github/vesta
1
0
Fork 0
mirror of https://github.com/serghey-rodin/vesta.git synced 2025-08-19 21:04:06 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improved SSL Chain validation

Browse source
This commit is contained in:
Serghey Rodin 2014-09-18 14:33:52 +03:00
commit 9e79206b64
1 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
func/domain.sh
View file

@ -313,25 +313,26 @@ is_web_domain_cert_valid() {
crt_vrf=$(openssl verify $ssl_dir/$domain.crt 2>&1) crt_vrf=$(openssl verify $ssl_dir/$domain.crt 2>&1)
if [ ! -z "$(echo $crt_vrf | grep 'unable to load')" ]; then if [ ! -z "$(echo $crt_vrf | grep 'unable to load')" ]; then
echo "Error: certificate is not valid" echo "Error: SSL Certificate is not valid"
log_event "$E_INVALID" "$EVENT" log_event "$E_INVALID" "$EVENT"
exit $E_INVALID exit $E_INVALID
fi fi
if [ ! -z "$(echo $crt_vrf | grep 'unable to get local issuer')" ]; then if [ ! -z "$(echo $crt_vrf | grep 'unable to get local issuer')" ]; then
if [ ! -e "$ssl_dir/$domain.ca" ]; then if [ ! -e "$ssl_dir/$domain.ca" ]; then
echo "Error: certificate authority not found" echo "Error: Certificate Authority not found"
log_event "$E_NOTEXIST" "$EVENT" log_event "$E_NOTEXIST" "$EVENT"
exit $E_NOTEXIST exit $E_NOTEXIST
fi fi
fi fi
if [ -e "$ssl_dir/$domain.ca" ]; then if [ -e "$ssl_dir/$domain.ca" ]; then
crt_vrf=$(openssl verify -purpose sslserver \ s1=$(openssl x509 -text -in $ssl_dir/$domain.crt 2>/dev/null)
-CAfile $ssl_dir/$domain.ca $ssl_dir/$domain.crt 2>/dev/null |\ s1=$(echo "$s1" |grep Issuer |awk -F = '{print $6}' |head -n1)
grep 'OK') s2=$(openssl x509 -text -in $ssl_dir/$domain.ca 2>/dev/null)
if [ -z "$crt_vrf" ]; then s2=$(echo "$s2" |grep Subject |awk -F = '{print $6}' |head -n1)
echo "Error: root or/and intermediate cerificate not found" if [ "$s1" != "$s2" ]; then
echo "Error: SSL intermediate chain is not valid"
log_event "$E_NOTEXIST" "$EVENT" log_event "$E_NOTEXIST" "$EVENT"
exit $E_NOTEXIST exit $E_NOTEXIST
fi fi
@ -339,7 +340,7 @@ is_web_domain_cert_valid() {
key_vrf=$(grep 'PRIVATE KEY' $ssl_dir/$domain.key | wc -l) key_vrf=$(grep 'PRIVATE KEY' $ssl_dir/$domain.key | wc -l)
if [ "$key_vrf" -ne 2 ]; then if [ "$key_vrf" -ne 2 ]; then
echo "Error: ssl key is not valid" echo "Error: SSL Key is not valid"
log_event "$E_INVALID" "$EVENT" log_event "$E_INVALID" "$EVENT"
exit $E_INVALID exit $E_INVALID
fi fi