News for hackers. Stuff that matters.

A comment on Final Removal of Trust in WoSign and StartCom Certificates.

Re:Final Removal of Trust in WoSign and StartCom Certificates by brian_herman on Friday July 07, 2017 @12:25PM (#14719663)
Is there a tool that we can use to tell if we have these certs?
[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by theossuary on Friday July 07, 2017 @12:48PM (#14719858)
It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the site a failing grade if the Wosign cert is found/invalid) [2].

Note, I haven't been able to test that script on an actually broken site with a Wosign certificate

[1]: https://pastebin.com/ZVMM3PJZ [2]: https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hi...

[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by ivanr on Friday July 07, 2017 @12:59PM (#14719951)
For what it's worth, SSL Labs also has a command-line tool that enables you to scan in bulk https://github.com/ssllabs/ssllabs-scan

However, although they don't trust WoSign and StartCom any more, it's possible that there is a cross-signed certificate to another CA, in which case the problem is not going to be detected. I seem to recollect that such cross-signed certs exist, but I haven't looked for them recently. Will do.

[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by dom0 on Friday July 07, 2017 @12:48PM (#14719864) 

    echo | openssl s_client -connect somewhere.net:443 -servername somewhere.net | grep -qE "(WoSign)|(StartCom)"
[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by ivanr on Friday July 07, 2017 @12:55PM (#14719924)
That's a bit simplistic. For example, you at the very least want to have a "-servername" there to account for SNI-only hosts. You'll then need to worry about prefixed and non-prefixed hosts (e.g., www.example.com and example.com). Then, what do you do if your web site relies on a third-party sites that uses WoSign? Yes, now you have to parse the HTML response, extract all links, and check those too.

Then there's also a question of servers other than HTTP, so you need to throw in a port scanner in there. And a tool to actively follow protocols, to discover MX hosts, maybe even look at SRV records, and so on.

[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by schoen on Friday July 07, 2017 @12:53PM (#14719911)
For more accurate browser-like results, you might want to add "-servername somewhere" so that you get the response associated with the "somewhere" virtual host rather than the default response.
[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by aaronmdjones on Saturday July 08, 2017 @01:23PM (#14726242)
No need to prefix the command with `echo | '. If you want OpenSSL to have no standard input (so it closes its connection), just redirect standard input from /dev/null.

$ openssl ... </dev/null | grep ...

EDIT: This also avoids OpenSSL sending its only input character (the newline that echo produces) to the server, which will throw it away anyway.

[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by ivanr on Friday July 07, 2017 @12:32PM (#14719721)
Are you asking because you have a large number of hosts and can't check them all manually? (Edit: Because the obvious answer is to use your browser or a tool such as SSL Labs or Hardenize to see who issued the certificate.) Out of curiosity, how many hosts are you looking after?
[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by svenfaw on Friday July 07, 2017 @03:17PM (#14721243)
Something to be aware of: on Windows, certain third-party executables are signed with a WoSign cert. One popular example being the npcap library (part of nmap). If you distrust WoSign roots, side effects may occur upon using nmap.
[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by jwilk on Saturday July 08, 2017 @08:33AM (#14725194)
https://github.com/jwilk/skeptica
[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by Rjevski on Friday July 07, 2017 @12:41PM (#14719808)
A script running openssl s_client would do the trick.
[ Parent | on HN ]