SSL meta data

[BerndWill]

Hello everybody,

please help me with this topic:

Working at a big company (+100.000 employees worldwide), we have an amount
of data centers and shared services where our webservers, backend server
etc. are located.

Now it happens from time to time, that certificates are expired and instead
of our data centers organizing new certificates in time, we often are faced
with expired certificates and offline connections.

The only solution from me and my colleagues view (as poor at it sounds) is
to setup a little python script "pinging" an amount of about 2.000 servers
in daily intervals checking for the validity of those SSL certificates.

Though there is a lot of examples demonstrating how to access SSL
connections, I could not find a documentation about the certificate's data
(validation information).

I would love to read programmaticall y some information out of the
certificates itself (who signed it and what is the validation period, i.e.
meta data).

Can someone please help me out here !?

(I know we should better setup a database with validation dates, but believe
me, we didn't succeed in it)

Thanks in advance for any help or tip

Regards

Bernd

[Paul Rubin]

Re: SSL meta data

"BerndWill" <bernd@ewill.de writes:

I would love to read programmaticall y some information out of the
certificates itself (who signed it and what is the validation period, i.e.
meta data).
>
Can someone please help me out here !?

This is very cheesy but I sometimes I've just run the openssl command
line utility with popen and read the output:

openssl x509 -text -noout -in certfile

will dump out the cert contents and you can parse it with regexps.

The right way to do it is to make the appropriate m2crypto (or
whatever) calls that parse the cert directly.

[Jan Dries]

Re: SSL meta data

Paul Rubin wrote:

"BerndWill" <bernd@ewill.de writes:

>I would love to read programmaticall y some information out of the
>certificates itself (who signed it and what is the validation period, i.e.
>meta data).
>>
> Can someone please help me out here !?

>
This is very cheesy but I sometimes I've just run the openssl command
line utility with popen and read the output:
>
openssl x509 -text -noout -in certfile
>
will dump out the cert contents and you can parse it with regexps.
>
The right way to do it is to make the appropriate m2crypto (or
whatever) calls that parse the cert directly.

I'm not sure this is what the OP is looking for. Your method assumes the
certificate is on the local file system, while it seems to me he wants
to do an HTTPS request to one of their servers and obtain information
from the certificate installed there.

For doing that, cURL might be a good choice (either the command line
version (http://curl.haxx.se) or the python extension module PycURL
http://pycurl.sourceforge.net/)).

For instance:

C:\curl -v https://www.paypal.com

* About to connect() to www.paypal.com port 443
* Trying 216.113.188.65. .. * connected
* Connected to www.paypal.com (216.113.188.65 ) port 443
* successfully set certificate verify locations:
* CAfile: C:\home\persona l\development\b in\curl-ca-bundle.crt
CApath: none
* SSL connection using DHE-RSA-AES256-SHA
* Server certificate:
* subject: /C=US/ST=California/L=Mountain View/O=Paypal
Inc./OU=Information Systems/OU=Terms of use at
www.verisign.com/rpa (c)00/CN=www.paypal.c om
* start date: 2006-02-09 00:00:00 GMT
* expire date: 2008-02-09 23:59:59 GMT
* common name: www.paypal.com (matched)
* issuer: /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign
International Server CA - Class 3/OU=
www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign
* SSL certificate verify ok.

[more output deleted]

I'm sure that by using the cURL API directly, you can obtain the
certificate information in a more direct way without having to rely on
parsing the above output with regexps. Doing so might also be more
complex though :-)

Regards,
Jan

[Paul Rubin]

Re: SSL meta data

Jan Dries <jan.dries@dcub e-resource.bewrit es:

C:\curl -v https://www.paypal.com
>
I'm sure that by using the cURL API directly, you can obtain the
certificate information in a more direct way without having to rely on
parsing the above output with regexps. Doing so might also be more
complex though :-)

Yeah, same idea, I haven't stayed on top of curl and so forth. I usually
use openssl for that:

openssl s_client -connect www.paypal.com:443

This prints out the cert so you'd have to parse it in a separate step
(e.g. save it in a file first). Anyway these are just dirty hacks,
but might be ok for this type of internal administrative purposes.
Otherwise use the real API.

[BerndWill]

Re: SSL meta data

Thanks Jan.
I will try pycurl then.

Regards
Bernd

"Jan Dries" <jan.dries@dcub e-resource.beschr ieb im Newsbeitrag
news:mailman.60 1.1159213325.10 491.python-list@python.org ...

Paul Rubin wrote:

>"BerndWill" <bernd@ewill.de writes:

>>I would love to read programmaticall y some information out of the
>>certificate s itself (who signed it and what is the validation period,
>>i.e. meta data).
>>>
>> Can someone please help me out here !?

>>
>This is very cheesy but I sometimes I've just run the openssl command
>line utility with popen and read the output:
>>
> openssl x509 -text -noout -in certfile
>>
>will dump out the cert contents and you can parse it with regexps.
>>
>The right way to do it is to make the appropriate m2crypto (or
>whatever) calls that parse the cert directly.

>
I'm not sure this is what the OP is looking for. Your method assumes the
certificate is on the local file system, while it seems to me he wants to
do an HTTPS request to one of their servers and obtain information from
the certificate installed there.
>
For doing that, cURL might be a good choice (either the command line
version (http://curl.haxx.se) or the python extension module PycURL
http://pycurl.sourceforge.net/)).
>
For instance:
>
C:\curl -v https://www.paypal.com
>
* About to connect() to www.paypal.com port 443
* Trying 216.113.188.65. .. * connected
* Connected to www.paypal.com (216.113.188.65 ) port 443
* successfully set certificate verify locations:
* CAfile: C:\home\persona l\development\b in\curl-ca-bundle.crt
CApath: none
* SSL connection using DHE-RSA-AES256-SHA
* Server certificate:
* subject: /C=US/ST=California/L=Mountain View/O=Paypal
Inc./OU=Information Systems/OU=Terms of use at
www.verisign.com/rpa (c)00/CN=www.paypal.c om
* start date: 2006-02-09 00:00:00 GMT
* expire date: 2008-02-09 23:59:59 GMT
* common name: www.paypal.com (matched)
* issuer: /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign
International Server CA - Class 3/OU=
www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign
* SSL certificate verify ok.
>
[more output deleted]
>
I'm sure that by using the cURL API directly, you can obtain the
certificate information in a more direct way without having to rely on
parsing the above output with regexps. Doing so might also be more complex
though :-)
>
Regards,
Jan
>

[Lawrence D'Oliveiro]

Re: SSL meta data

In message <ef99ht$ih2$1@s vr7.m-online.net>, BerndWill wrote:

The only solution from me and my colleagues view (as poor at it sounds)
is to setup a little python script "pinging" an amount of about 2.000
servers in daily intervals checking for the validity of those SSL
certificates.

There's no need to check each server more than once. It gives you its
certificate, you check the expiry date, save that in a database, and you
don't have to worry until the expiry date comes close, when it's time to
notify somebody to organize a renewal.