Browse Source

Script to find exipred CRLs and certificates

Check for expiration in 3 months.
First argument is the offset. e.g. "+1 year"
Sean Parkinson 3 years ago
parent
commit
409daa665d
3 changed files with 149 additions and 0 deletions
  1. 1 0
      Makefile.am
  2. 143 0
      certs/check_dates.sh
  3. 5 0
      certs/include.am

+ 1 - 0
Makefile.am

@@ -19,6 +19,7 @@ dist_doc_DATA=
 dist_noinst_SCRIPTS =
 noinst_SCRIPTS =
 check_SCRIPTS =
+noinst_DATA =
 
 #includes additional rules from aminclude.am
 @INC_AMINCLUDE@

+ 143 - 0
certs/check_dates.sh

@@ -0,0 +1,143 @@
+#!/bin/sh
+
+# Whether a certificate or CRLs needs updating
+expired=0
+# Default to checking expiry within 6 months
+offset="+6 months"
+
+# First command line argument is the new expiry time
+if [ "$1" != "" ]
+then
+    offset=$1
+fi
+
+# Certificates that are expired and are intentionally or irrelevantly so.
+exp_expired="\
+/test/crit-cert.pem \
+/test/expired/expired-cert.pem \
+/test/expired/expired-ca.pem \
+/test/expired/expired-cert.der \
+/test/expired/expired-ca.der \
+/certeccrsa.pem \
+/certeccrsa.der
+"
+
+# Files that are not certificates or CRLs put get matched anyway
+ignore="\
+/test/cert-ext-ns.der \
+/rsa3072.der \
+/rsa2048.der \
+/1024/rsa1024.der \
+"
+
+# Get the date offset from now - earliest expiry - in seconds
+earliest=`date -d "$offset" +%s`
+
+# Compare the date with earliest allowed expiry.
+#
+# $1  Name of file being checked.
+# $2  Expiry date in file (notAfter or nextUpdate).
+check_expiry() {
+    # Convert date to a number of seconds
+    expiry=`date -d "$2" +%s`
+
+    # Check expiry is not too soon
+    if [ $expiry -lt $earliest ]
+    then
+        # Reset result
+        result=expired
+        # Ignore files that are expected to be expired
+        for exp in $exp_expired
+        do
+            case $1 in
+            *$exp)
+                result=ignore
+                break
+                ;;
+            esac
+        done
+        # Report any unexpected expiries
+        if [ "$result" = "expired" ]
+        then
+            echo "$1 expires at:"
+            echo "    '$2' (< $offset)"
+            expired=1
+        fi
+    fi
+}
+
+# Check file expiry.
+#
+# The file is of any format.
+# Try to guess from name what it is.
+#
+# $1       Name of file to check
+# $inform  Command line argument to use with openssl for input file format
+check_file() {
+    # Check file is not in list of files to ignore
+    for i in $ignore
+    do
+        case $1 in
+        *$i)
+            return
+            ;;
+        esac
+    done
+
+    # Use pattern matching to guess format
+    case $1 in
+    *key*) ;;
+    *dh*) ;;
+    *params*) ;;
+    *priv*) ;;
+    *pub*) ;;
+    *dsa*) ;;
+    *crl*)
+        # Get the nextUpdate field from the CRL
+        next_update=`openssl crl -in $file $inform -noout -nextupdate 2>&1`
+        if [ "$?" != "0" ]
+        then
+            # Didn't work so report failure
+            echo "$file not a crl"
+        else
+            # Get the date after the equal sign and check file
+            next_update="${next_update#*=}"
+            check_expiry $file "$next_update"
+        fi
+        ;;
+    *)
+        # Get the notAfter field from the certificate
+        not_after=`openssl x509 -in $file $inform -noout -enddate 2>&1`
+        if [ "$?" != "0" ]
+        then
+            # Didn't work, maybe wasn't a certificate, so report failure
+            echo "$file not a certificate"
+        else
+            # Get the date after the equal sign and check file
+            not_after="${not_after#*=}"
+            check_expiry $file "$not_after"
+        fi
+        ;;
+    esac
+}
+
+# Check all PEM files
+inform="-inform PEM"
+pem_files=`find . -name '*.pem'`
+for file in $pem_files
+do
+    check_file $file
+done
+
+# Check all DER files
+inform="-inform DER"
+der_files=`find . -name '*.der'`
+for file in $der_files
+do
+    check_file $file
+done
+
+# Return result of check
+# 0 on success
+# 1 on failure
+return $expired

+ 5 - 0
certs/include.am

@@ -112,3 +112,8 @@ include certs/statickeys/include.am
 include certs/test/include.am
 include certs/test-pathlen/include.am
 include certs/intermediate/include.am
+
+if BUILD_FIPS_V2
+else
+noinst_DATA += certs/check_dates.sh
+endif