foreman-certificate-check

#!/usr/bin/env bash

# Define colors uses for status output
RED=$(tput setaf 1 2> /dev/null)
GREEN=$(tput setaf 2 2> /dev/null)
RESET=$(tput sgr0 2> /dev/null)

CABUNDLE_MAX_ISSUERS=32

function usage () {
  cat <<HELP >&2
Verifies, that custom SSL certificate files are usable as part of the installation.
When passing filenames use absolute paths.

usage: $0 -c CERT_FILE -k KEY_FILE -b CA_BUNDLE_FILE
HELP
}

while getopts "c:k:b:" opt; do
    case $opt in
        c)
            CERT_FILE="$(readlink -f $OPTARG)"
            ;;
        k)
            KEY_FILE="$(readlink -f $OPTARG)"
            ;;
        b)
            CA_BUNDLE_FILE="$(readlink -f $OPTARG)"
            ;;
        h)
            usage
            exit 0
            ;;
        ?)
            usage
            exit 1
            ;;
    esac
done

EXIT_CODE=0

if [ -z "$CERT_FILE" -o -z "$KEY_FILE" -o -z "$CA_BUNDLE_FILE" ]; then
    echo 'One of the required parameters is missing.' >&2
    usage
    exit 1
fi

function error () {
    echo -e "\n${RED}[FAIL]${RESET}\n"
    CURRENT_EXIT_CODE=$1
    EXIT_CODE=$((EXIT_CODE|CURRENT_EXIT_CODE))
    echo -e $2 >&2
}

function success () {
    echo -e "\n${GREEN}[OK]${RESET}\n"
}

function check-files-exist() {
    if [[ ! -f "$CA_BUNDLE_FILE" ]] || [[ ! -f "$CERT_FILE" ]] || [[ ! -f "$KEY_FILE" ]] ; then
        echo "One of '${CERT_FILE}', '${KEY_FILE}' or '${CA_BUNDLE_FILE}' not found" >&2
        exit 1
    fi
}

function check-server-cert-encoding () {
    printf 'Checking server certificate encoding: '
    openssl x509 -inform pem -in $CERT_FILE -noout -text &> /dev/null
    if [[ $? == "0" ]]; then
        success
    else
        openssl x509 -inform der -in $CERT_FILE -noout -text &> /dev/null
        if [[ $? == "0" ]]; then
            error 8 "The server certificate is in DER encoding, which is incompatible.\n\n"
            printf "Run the following command to convert the certificate to PEM encoding,\n"
            printf "then test it again.\n"
            printf "# openssl x509 -in %s -outform pem -out %s.pem\n\n" $(basename $CERT_FILE) $(basename $CERT_FILE)
            printf "When you run $(basename $0) again, use file\n"
            printf "%s.pem for the server certificate.\n\n" $(basename $CERT_FILE)
        else
            error 9 "The encoding of the server certificate is unknown."
        fi
    fi
}

function check-expiration () {
    CERT_EXP=$(openssl x509 -noout -enddate -in $CERT_FILE | sed -e 's/notAfter=//' | awk '{$NF="";}1')
    CA_EXP=$(openssl x509 -noout -enddate -in $CA_BUNDLE_FILE | sed -e 's/notAfter=//' | awk '{$NF="";}1')
    DATE_TODAY=$(date -u +%Y%m%d%H%M%S)
    CERT_DATE=$(date -d"${CERT_EXP}" +%Y%m%d%H%M%S)
    CA_DATE=$(date -d"${CA_EXP}" +%Y%m%d%H%M%S)
    printf "Checking expiration of certificate: "
    if [[ $DATE_TODAY -gt $CERT_DATE ]]; then
        error 6 "The certificate \"$CERT_FILE\" has already expired on: $CERT_EXP"
    else
        success
    fi
    printf "Checking expiration of CA bundle: "
    if [[ $DATE_TODAY -gt $CA_DATE ]]; then
        error 7 "The CA bundle \"$CA_BUNDLE_FILE\" has already expired on: $CA_EXP"
    else
        success
    fi
}

function check-cert-ca-flag () {
    printf "Checking if server certificate has CA:TRUE flag "
    openssl x509 -in $CERT_FILE -noout -text | grep -q CA:TRUE
    if [[ $? -ne 0 ]]; then
        success
    else
        error 7 "The server certificate is marked as a CA and can not be used."
    fi
}

function check-passphrase () {
    printf "Checking for private key passphrase: "
    CHECK=$(cat $KEY_FILE | grep ENCRYPTED)
    if [[ $? == "0" ]]; then
        error 2 "The $KEY_FILE contains a passphrase, remove the key's passphrase by doing:
        \nmv $KEY_FILE $KEY_FILE.old
        \nopenssl pkey -in $KEY_FILE.old -out $KEY_FILE"
        exit 2
    else
        success
    fi
}

function check-priv-key () {
    printf "Checking to see if the private key matches the certificate: "
    CERT_PUBKEY_SUM=$(openssl x509 -noout -pubkey -in $CERT_FILE | openssl sha512)
    KEY_PUBKEY_SUM=$(openssl pkey -pubout -in $KEY_FILE | openssl sha512)
    if [[ "$CERT_PUBKEY_SUM" != "$KEY_PUBKEY_SUM" ]]; then
        error 2 "The $KEY_FILE does not match the $CERT_FILE"
    else
        success
    fi
}

function check-ca-bundle () {
    printf "Checking CA bundle against the certificate file: "
    ERROR_PATTERN="error [0-9]+ at"
    CHECK=$(openssl verify -no-CApath -no-CAstore -CAfile $CA_BUNDLE_FILE -purpose sslserver -verbose $CERT_FILE 2>&1)
    CHECK_STATUS=$?

    if [[ $CHECK_STATUS != "0" || $CHECK =~ $ERROR_PATTERN ]]; then
        error 4 "The $CA_BUNDLE_FILE does not verify the $CERT_FILE"
        echo -e "${CHECK/OK/}\n"
    else
        success
    fi
}

function check-ca-bundle-size () {
    printf "Checking CA bundle size: "
    CHECK=$(grep -c "^--*BEGIN" $CA_BUNDLE_FILE)
    printf $CHECK
    if [[ $CHECK -lt $CABUNDLE_MAX_ISSUERS ]]; then
        success
    else
        CERRTISSUER=$(openssl x509 -noout -in $CERT_FILE -issuer 2>&1)
        error 10 "The CA bundle counts $CHECK issuers. Please trim your CA bundle and include only the certs relevant to your cert file"
        echo $CERTISSUER
        echo
    fi
}

function check-ca-bundle-trust-rules () {
    printf "Checking if CA bundle has trust rules: "
    CHECK=$(grep 'BEGIN TRUSTED CERTIFICATE'  $CA_BUNDLE_FILE| wc -l)
    printf $CHECK
    if [[ $CHECK -lt 1 ]]; then
        success
    else
        error 10 "The CA bundle contains $CHECK certificate(s) with trust rules. This will create problems for older systems. Please, recreate the bundle using certificates without trust rules."
        echo
    fi
}

function check-cert-san () {
    printf "Checking Subject Alt Name on certificate "
    DNS_LIST=$(openssl x509 -noout -text -in $CERT_FILE | grep DNS:)
    if [[ $? == "0" ]]; then
        success
        printf "Checking if any Subject Alt Name on certificate matches the Subject CN"
        SUBJECT_CN=$(openssl x509 -in $CERT_FILE -noout -subject -nameopt multiline|grep commonName|cut -d '=' -f 2|tr -d ' ')
        for DNS in ${DNS_LIST}
          do
          DNS_VALUE="$( echo ${DNS//DNS:/} | tr -d ',')"
          if [ $SUBJECT_CN == $DNS_VALUE ]
          then
            success
            return
          fi
        done
        error 11 "The $CERT_FILE does not have a Subject Alt Name matching the Subject CN"
    else
        error 11 "The $CERT_FILE does not contain a Subject Alt Name. Common Name is deprecated, use Subject Alt Name instead. See: https://tools.ietf.org/html/rfc2818#section-3.1"
    fi
}

function check-cert-usage-key-encipherment () {
    printf "Checking Key Usage extension on certificate for Key Encipherment "
    CHECK=$(openssl x509 -noout -text -in $CERT_FILE | grep -A1 'X509v3 Key Usage:' | grep 'Key Encipherment')
    if [[ $? == "0" ]]; then
        success
    else
        error 4 "The $CERT_FILE does not allow for the 'Key Encipherment' key usage."
    fi
}

function check-shortname () {
    printf "Checking for use of shortname as CN"

    SUBJECT_CN=$(openssl x509 -in $CERT_FILE -noout -subject -nameopt multiline|grep commonName|cut -d '=' -f 2|tr -d ' ')
    if [[ $SUBJECT_CN != *"."* ]]; then
        error 1 "The $(basename $CERT_FILE) is using a shortname for Common Name (CN) and cannot be used.\n"
    fi

    DNS_LIST=$(openssl x509 -noout -text -in $CERT_FILE | grep DNS:)
    if [[ $? == "0" ]]; then
        for DNS in ${DNS_LIST}
          do
          DNS_VALUE="$( echo ${DNS//DNS:/} | tr -d ',')"

          if [[ $DNS_VALUE == *"."* ]]; then
            success
            return
          fi
        done
        error 1 "The $(basename $CERT_FILE) is using only shortnames for Subject Alt Name and cannot be used.\n"
    fi
}

function check-ca-signing-algorithm () {
    printf "Checking CA signing algorithm for sha1: "
    CHECK=$(openssl crl2pkcs7 -nocrl -certfile "$CA_BUNDLE_FILE" | openssl pkcs7 -print | grep algorithm | grep -q 'sha1WithRSAEncryption')
    if [[ $? == "0" ]]; then
        error 4 "The file '$CA_BUNDLE_FILE' contains a certificate signed with sha1 and will break installation. Update the server CA certificate and its chain with one signed by sha256 or stronger."
    else
        success
    fi
}

function check-pem-content () {
    local FILE=$1
    local TYPE=$2

    printf "Checking ${TYPE} for non-PEM content: "

    if awk '
        BEGIN {
            in_cert = 0
            bad = 0
        }

        /^-----BEGIN (TRUSTED )?CERTIFICATE-----$/ {
            if (in_cert) {
                bad = 1
            }
            in_cert = 1
            next
        }

        /^-----END (TRUSTED )?CERTIFICATE-----$/ {
            if (!in_cert) {
                bad = 1
            }
            in_cert = 0
            next
        }

        /^[[:space:]]*$/ {
            next
        }

        {
            if (!in_cert) {
                bad = 1
            }
        }

        END {
            if (in_cert) {
                bad = 1
            }
            exit bad
        }
    ' "$FILE"
    then
        success
    else
        error 12 "The ${TYPE} '$FILE' contains content outside PEM CERTIFICATE blocks. Only PEM CERTIFICATE blocks are allowed."
    fi
}

check-files-exist
check-pem-content "$CERT_FILE" "certificate file"
check-pem-content "$CA_BUNDLE_FILE" "CA bundle"
check-server-cert-encoding
check-expiration
check-cert-ca-flag
check-passphrase
check-priv-key
check-ca-bundle
check-ca-bundle-size
check-ca-bundle-trust-rules
check-cert-san
check-cert-usage-key-encipherment
check-shortname
check-ca-signing-algorithm

if [[ $EXIT_CODE == "0" ]]; then
    echo -e "${GREEN}Validation succeeded${RESET}\n"
else
  exit $EXIT_CODE
fi