inspect-cert-chain 0.0.11

OpenSSL-like text output for debugging certificate chains
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126

#![deny(rust_2018_idioms, future_incompatible)]

use std::{
    fs,
    io::{self, Read},
};

use clap::Parser;
use der::{Decode as _, Encode as _};
use eyre::WrapErr as _;
use pem_rfc7468::{LineEnding, PemLabel as _};
use x509_cert::Certificate;

mod ext;
mod fetch;
mod info;
mod util;

cfg_if::cfg_if! {
    if #[cfg(windows)] {
        const LINE_ENDING: LineEnding = LineEnding::CRLF;
    } else {
        const LINE_ENDING: LineEnding = LineEnding::LF;
    }
}

#[derive(Debug, Parser)]
#[command(author, version, about, long_about = None)]
struct Args {
    /// Download certificate chain from remote host.
    #[clap(long, conflicts_with = "file")]
    host: Option<String>,

    /// When provided, writes downloaded chain to file in PEM format.
    #[clap(long, conflicts_with = "file")]
    dump: Option<camino::Utf8PathBuf>,

    /// Inspect a local certificate chain in PEM format.
    #[clap(long, conflicts_with = "host")]
    file: Option<camino::Utf8PathBuf>,

    #[arg(short, long, action = clap::ArgAction::Count)]
    verbose: u8,
}

// let anchor = &TLS_SERVER_ROOTS.0[3]; // seems to have wrong modulus ?!?

fn main() -> eyre::Result<()> {
    color_eyre::install()?;

    let args = Args::parse();

    if args.verbose == 0 {
        pretty_env_logger::try_init_timed()?;
    } else {
        std::env::set_var("RUST_LOG", "info");
        pretty_env_logger::try_init_timed()?;
    }

    let certs = if let Some(host) = &args.host {
        tracing::info!("fetching certificate chain from remote host: {host}");
        fetch::cert_chain(host)?
    } else if let Some(file) = &args.file {
        let mut input = if file == "-" {
            tracing::info!("reading certificate chain from stdin: {file}");

            let mut buf = String::new();
            let n_bytes = io::stdin().read_to_string(&mut buf).unwrap();
            tracing::trace!("read {n_bytes} from stdin");
            Box::new(io::Cursor::new(buf)) as Box<dyn io::BufRead>
        } else {
            tracing::info!("reading certificate chain from file: {file}");

            let file =
                fs::File::open(file).wrap_err_with(|| format!("could not open file: {file}"))?;
            Box::new(io::BufReader::new(file)) as Box<dyn io::BufRead>
        };

        tracing::debug!("reading certificate chain PEM files");
        let certs = rustls_pemfile::certs(&mut input)?;

        tracing::debug!("parsing certificate chain");
        certs
            .into_iter()
            .map(|der| x509_cert::Certificate::from_der(&der))
            .collect::<Result<_, _>>()?
    } else {
        return Err(eyre::eyre!("use --host or --file"));
    };

    let n_certs = certs.len();
    tracing::info!("chain contains {n_certs} certificates");

    if n_certs == 0 {
        return Err(eyre::eyre!("chain contained 0 certificates"));
    }

    for cert in &certs {
        info::print_cert_info(cert);

        println!();
        println!();
    }

    if let Some(dump_path) = args.dump {
        tracing::info!("writing chain to {dump_path}");

        let pem_chain = certs
            .into_iter()
            .map(|cert| {
                let mut der = Vec::with_capacity(256);
                cert.encode_to_vec(&mut der)
                    .wrap_err("failed to convert certificate back to DER encoding")?;

                pem_rfc7468::encode_string(Certificate::PEM_LABEL, LINE_ENDING, &der)
                    .wrap_err("failed to encode DER certificate to PEM format")
            })
            .collect::<Result<Vec<_>, _>>()?
            .concat();

        fs::write(&dump_path, pem_chain)
            .wrap_err_with(|| format!("failed to dump downloaded cert chain to {dump_path}"))?;
    }

    Ok(())
}