diff --git a/COLLECTOR.md b/COLLECTOR.md index f192e4f..e1798d8 100644 --- a/COLLECTOR.md +++ b/COLLECTOR.md @@ -32,6 +32,13 @@ cd ssldump sudo ./ssldump -ANn -i eth1 | python ../crl-monitor/bin/x509/pcap-sslcert.py -v ~~~~ +To dump from JSON the raw certificates: + +~~~~ +cd ssldump +sudo ./ssldump -ANn -i eth1 | python ../crl-monitor/bin/x509/pcap-sslcert.py -j | jq -r .pem +~~~~ + Feeding the certificate store: diff --git a/README.md b/README.md index 23132eb..f7ca0dd 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ This command parses all the certificates and extract the subjects and imports t Then you need to import the mapping between scanned IP addresses and the fingerprint of the X.509 certificate seen: ~~~~ -zcat ./scans-io/data/20141208_hosts.gz | python hoststoredis.py -p 6381 +zcat ./scans-io/data/20141208_hosts.gz | python hoststoredis.py -p 6381 -s ~~~~ The above procedure can be repeated with additional scans or you can import multiple scans in parallel using GNU Parallel.