Benjamin Peterson | 90f5ba5 | 2010-03-11 22:53:45 +0000 | [diff] [blame] | 1 | #!/usr/bin/env python3 |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 2 | # |
| 3 | # fetch the certificate that the server(s) are providing in PEM form |
| 4 | # |
| 5 | # args are HOST:PORT [, HOST:PORT...] |
| 6 | # |
| 7 | # By Bill Janssen. |
| 8 | |
Georg Brandl | cbb9421 | 2010-10-28 08:38:30 +0000 | [diff] [blame] | 9 | import re |
| 10 | import os |
Christian Heimes | 05e8be1 | 2008-02-23 18:30:17 +0000 | [diff] [blame] | 11 | import sys |
Georg Brandl | cbb9421 | 2010-10-28 08:38:30 +0000 | [diff] [blame] | 12 | import tempfile |
| 13 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 14 | |
| 15 | def fetch_server_certificate (host, port): |
| 16 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 17 | def subproc(cmd): |
| 18 | from subprocess import Popen, PIPE, STDOUT |
| 19 | proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True) |
| 20 | status = proc.wait() |
| 21 | output = proc.stdout.read() |
| 22 | return status, output |
| 23 | |
| 24 | def strip_to_x509_cert(certfile_contents, outfile=None): |
Georg Brandl | cbb9421 | 2010-10-28 08:38:30 +0000 | [diff] [blame] | 25 | m = re.search(br"^([-]+BEGIN CERTIFICATE[-]+[\r]*\n" |
| 26 | br".*[\r]*^[-]+END CERTIFICATE[-]+)$", |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 27 | certfile_contents, re.MULTILINE | re.DOTALL) |
| 28 | if not m: |
| 29 | return None |
| 30 | else: |
| 31 | tn = tempfile.mktemp() |
Georg Brandl | cbb9421 | 2010-10-28 08:38:30 +0000 | [diff] [blame] | 32 | fp = open(tn, "wb") |
| 33 | fp.write(m.group(1) + b"\n") |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 34 | fp.close() |
| 35 | try: |
| 36 | tn2 = (outfile or tempfile.mktemp()) |
| 37 | status, output = subproc(r'openssl x509 -in "%s" -out "%s"' % |
| 38 | (tn, tn2)) |
| 39 | if status != 0: |
Georg Brandl | 30baf2b | 2010-12-30 17:36:17 +0000 | [diff] [blame] | 40 | raise RuntimeError('OpenSSL x509 failed with status %s and ' |
| 41 | 'output: %r' % (status, output)) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 42 | fp = open(tn2, 'rb') |
| 43 | data = fp.read() |
| 44 | fp.close() |
| 45 | os.unlink(tn2) |
| 46 | return data |
| 47 | finally: |
| 48 | os.unlink(tn) |
| 49 | |
| 50 | if sys.platform.startswith("win"): |
| 51 | tfile = tempfile.mktemp() |
| 52 | fp = open(tfile, "w") |
| 53 | fp.write("quit\n") |
| 54 | fp.close() |
| 55 | try: |
| 56 | status, output = subproc( |
| 57 | 'openssl s_client -connect "%s:%s" -showcerts < "%s"' % |
| 58 | (host, port, tfile)) |
| 59 | finally: |
| 60 | os.unlink(tfile) |
| 61 | else: |
| 62 | status, output = subproc( |
| 63 | 'openssl s_client -connect "%s:%s" -showcerts < /dev/null' % |
| 64 | (host, port)) |
| 65 | if status != 0: |
Georg Brandl | 30baf2b | 2010-12-30 17:36:17 +0000 | [diff] [blame] | 66 | raise RuntimeError('OpenSSL connect failed with status %s and ' |
| 67 | 'output: %r' % (status, output)) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 68 | certtext = strip_to_x509_cert(output) |
| 69 | if not certtext: |
| 70 | raise ValueError("Invalid response received from server at %s:%s" % |
| 71 | (host, port)) |
| 72 | return certtext |
| 73 | |
Georg Brandl | cbb9421 | 2010-10-28 08:38:30 +0000 | [diff] [blame] | 74 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 75 | if __name__ == "__main__": |
| 76 | if len(sys.argv) < 2: |
| 77 | sys.stderr.write( |
| 78 | "Usage: %s HOSTNAME:PORTNUMBER [, HOSTNAME:PORTNUMBER...]\n" % |
| 79 | sys.argv[0]) |
| 80 | sys.exit(1) |
| 81 | for arg in sys.argv[1:]: |
| 82 | host, port = arg.split(":") |
Georg Brandl | cbb9421 | 2010-10-28 08:38:30 +0000 | [diff] [blame] | 83 | sys.stdout.buffer.write(fetch_server_certificate(host, int(port))) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 84 | sys.exit(0) |