Re: [hobbit] SSL cert testing to match common name with host/URL?

[Ralph Mitchell <ralphmitchell (at) gmail.com>]

On Tue, Jun 15, 2010 at 2:55 PM, Cleaver, Japheth <jcleaver (at) soe.sony.com>wrote:

>
> I've been adding testing of https URLs into our system and noticed that
> while the expiration date checking is nice, Xymon doesn't seem to be
> checking testing the common name at all for validity (in the manner that a
> browser might).
>
> I've been examining contest.c and bbtest-net.c/h looking for the best way
> of exposing this data back up to the status determination near line ~1800 of
> bbtest-net.c, but can't seem to properly add things to the testitem struct
> to get things passed properly.
>
> E.g.:
> contest.c:649:        item->certcommonname =
> strdup(X509_NAME_get_text_by_NID(X509_get_subject_name(peercert),
> NID_commonName, NULL, 0));
>
>
> Has anyone tried to solve this problem before? Or, perchance, have a patch?


I don't recall anyone else mentioning this as a problem.    A fairly easy
workaround would be to roll your own check.  For example, this:

     curl -v https://mail.google.com

returns:

     * Server certificate:
     *        subject: C=US; ST=California; L=Mountain View; O=Google Inc;
CN=mail.google.com
     *        start date: 2009-12-18 00:00:00 GMT
     *        expire date: 2011-12-18 23:59:59 GMT
     *        common name: mail.google.com (matched)
     *        issuer: C=ZA; O=Thawte Consulting (Pty) Ltd.; CN=Thawte SGC CA
     *        SSL certificate verify ok.
     > GET / HTTP/1.1

among other things.  It wouldn't be too hard to grep out "common name" from
that and go from there.  If there's anything hinky about the cert, curl will
return an error.  If you use the "-k" option, it'll ignore the error and
give you the page along with info about what was wrong.

Ralph Mitchell