Merge pull request #150 from square/cs/ocsp-aia

Show OCSP servers and issuing certificate URL info in verbose mode

lib/display.go

@@ -66,6 +66,14 @@ Excluded:
 	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedDNSDomains)}}
 {{- end}}
 {{- end}}
+{{- if .OCSPServer}}
+OCSP Server(s):
+	{{wrapWith .Width "\n\t" (join ", " .OCSPServer)}}
+{{- end}}
+{{- if .IssuingCertificateURL}}
+Issuing Certificate URL(s):
+	{{wrapWith .Width "\n\t" (join ", " .IssuingCertificateURL)}}
+{{- end}}
 {{- if .KeyUsage}}
 Key Usage:
 {{- range .KeyUsage | keyUsage}}

lib/encoder.go

@@ -178,24 +178,26 @@ type nameConstraints struct {
 
 // simpleCertificate is a JSON-representable certificate metadata holder.
 type simpleCertificate struct {
-	Alias              string              `json:"alias,omitempty"`
-	SerialNumber       string              `json:"serial"`
-	NotBefore          time.Time           `json:"not_before"`
-	NotAfter           time.Time           `json:"not_after"`
-	SignatureAlgorithm simpleSigAlg        `json:"signature_algorithm"`
-	IsSelfSigned       bool                `json:"is_self_signed"`
-	Subject            simplePKIXName      `json:"subject"`
-	Issuer             simplePKIXName      `json:"issuer"`
-	BasicConstraints   *basicConstraints   `json:"basic_constraints,omitempty"`
-	NameConstraints    *nameConstraints    `json:"name_constraints,omitempty"`
-	KeyUsage           simpleKeyUsage      `json:"key_usage,omitempty"`
-	ExtKeyUsage        []simpleExtKeyUsage `json:"extended_key_usage,omitempty"`
-	AltDNSNames        []string            `json:"dns_names,omitempty"`
-	AltIPAddresses     []net.IP            `json:"ip_addresses,omitempty"`
-	URINames           []string            `json:"uri_names,omitempty"`
-	EmailAddresses     []string            `json:"email_addresses,omitempty"`
-	Warnings           []string            `json:"warnings,omitempty"`
-	PEM                string              `json:"pem,omitempty"`
+	Alias                 string              `json:"alias,omitempty"`
+	SerialNumber          string              `json:"serial"`
+	NotBefore             time.Time           `json:"not_before"`
+	NotAfter              time.Time           `json:"not_after"`
+	SignatureAlgorithm    simpleSigAlg        `json:"signature_algorithm"`
+	IsSelfSigned          bool                `json:"is_self_signed"`
+	Subject               simplePKIXName      `json:"subject"`
+	Issuer                simplePKIXName      `json:"issuer"`
+	BasicConstraints      *basicConstraints   `json:"basic_constraints,omitempty"`
+	NameConstraints       *nameConstraints    `json:"name_constraints,omitempty"`
+	OCSPServer            []string            `json:"ocsp_server,omitempty"`
+	IssuingCertificateURL []string            `json:"issuing_certificate,omitempty"`
+	KeyUsage              simpleKeyUsage      `json:"key_usage,omitempty"`
+	ExtKeyUsage           []simpleExtKeyUsage `json:"extended_key_usage,omitempty"`
+	AltDNSNames           []string            `json:"dns_names,omitempty"`
+	AltIPAddresses        []net.IP            `json:"ip_addresses,omitempty"`
+	URINames              []string            `json:"uri_names,omitempty"`
+	EmailAddresses        []string            `json:"email_addresses,omitempty"`
+	Warnings              []string            `json:"warnings,omitempty"`
+	PEM                   string              `json:"pem,omitempty"`
 
 	// Internal fields for text display. Set - to skip serialize.
 	Width int `json:"-"`
@@ -227,11 +229,13 @@ func createSimpleCertificate(name string, cert *x509.Certificate) simpleCertific
 			Name:  cert.Issuer,
 			KeyID: cert.AuthorityKeyId,
 		},
-		KeyUsage:       simpleKeyUsage(cert.KeyUsage),
-		AltDNSNames:    cert.DNSNames,
-		AltIPAddresses: cert.IPAddresses,
-		EmailAddresses: cert.EmailAddresses,
-		PEM:            string(pem.EncodeToMemory(EncodeX509ToPEM(cert, nil))),
+		KeyUsage:              simpleKeyUsage(cert.KeyUsage),
+		OCSPServer:            cert.OCSPServer,
+		IssuingCertificateURL: cert.IssuingCertificateURL,
+		AltDNSNames:           cert.DNSNames,
+		AltIPAddresses:        cert.IPAddresses,
+		EmailAddresses:        cert.EmailAddresses,
+		PEM:                   string(pem.EncodeToMemory(EncodeX509ToPEM(cert, nil))),
 	}
 
 	uriNames, err := spiffe.GetURINamesFromCertificate(cert)

tests/dump-cert-chain-to-text.t

@@ -131,6 +131,10 @@ Dump a live cert chain (squareup-chain.crt)
   Subject Key ID: D4:17:14:6F:0B:C5:20:A1:D6:FE:21:7E:DC:9E:F8:57:9C:ED:AE:6A
   Authority Key ID: C3:F7:D0:B5:2A:30:AD:AF:0D:91:21:70:39:54:DD:BC:89:70:C7:3A
   Basic Constraints: CA:false
+  OCSP Server(s):
+  \thttp://ocsp.entrust.net (esc)
+  Issuing Certificate URL(s):
+  \thttp://aia.entrust.net/l1m-chain256.cer (esc)
   Key Usage:
   \tDigital Signature (esc)
   \tKey Encipherment (esc)
@@ -162,6 +166,8 @@ Dump a live cert chain (squareup-chain.crt)
   Subject Key ID: C3:F7:D0:B5:2A:30:AD:AF:0D:91:21:70:39:54:DD:BC:89:70:C7:3A
   Authority Key ID: 6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB
   Basic Constraints: CA:true, pathlen:0
+  OCSP Server(s):
+  \thttp://ocsp.entrust.net (esc)
   Key Usage:
   \tCert Sign (esc)
   \tCRL Sign (esc)
@@ -188,6 +194,8 @@ Dump a live cert chain (squareup-chain.crt)
   Subject Key ID: 6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB
   Authority Key ID: 68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D
   Basic Constraints: CA:true, pathlen:1
+  OCSP Server(s):
+  \thttp://ocsp.entrust.net (esc)
   Key Usage:
   \tCert Sign (esc)
   \tCRL Sign (esc)