github/certigo
4
0
Fork 0
mirror of https://github.com/square/certigo.git synced 2024-04-21 12:32:40 +00:00
Code Issues Releases Wiki Activity
530 Commits 17 Branches 31 Tags
master
Commit Graph
530 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mat ByczkowskiandGitHub b78a846ab9 Merge pull request #303 from square/dependabot/go_modules/github.com/stretchr/testify-1.8.2 
Bump github.com/stretchr/testify from 1.8.0 to 1.8.2
 2023-03-02 12:53:34 -08:00
dependabot[bot]andGitHub 4dee94d5a2 Bump github.com/stretchr/testify from 1.8.0 to 1.8.2 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.0 to 1.8.2.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.8.0...v1.8.2)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-02-27 03:12:40 +00:00
Violet DongandGitHub eeeebda27a Merge pull request #301 from square/violet/update_cism_to_cryptid 
update cism to cryptographic-identity
 2023-02-14 12:41:07 -05:00
Violet Dong 4956ed199e update cism to cryptographic-identity 2023-02-10 11:53:28 -05:00
John WoodandGitHub abfe56fea8 Fetch latest CT log info (#297) 2022-11-17 13:10:15 -08:00
Isaac SemayaandGitHub 5d695f622f Merge pull request #296 from square/dependabot/go_modules/github.com/google/certificate-transparency-go-1.1.4 
Bump github.com/google/certificate-transparency-go from 1.1.3 to 1.1.4
 2022-10-24 10:15:24 -07:00
dependabot[bot]andGitHub b17c2a8ea9 Bump github.com/google/certificate-transparency-go from 1.1.3 to 1.1.4 
Bumps [github.com/google/certificate-transparency-go](https://github.com/google/certificate-transparency-go) from 1.1.3 to 1.1.4.
- [Release notes](https://github.com/google/certificate-transparency-go/releases)
- [Changelog](https://github.com/google/certificate-transparency-go/blob/master/CHANGELOG.md)
- [Commits](https://github.com/google/certificate-transparency-go/compare/v1.1.3...v1.1.4)

---
updated-dependencies:
- dependency-name: github.com/google/certificate-transparency-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-10-24 02:12:08 +00:00
Cedric StaubandGitHub 75f2ec06b4 Switch to using SSLMate's PKCS#12 library (#293) 2022-09-21 10:36:59 -07:00
John WoodandGitHub 44210f297c Remove ioutil (#289) 2022-08-11 10:59:59 -07:00
John Wood 3041543f46 Move to Go 1.19 2022-08-09 12:41:02 -07:00
John ShiehGitHubJohn WoodSven Wick
 		eea7ad61c3 Add zlint support (#286) 
Co-authored-by: John Wood <jwood@squareup.com>
Co-authored-by: Sven Wick <sven.wick@gmx.de>
 2022-08-01 12:01:38 -06:00
Mat ByczkowskiandGitHub 76eddf7ad9 Merge pull request #284 from vaporup/patch-1 
Update README.md
 2022-07-22 12:38:34 -07:00
Sven WickandGitHub a6e3354dc8 Update README.md 
Remove leading whitespace
 2022-07-19 15:45:34 +02:00
John WoodandGitHub 79f1ecf29f Unconditionally add forward slash in OCSP GET requests (#282) 2022-07-01 13:41:01 -07:00
Isaac SemayaandGitHub 4e0e518444 Merge pull request #278 from square/dependabot/go_modules/github.com/stretchr/testify-1.8.0 
Bump github.com/stretchr/testify from 1.7.5 to 1.8.0
 2022-06-30 16:36:45 -07:00
Isaac SemayaandGitHub 9c39690e9b Merge branch 'master' into dependabot/go_modules/github.com/stretchr/testify-1.8.0 2022-06-30 16:29:25 -07:00
John WoodandGitHub 0a56dcc30e Use Go generate instead of a makefile (#279) 
* Use Go generate instead of a makefile

* Meet the go generate specifications
 2022-06-30 11:09:52 -07:00
dependabot[bot]andGitHub f7e8197bdd Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.5 to 1.8.0.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.5...v1.8.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-06-30 02:15:56 +00:00
John WoodandGitHub 37a41318ba Add support for printing SCTs (#277) 
* Address PR comments
 2022-06-29 17:35:59 -07:00
John WoodandGitHub 3871aa0f39 Update Go version to 1.18 (#276) 
* Update Go version

* Remove unsupported SHA1 cert test
 2022-06-28 17:49:00 -07:00
John WoodandGitHub 9a1ff6da3d Update to 1.16 (#275) v1.16.0 2022-06-28 14:59:36 -07:00
John WoodandGitHub 4c8f1c5862 Fix OCSP checking (#274) 
Fixes #272. The root of the problem is that we're asking the wrong OCSP servers. The current code does something like:

leaf, issuers := chain[0], chain[1:]
for _, issuer := range issuers {
  // check for revocation of leaf via issuer.OCSPServer
}

The main problem is that OCSPServer is the URI of the OCSP server for that certificate, and by asking issuer.OCSPServer about leaf, we're requesting OCSP responses from the wrong server. We should be checking leaf.OCSPServer in this example instead of issuer.OCSPServer.

The second problem is that the loop makes no sense. One would not expect any OCSP server in a given chain to be authoritative for a given leaf.

If you do certigo connect google.com, you'll see

Certificate has OCSP extension, but was unable to check status:
	ocsp: error from server: unauthorized

The "unauthorized" means the OCSP server we asked doesn't know anything about the cert we asked about.
 2022-06-28 14:51:03 -07:00
Isaac SemayaandGitHub f81bda15e6 Merge pull request #273 from square/dependabot/go_modules/github.com/stretchr/testify-1.7.5 
Bump github.com/stretchr/testify from 1.7.2 to 1.7.5
 2022-06-24 16:25:04 -07:00
dependabot[bot]andGitHub 55b2ec8d5d Bump github.com/stretchr/testify from 1.7.2 to 1.7.5 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.2 to 1.7.5.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.2...v1.7.5)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-06-24 02:11:25 +00:00
Alberto SantosandGitHub 8772a7a649 Update go command to install certigo (#270) 2022-06-17 12:11:04 -07:00
Isaac SemayaandGitHub 8fad8a0a92 Merge pull request #269 from square/dependabot/go_modules/github.com/stretchr/testify-1.7.2 
Bump github.com/stretchr/testify from 1.7.1 to 1.7.2
 2022-06-13 22:38:37 +01:00
dependabot[bot]andGitHub 37265fa5ec Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.1 to 1.7.2.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.1...v1.7.2)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-06-07 02:10:00 +00:00
John WoodandGitHub b2185d09eb Upgrade yaml.v3 version (#266) 2022-06-06 09:47:52 -07:00
John WoodandGitHub 7ef0417bde Allow any ciphersuite in TestConnect (#268) 2022-06-06 08:47:20 -07:00
John WoodandGitHub 5332ac7ca2 Fix TestConnect on macOS (#265) 
@bdd did an excellent writeup of the issue in #264. To fix this, stop relying on stable error messages between platforms and Go versions by performing a successful certigo connect in the test rather than a failed one.

I generated new ECDSA certificates for localhost using https://github.com/square/certstrap.
 2022-06-01 10:20:03 -07:00
dependabot[bot]GitHubgithubJohn Wood
 		41b5b73f75 Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 (#262) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.0 to 1.7.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.0...v1.7.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Wood <jwood@squareup.com>
 2022-03-24 12:02:18 -07:00
Seth TheriaultGitHubJohn Wood
 		3a9d341427 Bump version string to 1.15.1 (#263) 
Co-authored-by: John Wood <jwood@squareup.com>
v1.15.1 		2022-03-24 11:31:14 -07:00
John WoodandGitHub f8a8c1f06a Remove use of the format list in the connect command (#260) v1.15.0 2022-02-24 12:40:07 -08:00
Isaac SemayaandGitHub d167b5f48d Merge pull request #256 from square/isemaya/add-leaf-flag-first-cert 
Add flag to view the first cert only, including for json and pem
 2022-02-23 16:45:22 -08:00
Isaac Semaya 328db64fa0 Add --leaf flag to view the first cert only, including for json and pem 
added dump-pkcs12-chain-to-pem.t to contrast with dump-pkcs12-chain-to-pem-first-only and show that multiple pem blocks are dumped without the --first flag.t
 2022-02-23 16:44:05 -08:00
John WoodandGitHub 9e92473320 Set certs explicitly (#259) 2022-02-23 13:02:49 -08:00
John WoodandGitHub 2027dabecf Upgrade /x/crypto dependency (#257) 2022-02-23 12:20:11 -08:00
John WoodandGitHub 8f0d49f5b3 Don't check OCSP if there are no OCSP servers in the chain (#255) 2022-02-09 10:07:55 -08:00
John WoodandGitHub dc9943e20c Bump version string to 1.14.1 (#254) v1.14.1 2022-01-11 10:51:04 -08:00
klyubinandGitHub 1081a17c66 Add missing flags in usage in README.md (#253) 
This is a follow-up to ba10cd1db7
where I forgot to update the usage in README. This commit adds
not only the new flag introduced in ba10cd1db7
but also the missing flags from older changes.
v1.14.0 		2022-01-11 10:32:01 -08:00
klyubinandGitHub ba10cd1db7 Add support for verifying server certs against SPIFFE IDs (#252) 
Add support for verifying server certs against SPIFFE IDs

This adds support to "certigo connect" to verify that the
server presented a certificate for a specific hostname or
SPIFFE ID. This name can now be unrelated to the hostname
to connect to and the Server Name Indication (SNI) to send
to the server during the TLS handshake.

Prior to this commit, the name expected in the certificate
could only be a hostname, specified either via --name (SNI)
or the hostname to connect to. SPIFFE IDs -- URLs with
"spiffe" as the scheme -- are not useful as hostnames or
SNIs. As a result, this commit adds a new --expected-name
switch to certigo connect. This override provides full
control over what name to expect in the server certificate
presented during the TLS handshake. For example, this name
can now be different from the hostname connected to and the
name specified in Server Name Indication (SNI). Moreover,
if --expected-name is a URL with "spiffe" scheme, it is
only matched against Subject Alternative Names of type URI,
as per the SPIFFE spec.
v1.14.0-test.1 		2022-01-10 15:57:47 -08:00
Benjamin KaneandGitHub 2b1f74f2cb Allow certigo -h (#251) 2021-12-04 12:06:09 -08:00
John WoodandGitHub 4032ab142c Add the Ed25519 algo to the list of known algo names (#250) 2021-11-30 15:19:09 -08:00
Mat ByczkowskiandGitHub 44a8bce78f Merge pull request #249 from square/mbyczkowski-patch-1 
Bump version to 1.13.0
v1.13.0 v1.13.0-rc.1 		2021-11-29 12:09:31 -08:00
Mat ByczkowskiandGitHub 3eead6f4d1 Bump version to 1.13.0 2021-11-29 12:01:35 -08:00
Mat ByczkowskiandGitHub beea3f9bc3 Merge pull request #248 from square/add-release-action 
Add automatic draft releases on tagged builds
 2021-11-29 11:59:46 -08:00
Mat Byczkowski 2d7ca581c2 Add automatic draft releases on tagged builds 
We had these on for Travis CI builds, so this should bring that
functionatliy back to GH Actions builds.
v1.13.0-test.2 		2021-11-29 11:54:24 -08:00
Mat ByczkowskiandGitHub 23e3e9c790 Merge pull request #247 from square/dependabot/go_modules/github.com/mattn/go-colorable-0.1.12 
Bump github.com/mattn/go-colorable from 0.1.11 to 0.1.12
 2021-11-29 11:27:01 -08:00
dependabot[bot]andGitHub 6de98ab57c Bump github.com/mattn/go-colorable from 0.1.11 to 0.1.12 
Bumps [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) from 0.1.11 to 0.1.12.
- [Release notes](https://github.com/mattn/go-colorable/releases)
- [Commits](https://github.com/mattn/go-colorable/compare/v0.1.11...v0.1.12)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-colorable
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-11-24 02:13:21 +00:00
Mat ByczkowskiandGitHub eb0d9f461b Merge pull request #245 from square/mbyczkowski/add-gha 
Configure GH Actions
 2021-10-11 16:17:39 -07:00