mirror of
https://github.com/adulau/crl-monitor.git
synced 2024-11-22 01:57:05 +00:00
39 lines
835 B
Markdown
39 lines
835 B
Markdown
|
|
||
|
|
Building your own SSL certificate collector
|
||
|
|
===========================================
|
||
|
|
|
||
|
|
In order to build your own collector box for SSL certificate, ssldump
|
||
|
|
is required. The best is clone my ssldump version including recent
|
||
|
|
patches and some fixes for tapping monitored uplinks.
|
||
|
|
|
||
|
|
~~~~
|
||
|
|
git clone https://github.com/adulau/ssldump.git
|
||
|
|
cd ssldump
|
||
|
|
./configure --with-pcap-lib=/usr/lib/x86_64-linux-gnu/
|
||
|
|
~~~~
|
||
|
|
|
||
|
|
ssldump needs to be built *WITHOUT* OpenSSL support. We gather the raw
|
||
|
|
certificate extracted with ssldump directly.
|
||
|
|
|
||
|
|
Starting collection
|
||
|
|
===================
|
||
|
|
|
||
|
|
To test the compiled ssldump binary:
|
||
|
|
|
||
|
|
~~~~
|
||
|
|
cd ssldump
|
||
|
|
sudo ./ssldump -ANn -i eth1
|
||
|
|
~~~~
|
||
|
|
|
||
|
|
To test the parsing of the raw certificates:
|
||
|
|
|
||
|
|
~~~~
|
||
|
|
cd ssldump
|
||
|
|
sudo ./ssldump -ANn -i eth1 | python ../crl-monitor/bin/x509/pcal-sslcert.py -v
|
||
|
|
~~~~
|
||
|
|
|
||
|
|
Feeding the certificate store:
|
||
|
|
|
||
|
|
|
||
|
|
|