users/sgopal1/code/kotlin/installcerts/self-signed_badssl_com.p12
118161
```
162+
163+
* Debug TLS Session (`-d`)
119164

165+
```ruby
166+
$ installcerts https://rsa2048.badssl.com/ -d
167+
168+
➤ Enabling TLS debug tracing...
169+
Loading default ca truststore...
170+
Opening connection to rsa2048.badssl.com:443...
171+
adding as trusted cert:
172+
Subject: CN=Equifax Secure Global eBusiness CA-1, O=Equifax Secure Inc., C=US
173+
Issuer: CN=Equifax Secure Global eBusiness CA-1, O=Equifax Secure Inc., C=US
174+
Algorithm: RSA; Serial number: 0xc3517
175+
Valid from Sun Jun 20 21:00:00 PDT 1999 until Sun Jun 21 21:00:00 PDT 2020
176+
...
177+
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA,...
178+
Extension server_name, server_name: [type=host_name (0), value=rsa2048.badssl.com]
179+
***
180+
[write] MD5 and SHA1 hashes: len = 194
181+
0000: 01 00 00 BE 03 03 58 FE 41 39 72 B5 AA 3D F4 04 ......X.A9r..=..
182+
0010: 9E 4B E2 C4 C3 D0 44 2E 6C A7 19 67 58 01 AC D0 .K....D.l..gX...
183+
0020: 40 C3 D8 6A B7 AD 00 00 3A C0 23 C0 27 00 3C C0 @..j....:.#.'.<.
184+
0030: 25 C0 29 00 67 00 40 C0 09 C0 13 00 2F C0 04 C0 %.).g.@...../...
185+
0040: 0E 00 33 00 32 C0 2B C0 2F 00 9C C0 2D C0 31 00 ..3.2.+./...-.1.
186+
...
187+
188+
Cached client session: [Session-1, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
189+
[read] MD5 and SHA1 hashes: len = 16
190+
0000: 14 00 00 0C 98 CD 71 4B 98 1E 07 A0 3B 82 B1 84 ......qK....;...
191+
main, called close()
192+
main, called closeInternal(true)
193+
main, SEND TLSv1.2 ALERT: warning, description = close_notify
194+
Padded plaintext before ENCRYPTION: len = 2
195+
0000: 01 00 ..
196+
main, WRITE: TLSv1.2 Alert, length = 26
197+
[Raw write]: length = 31
198+
0000: 15 03 03 00 1A 00 00 00 00 00 00 00 01 71 F1 91 .............q..
199+
0010: C5 97 8D 78 EC FA 7D B4 C5 91 69 6C BD 99 78 ...x......il..x
200+
main, called closeSocket(true)
201+
🍺 No errors, certificate is already trusted!
202+
```
203+
120204
* Some useful Keytool commands
121205

122206
```ruby

‎gradle.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ org.gradle.script.lang.kotlin.accessors.auto=true
33

44
# Project custom properties
55
appAuthor=Suresh
6-
appVersion=1.0.0
6+
appVersion=1.0.1

‎src/main/kotlin/io/sureshg/cmd/Install.kt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ class Install {
3535
@Option(name = arrayOf("-v", "--verbose"), description = "Verbose mode")
3636
var verbose = false
3737

38+
@Option(name = arrayOf("-d", "--debug"), description = "Enable TLS debug tracing.")
39+
var debug = false
40+
3841
@Option(name = arrayOf("-V", "--version"), description = "Show version")
3942
var showVersion = false
4043

0 commit comments

Comments
 (0)