Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reports Certificate Serial number #1333

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
+57 −7
Open

Reports Certificate Serial number #1333

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b4999a4
Reports Certificate Serial number
rhys-evans Dec 7, 2024
e83ca65
Fix Serial Number example
rhysxevans Dec 9, 2024
e0bbd77
Add test for leading zeros handling on serial numbers
rhysxevans Dec 24, 2024
b8c230f
Merge branch 'master' into add_serialnumber_reporting_to_tls_connections
rhysxevans Jan 1, 2025
32b26aa
Make code more succinct, regarding returning `serialnumber`
rhysxevans Jan 2, 2025
239f19c
shorten comment and add links to relevant sources
rhysxevans Jan 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions prober/grpc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ func ProbeGRPC(ctx context.Context, target string, module config.Module, registr
Name: "probe_ssl_last_chain_info",
Help: "Contains SSL leaf certificate information",
},
[]string{"fingerprint_sha256", "subject", "issuer", "subjectalternative"},
[]string{"fingerprint_sha256", "subject", "issuer", "subjectalternative", "serialnumber"},
)
)

Expand Down Expand Up @@ -206,7 +206,7 @@ func ProbeGRPC(ctx context.Context, target string, module config.Module, registr
isSSLGauge.Set(float64(1))
probeSSLEarliestCertExpiryGauge.Set(float64(getEarliestCertExpiry(&tlsInfo.State).Unix()))
probeTLSVersion.WithLabelValues(getTLSVersion(&tlsInfo.State)).Set(1)
probeSSLLastInformation.WithLabelValues(getFingerprint(&tlsInfo.State), getSubject(&tlsInfo.State), getIssuer(&tlsInfo.State), getDNSNames(&tlsInfo.State)).Set(1)
probeSSLLastInformation.WithLabelValues(getFingerprint(&tlsInfo.State), getSubject(&tlsInfo.State), getIssuer(&tlsInfo.State), getDNSNames(&tlsInfo.State), getSerialNumber(&tlsInfo.State)).Set(1)
} else {
isSSLGauge.Set(float64(0))
}
Expand Down
4 changes: 2 additions & 2 deletions prober/http.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,7 +273,7 @@ func ProbeHTTP(ctx context.Context, target string, module config.Module, registr
Name: "probe_ssl_last_chain_info",
Help: "Contains SSL leaf certificate information",
},
[]string{"fingerprint_sha256", "subject", "issuer", "subjectalternative"},
[]string{"fingerprint_sha256", "subject", "issuer", "subjectalternative", "serialnumber"},
)

probeTLSVersion = prometheus.NewGaugeVec(
Expand Down Expand Up @@ -647,7 +647,7 @@ func ProbeHTTP(ctx context.Context, target string, module config.Module, registr
probeTLSVersion.WithLabelValues(getTLSVersion(resp.TLS)).Set(1)
probeTLSCipher.WithLabelValues(getTLSCipher(resp.TLS)).Set(1)
probeSSLLastChainExpiryTimestampSeconds.Set(float64(getLastChainExpiry(resp.TLS).Unix()))
probeSSLLastInformation.WithLabelValues(getFingerprint(resp.TLS), getSubject(resp.TLS), getIssuer(resp.TLS), getDNSNames(resp.TLS)).Set(1)
probeSSLLastInformation.WithLabelValues(getFingerprint(resp.TLS), getSubject(resp.TLS), getIssuer(resp.TLS), getDNSNames(resp.TLS), getSerialNumber(resp.TLS)).Set(1)
if httpConfig.FailIfSSL {
logger.Error("Final request was over SSL")
success = false
Expand Down
6 changes: 3 additions & 3 deletions prober/tcp.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ func ProbeTCP(ctx context.Context, target string, module config.Module, registry
Name: "probe_ssl_last_chain_info",
Help: "Contains SSL leaf certificate information",
},
[]string{"fingerprint_sha256", "subject", "issuer", "subjectalternative"},
[]string{"fingerprint_sha256", "subject", "issuer", "subjectalternative", "serialnumber"},
)
probeTLSVersion := prometheus.NewGaugeVec(
probeTLSInfoGaugeOpts,
Expand Down Expand Up @@ -147,7 +147,7 @@ func ProbeTCP(ctx context.Context, target string, module config.Module, registry
probeSSLEarliestCertExpiry.Set(float64(getEarliestCertExpiry(&state).Unix()))
probeTLSVersion.WithLabelValues(getTLSVersion(&state)).Set(1)
probeSSLLastChainExpiryTimestampSeconds.Set(float64(getLastChainExpiry(&state).Unix()))
probeSSLLastInformation.WithLabelValues(getFingerprint(&state), getSubject(&state), getIssuer(&state), getDNSNames(&state)).Set(1)
probeSSLLastInformation.WithLabelValues(getFingerprint(&state), getSubject(&state), getIssuer(&state), getDNSNames(&state), getSerialNumber(&state)).Set(1)
}
scanner := bufio.NewScanner(conn)
for i, qr := range module.TCP.QueryResponse {
Expand Down Expand Up @@ -216,7 +216,7 @@ func ProbeTCP(ctx context.Context, target string, module config.Module, registry
probeSSLEarliestCertExpiry.Set(float64(getEarliestCertExpiry(&state).Unix()))
probeTLSVersion.WithLabelValues(getTLSVersion(&state)).Set(1)
probeSSLLastChainExpiryTimestampSeconds.Set(float64(getLastChainExpiry(&state).Unix()))
probeSSLLastInformation.WithLabelValues(getFingerprint(&state), getSubject(&state), getIssuer(&state), getDNSNames(&state)).Set(1)
probeSSLLastInformation.WithLabelValues(getFingerprint(&state), getSubject(&state), getIssuer(&state), getDNSNames(&state), getSerialNumber(&state)).Set(1)
}
}
return true
Expand Down
12 changes: 12 additions & 0 deletions prober/tls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ import (
"crypto/sha256"
"crypto/tls"
"encoding/hex"
"fmt"
"strings"
"time"
)
Expand Down Expand Up @@ -69,6 +70,17 @@ func getLastChainExpiry(state *tls.ConnectionState) time.Time {
return lastChainExpiry
}

func getSerialNumber(state *tls.ConnectionState) string {
cert := state.PeerCertificates[0]
// Actual serial number = 0B:FF:BC:11:F1:90:7D:02:AF:71:9A:FC:D6:4F:B2:53
electron0zero marked this conversation as resolved.
Show resolved Hide resolved
// serialNumber := cert.SerialNumber.Text(16) // drops leading zeros outputs = BFFBC11F1907D02AF719AFCD64FB253 in lower case, telgraf follows this https://github.com/influxdata/telegraf/blob/a9c91f162ddbe453364f68a89799535c43328a3c/plugins/inputs/x509_cert/x509_cert.go#L218
// https://github.com/atc0005/check-cert retains the leading zero with some aditional formatting

serialNumber := strings.ToLower(fmt.Sprintf("%X", cert.SerialNumber.Bytes()))
electron0zero marked this conversation as resolved.
Show resolved Hide resolved
electron0zero marked this conversation as resolved.
Show resolved Hide resolved

return serialNumber
}

func getTLSVersion(state *tls.ConnectionState) string {
switch state.Version {
case tls.VersionTLS10:
Expand Down
Loading