forked from matteocorti/check_ssl_cert
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ChangeLog
1445 lines (789 loc) · 50.9 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2022-09-20 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): checking the maximum validity only for files or HTTPS
* check_ssl_cert (check_attr): added --maximum-validity to force the maximum validity check
2022-09-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): checking the maximum certificate validity
2022-09-15 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh: removed stray \ from regexes
* check_ssl_cert: removed stray \ from regexes
2022-09-13 Matteo Corti <matteo@corti.li>
* check_ssl_cert: added --grep-bin to specify the grep binary to be used
2022-09-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert (usage): default port in the help text
2022-09-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_security_header): added --debug-headers to store the HTTP headers in the headers.txt file
2022-09-08 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): curl ignores TLS problems while retrieving headers
* check_ssl_cert (main): curl uses --resolve if specified when retrieving HTTP headers
2022-09-07 Matteo Corti <matteo@corti.li>
* check_ssl_cert (parse_command_line_options): added an optional path for the X-Frame-Options header retrieval
2022-09-06 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Added --require-x-frame-options to check for the X-Frame-Options header
* check_ssl_cert (main): Disallowing --require-hsts and --require-x-frame-options if no HTTPS is used
* check_ssl_cert (extract_cert_attribute): Fixed a bug when parsing certificates without purpose
2022-09-02 Matteo Corti <matteo@corti.li>
* Makefile (CITATION.cff): rebuild if a new version was specified
* check_ssl_cert (main): disabling nmap checks if a proxy is specified
2022-09-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): follow redirects when checking HSTS
* check_ssl_cert (main): Add verbose message for HSTS
2022-08-31 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): parsing 'excessive message size' errors
2022-08-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (extract_cert_attribute): Parse UTF-8 attributes (e.g., Location, ...)
2022-08-24 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): nmap is now always required
* check_ssl_cert (main): new formatting option %SIGALGO%
* check_ssl_cert (main): new command line argument --default-format
* check_ssl_cert (extract_cert_attribute): fixed the parsing of the signature algorithm
2022-08-23 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Fixed the handling of --ignore-connection-state
2022-08-17 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Check for HSTS
2022-07-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert (usage): New option --user-agent to specify the user agent used by curl and by OpenSSL for HTTPS connections
2022-07-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): Better error output by timeouts
2022-07-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): Fetching 'no route to host' errors
2022-07-06 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): if x509 -ext is not supported no info on the cert purpose is extracted
2022-07-04 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Add shell version to the debug info
2022-07-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): DNSSEC checks
2022-06-29 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): some more informational output
2022-06-21 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): Better error message if the certificate file is not readable
2022-06-17 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Added checks for the certificate purpose
2022-06-15 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (setUp): test completion time estimation
2022-06-14 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (setUp): printing the test number
* check_ssl_cert (main): fixed a problem with the caching of IPv6 hosts
2022-06-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert: fixed a problem with Prometheus output
2022-06-03 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): X.509 version printed with --info
2022-06-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_cert_end_date): Applied patch for the missing quotes to the prometheus output
2022-05-27 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh: Added the possibility to set the debug mode for all the tests
2022-05-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): added default ports for XMPP
2022-05-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (parse_command_line_options): Support for DTLS
* check_ssl_cert (parse_command_line_options): Check if two protocols are specified at the same time
2022-05-10 Matteo Corti <matteo@corti.li>
* check_ssl_cert.completion (_check_ssl_cert): added the missing --check-ssl-labs option
2022-05-05 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): using nmap instead of netcat
2022-05-04 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Using netcat to check connections
2022-04-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Using --script +ssl-enum-ciphers for older versions of nmap
2022-04-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_ocsp): Updating the timeout when using the timeout option of 'ocsp'
2022-04-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_ocsp): Better error message in case of OCSP problems
2022-04-13 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Allows to run with the --init-host-cache option only
* check_ssl_cert.completion (_check_ssl_cert): check if the host cache exists
* check_ssl_cert (main): Added a cache for checked hosts (to be used with bash completion)
* check_ssl_cert (usage): Fixed the capitalization of the help messages
* check_ssl_cert (usage): Usage errors should trigger an unknown status
2022-04-06 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (testIPv6): Corrected the IPv6 tests
* check_ssl_cert (check_attr): Timeout support for SSL Labs
* check_ssl_cert (check_attr): Adding a missing -6 option (if specified) to nmap
2022-03-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): fixes debugging output on STDERR
2022-03-21 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): added missing proxy options for curl and s_client
2022-03-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert: status UNKNOWN only for plugin-internal problems (see https://nagios-plugins.org/doc/guidelines.html#AEN78)
2022-03-14 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): Add the protocol (if defined) to the critical message
2022-03-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Display all the unmatched common names
2022-02-28 Peter Newman (https://github.com/peternewman)
* check_ssl_cert (fetch_certificate): Allow pkcs12 extension for PKCS #12 files
2022-02-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): display the protocol in the output
2022-02-18 Matteo Corti <matteo@corti.li>
* check_ssl_cert.completion (_check_ssl_cert): host completion
2022-02-17 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): write the host and the port in the output
* check_ssl_cert (usage): list of possible variables for the --format option
2022-02-03 Matteo Corti <matteo@corti.li>
* check_ssl_cert.completion (_check_ssl_cert): first version of completion
2022-02-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): adding the reason of the timeout to the error message
* check_ssl_cert (main): do not set the default timeout if ${TIMEOUT} is already set
2022-01-13 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_integer): Added input validation for integers and floats
* check_ssl_cert (main): If --file is an URI fetch it with curl
2022-01-12 Matteo Corti <matteo@corti.li>
* check_ssl_cert: enable floating point computations
2022-01-10 Matteo Corti <matteo@corti.li>
* .github/workflows/test.yml (jobs): Removed Ubuntu 20.10
* Makefile (dist): Disable extended attributes support with bsdtar
2021-12-21 Matteo Corti <matteo@corti.li>
* Converted several documents to Markdown
2021-12-20 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Fixed a problem with self signed certificates
* check_ssl_cert (main): Better --info output by missing fields
2021-12-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert (parse_command_line_options): Remove the trailing . from FQDNs
2021-12-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): check if the used protocol was HTTP/2 (if requested)
2021-12-10 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): using NMAP_BIN instead of nmap
* check_ssl_cert (main): fixed a bug causing an unnecessary scan when checking for disallowed protocols
* check_ssl_cert (main): (main): SSL 2.0 and SSL 3.0 disabled by --all and --all-local
2021-12-08 Matteo Corti <matteo@corti.li>
* Fixed several spelling mistakes
2021-12-05 Bernd Stroessenreuther <booboo@gluga.de>
* check_ssl_cert: improve readability of --help by wrapping some very long lines
2021-12-03 Matteo Corti <corti@ubuntu-2110>
* check_ssl_cert (main): IPv6 checks fixed if ipconfig is not available
2021-11-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert (info): --info to print certificate information
2021-11-24 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Fixed a bug in the processing of error messages
* check_ssl_cert (main): Handle root certificates in DER format
* check_ssl_cert (check_attr): Fixed the nmap cipher check for hosts which are not discoverable
2021-11-12 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Skipping the manual renegotiation test with OpenSSL > 3.0.0
2021-11-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Fixed a problem with newlines in variable on some systems (e.g., Fedora)
* check_ssl_cert (fetch_certificate): Fixed a problem with OpenSSL 3.0.0 and debug mode with certain servers
2021-11-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Better extraction of the certificate issuers
2021-11-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): Parsing of OpenSSL 3 messages
* check_ssl_cert (fetch_certificate): Ignoring legacy renegotiation if --ignore-tls-renegotiation was specified
2021-10-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (debuglog): Better formatting of the elapsed time in the log output
2021-10-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Fixed the organization check
* check_ssl_cert (main): Check if -sigalgs is available
* check_ssl_cert (check_attr): check if nmap delivers cipher strengths
2021-10-21 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (testRSA): Added a test for RSA ciphers
* check_ssl_cert (main): Fixes --rsa on systems not supporting PSS
* check_ssl_cert (create_temporary_file): Uses mktemp if available (the workaround is only used if not available for speed reasons)
2021-10-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (create_temporary_file): AIX compatible temporary file creation
2021-10-12 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): using OpenSSL verify to verify a local chain
2021-10-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Checks the certificate chain
2021-10-08 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (testSubdomainWithUnderscore): does not test with older OpenSSL versions not supporting _
* check_ssl_cert (fetch_certificate): Fixed a typo
2021-10-06 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_ocsp): better handling of HTML pages instead of certificates
* check_ssl_cert (parse_command_line_options): a URL can be given as host (scheme and path will be stripped)
* check_ssl_cert (check_attr): accepts certificates without subject alternative names
2021-10-05 Matteo Corti <matteo@corti.li>
* check_ssl_cert (debuglog): added an option (--debug-time) to print the elapsed time in the debugging output
2021-10-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): --skip-element now skips a single element and can be specified multiple times
2021-09-29 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Added an option to set a custom state by connection failures
2021-09-27 Matteo Corti <matteo@corti.li>
* check_ssl_cert (hours_until): supporting certificate expiration after 2038-01-19 on 32 bit systems
* check_ssl_cert (main): adds a check for acceptable client certificate CAs
* test/unit_tests.sh: added a routine to create a self-signed certificate expiring in a given number of days
* test/unit_tests.sh: added a test for a certificate expiring between 0.5 and 1.5 days
2021-09-25 Bernd Stroessenreuther <booboo@gluga.de>
* test/unit_tests.sh: adding tests for using floating point numbers in thresholds
2021-09-24 Bernd Stroessenreuther <booboo@gluga.de>
* check_ssl_cert: --warning and --critical now also accept floating point numbers
2021-09-24 Matteo Corti <corti@precise>
* test/unit_tests.sh (oneTimeSetup): defining TMPDIR if not defined
2021-09-24 Bernd Stroessenreuther <booboo@gluga.de>
* test/unit_tests.sh: adding a test for checking a local CRL file
2021-09-22 Matteo Corti <matteo@corti.li>
* Makefile (dist): make dist does not check the format (just builds the distribution)
2021-09-21 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): converts local CRLs from DER to PEM
* check_ssl_cert (main): does not check renegotiation when checking files
2021-09-17 Bernd Stroessenreuther <booboo@gluga.de>
* test/unit_tests.sh: fixing error with endless ping if IPv6 enabled
2021-09-17 Bernd Stroessenreuther <booboo@gluga.de>
* check_ssl_cert: fixing error with SCT when checking a CRL file
2021-09-17 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (testPrometheus): added test for --prometheus
* check_ssl_cert: Adding output for Prometheus
2021-09-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert (critical): Applied a patch to fix the output of multiple errors
* check_ssl_cert (main): Automatically assume localhost if --file is specified
2021-09-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (usage): Added an option to ignore OCSP server errors
* check_ssl_cert (check_ocsp): Fixed the detection of an internal error
2021-09-02 Matteo Corti <matteo@corti.li>
* check_ssl_cert (hours_until): computes the date with dconv if date -f is missing
2021-09-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): detects old BSD date without -f
2021-08-31 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): added -crlf to the connection for the renegotiation test
2021-08-27 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): skipping the CN check on IP addresses
2021-08-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): small improvement in the verbose output of SSL Labs
2021-08-25 Matteo Corti <matteo@corti.li>
* README.md: Info about quoting *
2021-08-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert (parse_command_line_options): do not delete COMMON_NAME by --file
2021-08-18 Matteo Corti <matteo@corti.li>
* check_ssl_cert (parse_command_line_options): Fixed the debugging output by the command line arguments splitting
2021-08-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Support DANE TLSA 312
2021-08-13 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (testMultipleAltNamesOK): Added a test for multiple --cn and OK status
* check_ssl_cert (parse_command_line_options): Fixed the -n option (the old value was overwritten each time)
* check_ssl_cert (main): Better validation of the host command line argument
2021-07-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert: performance data is no more shown by critical and warning message when --no-perf is specified
2021-06-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert: removes the file name from file(1) output
2021-06-18 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): stop the SSL Labs checks after an error
2021-06-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): show the progress in % by SSL labs
* check_ssl_cert (check_attr): removing unnecessary port probing with nmap
2021-05-31 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_cert_end_date): Display since how many days the certificate was valid
2021-05-28 Igor Mironov <mcs6502-sek@yahoo.com.au>
* check_ssl_cert: compatibility fixes for LibreSSL 2.8.3 on macOS Catalina
2021-05-21 Matteo Corti <matteo@corti.li>
* check_ssl_cert: added the --debug-file option
* check_ssl_cert(check_ocsp): append .crt to the debug certificates
* check_ssl_cert: sanity checks for file write operations
2021-05-07 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_ocsp): Do not store the debugging copy of the certificate in the $TMPDIR
2021-05-06 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Fixed an error in the parameter validation
2021-05-05 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): do not wait if SSL Labs is giving an error
2021-04-30 Matteo Corti <matteo@corti.li>
* Makefile: avoid putting extended attribute files in the archives
2021-04-29 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Do not remove parenthesis from URI
2021-04-29 Claus-Theodor Riegg (https://github.com/ctriegg-mak)
* check_ssl_cert: match underscores in subdomains when matching name to wildcard certs
2021-04-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): adds and option to remove performance data
2021-04-23 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): Better handling of timeouts
2021-04-12 Matteo Corti <matteo@corti.li>
* check_ssl_cert (critical): Fixed the output when the CN is not available
2021-04-07 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): adding -starttls to the renegotiation check if needed
2021-04-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert: The host name must now always match with the certificate
* check_ssl_cert: (fetch_certificate): Fixed the errors messages (and added a new one for missing STARTTLS)
2021-03-31 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Added the --resolve option
2021-03-29 Matteo Corti <matteo@corti.li>
* check_ssl_cert: All the verbose messages are not beginning with a lowercase letter
* check_ssl_cert: Added the possibility to have different verbose and debug levels
* check_ssl_cert: Cleaner verbose output
* check_ssl_cert: Short options can now be grouped
2021-03-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): Better error handling in case a TLS connection is not possible
2021-03-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert (usage): adds a --all option to allow all the optional checks at the maximum level
2021-03-22 Matteo Corti <corti@matteo.ethz.ch>
* check_ssl_cert (fetch_certificate): detecting a timeout on the OpenSSL level
2021-03-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (openssl_version): works on systems which add a string to the OpenSSL version output (+ several fixes)
2021-03-14 Matteo Corti <matteo@corti.li>
* check_ssl_cert (openssl_version): added a function to compare OpenSSL versions. Getting rid of the man dependency
2021-03-12 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): fixing timeout on systems using 'timeout'
2021-03-12 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): reducing the total timeout by each execution
* check_ssl_cert (check_attr): check ciphers with nmap
* check_ssl_cert (check_ocsp): looping over all the supplied URIs
2021-03-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Setting GZIP to quiet (-q) before using man
2021-03-10 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Improved renegotiation testing
* check_ssl_cert (fetch_certificate): Added --password to specify a password source for PCKS12 certificates
2021-03-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Added missing processing of the --inetproto option
* check_ssl_cert (main): Added a sanity check for the protocol support of s_client
* check_ssl_cert (check_ocsp): skipping empty certificates
* check_ssl_cert (fetch_certificate): supporting local files in PKCS #12 and DER formats
* check_ssl_cert (main): Using grep -F when possible
2021-02-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Do not check SCTs if the certificate is self signed
2021-02-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): fixed the SCT check
2021-02-24 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Check for TLS renegotiation
2021-02-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Do not reset $OPENSSL so that a different
OpenSSL version can be specified with the environment variable
2021-02-17 Robin Pronk <robin.pronk@nedap.com>
* check_ssl_cert: Make HTTP request URL configurable (default stays /)
2021-02-05 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Adds a check for grep (to check if basic utilities are in the PATH)
2021-01-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Checks for signed certificate timestamps (SCTs)
* check_ssl_cert (fetch_certificate): Better error catching for s_client errors
2021-01-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert (hours_until): Warning about BusyBox date dropping the time zone
2021-01-26 Matteo Corti <corti@matteo.ethz.ch>
* check_ssl_cert: added --date to specify the date binary
* check_ssl_cert (hours_until): support for BusyBox date
2021-01-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): Better handling of wait and kill output
2021-01-18 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): Execute timeout in the background so that it can handle signals
* check_ssl_cert (fetch_certificate): Better error message for DH with a too small key and handshake failure
* check_ssl_cert (check_crl): Checks revocation via CRL
2021-01-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_ocsp): OCSP check on all the chain elements
2021-01-14 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): retries when SSL Labs is running at full capacity
2020-12-23 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): - instead of _ to separate words in the command line options
2020-12-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): added the --no-proxy option
2020-12-21 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): added a sanity check for the -f option
* check_ssl_cert (main): better handling of certificates without CN
2020-12-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): fixed the regex for the proxy cleanup for s_client
2020-12-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (require_s_client_option): Checks if s_client supports the -no_ssl[23] options
* check_ssl_cert (main): Better filtering of the nmap output
2020-12-11 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Corrected the handling of the issuer URI
2020-12-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Correct handling of -proxy by s_client and --proxy by curl
2020-11-30 Matteo Corti <matteo@corti.li>
* check_ssl_cert (create_temporary_file): bug fix: temp directory not used
* check_ssl_cert: patch for the --element option
* check_ssl_cert: bug fix: force -4 or -6 with curl when specified
2020-08-07 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed a bug with the output of --version
2020-07-24 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): Fixed a bug in the output with --not-issued-by
2020-07-02 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): MySQL support
2020-07-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Adding support for better file(1) certificate parsing
2020-06-12 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Fixed a problem on BSD in the processing of the issuers
* check_ssl_cert (debuglog): [DBG] prefix for all the lines
2020-06-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert: fixed a bug in the output (expiration date of chain elements)
2020-06-05 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): support for s_client -proxy option
2020-06-04 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Processes all the certificates in the chain
* check_ssl_cert: New option to check that the issuer does not match a given pattern
2020-05-18 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Propagates the -6 switch to nmap
2020-03-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): show command line arguments in debug mode
2020-03-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): new option (--not-valid-longer-than) to check if a certificate is valid longer than the specified number of days
2020-02-17 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): added support for xmpp-server in the STARTTLS negotiation
2020-01-07 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): option to force HTTP/2
2019-12-23 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): better error message in case of connection refused
2019-12-20 Matteo Corti <matteo@corti.li>
* check_ssl_cert: better error message in case of an invalid host
2019-11-04 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): fixed a bug in the SMTP connection (using s_client -name)
* check_ssl_cert (main): -name only used with OpenSSL versions which supports it
2019-10-31 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): the return value of the command is no more ignored from expect
2019-10-29 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Merged a patch fixing a copy and paste error with sieve
2019-10-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): Better handling of timeout return codes
2019-10-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Better error message for non matching DANE records
* check_ssl_cert (main): Default ports for other protocols
2019-10-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_required_prog): fixed a couple of small issues and introduced a feature to specify the dig binary
2019-10-22 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Fixed a bug printing both a critical and a warning message when both condition match
2019-10-18 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Fixed a bug ignoring --dane without parameters
2019-10-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Integrated the DANE checks
2019-10-14 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): Remove RSA-PSS if not TLS 1.3 requested
* check_ssl_cert (check_attr): Write the OCSP issuer cert to the temporary directory
2019-10-10 Matteo Corti <corti@Matteo-Cortis-Mac-mini.local>
* check_ssl_cert (main): do not disable TLS 1.3 if --rsa is specified
2019-10-10 Matteo Corti <matteo@corti.li>
* check_ssl_cert (main): fixes the ciphers for --rsa and --ecdsa
2019-10-10 Matteo Corti <matteo@corti.li>
* check_ssl_cert (check_attr): a wildcard certificate does not match the 'main' domain
2019-10-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert: disables TLS 1.3 with --rsa
* check_ssl_cert: Validate OCSP stapling expiring date
2019-09-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert: stops if needed programs are not found
2019-09-24 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed a bug in the processing of the SSL Labs options
* check_ssl_cert: Fixed a bug with POP3S
2019-09-24 Matteo Corti <matteo@corti.li>
* check_ssl_cert: OCSP check does not trigger an additional s_client call
2019-09-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed a problem in the critical output
2019-09-18 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Consolidated the error messages in case of more than one error
* check_ssl_cert: Fixed a bug where the cipher was not forced by the OCSP checks
2019-08-09 Matteo Corti <matteo@corti.li>
* check_ssl_cert (ascii_grep): Removed NULL characters before 'grepping' a file
* check_ssl_cert (critical): Display the CN in a critical or warning message (if present)
* check_ssl_cert: merged patch to choose the IP protocol version
2019-08-08 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Applied patch to support LDAPS
* check_ssl_cert.1: Formatting and ordering
2019-07-26 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Try to detect if LDAP is not supported
2019-06-02 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Return the filename when using --file by warnings
2019-03-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert: added an option to specify a user agent for curl
2019-02-27 Matteo Corti <matteo@corti.li>
* test/unit_tests.sh (testMultipleAltNamesFailTwo): removed outdated tests
2019-02-27 Matteo Corti <matteo@corti.li>
* check_ssl_cert: better error message in case of wrong intermediate certificate
2019-02-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Better error message in case of OCSP failure
2019-02-08 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Check the readability of the certificate file
2019-02-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert: applied patch for the SSLlabs warning
2019-01-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert: replaced echo -e with printf
2018-12-24 Matteo Corti <corti@macmini.home>
* check_ssl_cert: Better output in case of errors while using SNI
2018-12-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Better help about IMAP IMAPS POP3 and POP3S
* check_ssl_cert: Support for SNI and SSL Labs
2018-12-11 Matteo Corti <corti@macmini.home>
* check_ssl_cert: Differentiate IMAP with STARTTLS on port 143 and IMAPS on 993
* check_ssl_cert: Fixed a vulnerability in the parsing of the certificate issuer
2018-11-07 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed a problem with IMAP on port 993
* check_ssl_cert: fixed a problem with newlines in the HTTP request
2018-11-05 Matteo Corti <matteo@corti.li>
* check_ssl_cert: CA file and directory support
2018-10-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed the HTTP request string
2018-10-18 eimamagi <https://github.com/eimamagi>
* check_ssl_cert: Allow to specify a client certificate key
2018-10-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert (exec_with_timeout): fixed the check on the the return value
2018-08-10 Matteo Corti <matteo@corti.li>
* check_ssl_cert: disabling OCSP checks if no OCSP host is found
2018-07-20 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Applied a patch from Markus Frosch to fix the cleanup of temporary files
2018-07-01 Matteo Corti <matteo@corti.li>
* check_ssl_cert: do not trap on EXIT
* check_ssl_cert: remove temporary file when no signals are trapped
2018-06-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert: fixed a bug in the deletion of temporary files when a signal is caught
2018-06-25 Matteo Corti <matteo@corti.li>
* check_ssl_cert: added a check to require OCSP stapling
2018-04-29 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Removed the SNI name check patch (see #78)
2018-04-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Merged the SNI name check patch
2018-04-17 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Merged the --terse patch, added performance data to the terse output and reordered the help
2018-04-12 Matteo Corti <matteo@corti.li>
* Makefile: Checks if the copyright year is correct. make test is now dependent on make dist
2018-04-06 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Added UTF8 output
2018-04-05 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Added debugging output for curl
2018-03-29 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed a bug introduced in the last version
2018-03-28 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Removed curl dependency when not checking SSL Labs
2018-03-17 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Added support for TLS 1.3
2018-03-06 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed OCSP check with LibreSSL
* check_ssl_cert: Lists the number or default root certificates in debug mode
2018-01-19 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed a bug processing more than one OCSP host
2017-12-15 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Fixed a bug in the specification of the xmpphost parameter
2017-12-14 Matteo Corti <matteo@corti.li>
* check_ssl_cert: Added an option to specify the 'to' attribute of the XMPP stream element
2017-11-29 Wim van Ravesteijn https://github.com/wimvr
* check_ssl_cert: Support for DER encoded CRL files
2017-11-28 Georg https://github.com/gbotti
* check_ssl_cert: added --fingerprint to check the SHA1 fingerprint of the certificate
2017-11-17 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): adding support for -xmpphost if available
2017-11-16 Matteo Corti <matteo@corti.li>
* check_ssl_cert (fetch_certificate): fixing XMPP support