github/certigo
4
0
Fork 0
mirror of https://github.com/square/certigo.git synced 2024-04-21 12:32:40 +00:00
Code Issues Releases Wiki Activity
510 Commits 17 Branches 31 Tags
v1.16.0
Commit Graph
510 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
John WoodandGitHub 9a1ff6da3d Update to 1.16 (#275) v1.16.0 2022-06-28 14:59:36 -07:00
John WoodandGitHub 4c8f1c5862 Fix OCSP checking (#274) 
Fixes #272. The root of the problem is that we're asking the wrong OCSP servers. The current code does something like:

leaf, issuers := chain[0], chain[1:]
for _, issuer := range issuers {
  // check for revocation of leaf via issuer.OCSPServer
}

The main problem is that OCSPServer is the URI of the OCSP server for that certificate, and by asking issuer.OCSPServer about leaf, we're requesting OCSP responses from the wrong server. We should be checking leaf.OCSPServer in this example instead of issuer.OCSPServer.

The second problem is that the loop makes no sense. One would not expect any OCSP server in a given chain to be authoritative for a given leaf.

If you do certigo connect google.com, you'll see

Certificate has OCSP extension, but was unable to check status:
	ocsp: error from server: unauthorized

The "unauthorized" means the OCSP server we asked doesn't know anything about the cert we asked about.
 2022-06-28 14:51:03 -07:00
Isaac SemayaandGitHub f81bda15e6 Merge pull request #273 from square/dependabot/go_modules/github.com/stretchr/testify-1.7.5 
Bump github.com/stretchr/testify from 1.7.2 to 1.7.5
 2022-06-24 16:25:04 -07:00
dependabot[bot]andGitHub 55b2ec8d5d Bump github.com/stretchr/testify from 1.7.2 to 1.7.5 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.2 to 1.7.5.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.2...v1.7.5)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-06-24 02:11:25 +00:00
Alberto SantosandGitHub 8772a7a649 Update go command to install certigo (#270) 2022-06-17 12:11:04 -07:00
Isaac SemayaandGitHub 8fad8a0a92 Merge pull request #269 from square/dependabot/go_modules/github.com/stretchr/testify-1.7.2 
Bump github.com/stretchr/testify from 1.7.1 to 1.7.2
 2022-06-13 22:38:37 +01:00
dependabot[bot]andGitHub 37265fa5ec Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.1 to 1.7.2.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.1...v1.7.2)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-06-07 02:10:00 +00:00
John WoodandGitHub b2185d09eb Upgrade yaml.v3 version (#266) 2022-06-06 09:47:52 -07:00
John WoodandGitHub 7ef0417bde Allow any ciphersuite in TestConnect (#268) 2022-06-06 08:47:20 -07:00
John WoodandGitHub 5332ac7ca2 Fix TestConnect on macOS (#265) 
@bdd did an excellent writeup of the issue in #264. To fix this, stop relying on stable error messages between platforms and Go versions by performing a successful certigo connect in the test rather than a failed one.

I generated new ECDSA certificates for localhost using https://github.com/square/certstrap.
 2022-06-01 10:20:03 -07:00
dependabot[bot]GitHubgithubJohn Wood
 		41b5b73f75 Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 (#262) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.7.0 to 1.7.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.7.0...v1.7.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Wood <jwood@squareup.com>
 2022-03-24 12:02:18 -07:00
Seth TheriaultGitHubJohn Wood
 		3a9d341427 Bump version string to 1.15.1 (#263) 
Co-authored-by: John Wood <jwood@squareup.com>
v1.15.1 		2022-03-24 11:31:14 -07:00
John WoodandGitHub f8a8c1f06a Remove use of the format list in the connect command (#260) v1.15.0 2022-02-24 12:40:07 -08:00
Isaac SemayaandGitHub d167b5f48d Merge pull request #256 from square/isemaya/add-leaf-flag-first-cert 
Add flag to view the first cert only, including for json and pem
 2022-02-23 16:45:22 -08:00
Isaac Semaya 328db64fa0 Add --leaf flag to view the first cert only, including for json and pem 
added dump-pkcs12-chain-to-pem.t to contrast with dump-pkcs12-chain-to-pem-first-only and show that multiple pem blocks are dumped without the --first flag.t
 2022-02-23 16:44:05 -08:00
John WoodandGitHub 9e92473320 Set certs explicitly (#259) 2022-02-23 13:02:49 -08:00
John WoodandGitHub 2027dabecf Upgrade /x/crypto dependency (#257) 2022-02-23 12:20:11 -08:00
John WoodandGitHub 8f0d49f5b3 Don't check OCSP if there are no OCSP servers in the chain (#255) 2022-02-09 10:07:55 -08:00
John WoodandGitHub dc9943e20c Bump version string to 1.14.1 (#254) v1.14.1 2022-01-11 10:51:04 -08:00
klyubinandGitHub 1081a17c66 Add missing flags in usage in README.md (#253) 
This is a follow-up to ba10cd1db7
where I forgot to update the usage in README. This commit adds
not only the new flag introduced in ba10cd1db7
but also the missing flags from older changes.
v1.14.0 		2022-01-11 10:32:01 -08:00
klyubinandGitHub ba10cd1db7 Add support for verifying server certs against SPIFFE IDs (#252) 
Add support for verifying server certs against SPIFFE IDs

This adds support to "certigo connect" to verify that the
server presented a certificate for a specific hostname or
SPIFFE ID. This name can now be unrelated to the hostname
to connect to and the Server Name Indication (SNI) to send
to the server during the TLS handshake.

Prior to this commit, the name expected in the certificate
could only be a hostname, specified either via --name (SNI)
or the hostname to connect to. SPIFFE IDs -- URLs with
"spiffe" as the scheme -- are not useful as hostnames or
SNIs. As a result, this commit adds a new --expected-name
switch to certigo connect. This override provides full
control over what name to expect in the server certificate
presented during the TLS handshake. For example, this name
can now be different from the hostname connected to and the
name specified in Server Name Indication (SNI). Moreover,
if --expected-name is a URL with "spiffe" scheme, it is
only matched against Subject Alternative Names of type URI,
as per the SPIFFE spec.
v1.14.0-test.1 		2022-01-10 15:57:47 -08:00
Benjamin KaneandGitHub 2b1f74f2cb Allow certigo -h (#251) 2021-12-04 12:06:09 -08:00
John WoodandGitHub 4032ab142c Add the Ed25519 algo to the list of known algo names (#250) 2021-11-30 15:19:09 -08:00
Mat ByczkowskiandGitHub 44a8bce78f Merge pull request #249 from square/mbyczkowski-patch-1 
Bump version to 1.13.0
v1.13.0 v1.13.0-rc.1 		2021-11-29 12:09:31 -08:00
Mat ByczkowskiandGitHub 3eead6f4d1 Bump version to 1.13.0 2021-11-29 12:01:35 -08:00
Mat ByczkowskiandGitHub beea3f9bc3 Merge pull request #248 from square/add-release-action 
Add automatic draft releases on tagged builds
 2021-11-29 11:59:46 -08:00
Mat Byczkowski 2d7ca581c2 Add automatic draft releases on tagged builds 
We had these on for Travis CI builds, so this should bring that
functionatliy back to GH Actions builds.
v1.13.0-test.2 		2021-11-29 11:54:24 -08:00
Mat ByczkowskiandGitHub 23e3e9c790 Merge pull request #247 from square/dependabot/go_modules/github.com/mattn/go-colorable-0.1.12 
Bump github.com/mattn/go-colorable from 0.1.11 to 0.1.12
 2021-11-29 11:27:01 -08:00
dependabot[bot]andGitHub 6de98ab57c Bump github.com/mattn/go-colorable from 0.1.11 to 0.1.12 
Bumps [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) from 0.1.11 to 0.1.12.
- [Release notes](https://github.com/mattn/go-colorable/releases)
- [Commits](https://github.com/mattn/go-colorable/compare/v0.1.11...v0.1.12)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-colorable
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-11-24 02:13:21 +00:00
Mat ByczkowskiandGitHub eb0d9f461b Merge pull request #245 from square/mbyczkowski/add-gha 
Configure GH Actions
 2021-10-11 16:17:39 -07:00
Mat ByczkowskiandGitHub 620ecc63da Merge pull request #246 from square/mbyczkowski-patch-1 
Add CODEOWNERS file
 2021-10-11 16:17:28 -07:00
Mat ByczkowskiandGitHub 2da7d3a554 Add CODEOWNERS file 2021-10-11 15:56:57 -07:00
Mat Byczkowski dd20d54fbb Set-up GH Actions for CI 2021-10-11 15:54:54 -07:00
Mat Byczkowski c0f8ce4c9c Remove Travis CI 2021-10-11 15:54:54 -07:00
Mat ByczkowskiandGitHub 58f1537bd2 Merge pull request #244 from square/dependabot/go_modules/github.com/mattn/go-colorable-0.1.11 
Bump github.com/mattn/go-colorable from 0.1.8 to 0.1.11
 2021-10-11 15:19:06 -07:00
dependabot[bot]andGitHub 93f7a5986c Bump github.com/mattn/go-colorable from 0.1.8 to 0.1.11 
Bumps [github.com/mattn/go-colorable](https://github.com/mattn/go-colorable) from 0.1.8 to 0.1.11.
- [Release notes](https://github.com/mattn/go-colorable/releases)
- [Commits](https://github.com/mattn/go-colorable/compare/v0.1.8...v0.1.11)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-colorable
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-10-11 22:16:12 +00:00
Mat ByczkowskiandGitHub 67d1e70e65 Merge pull request #242 from square/dependabot/go_modules/github.com/fatih/color-1.13.0 
Bump github.com/fatih/color from 1.12.0 to 1.13.0
 2021-10-11 15:15:01 -07:00
dependabot[bot]andGitHub 1e9d95be5b Bump github.com/fatih/color from 1.12.0 to 1.13.0 
Bumps [github.com/fatih/color](https://github.com/fatih/color) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/fatih/color/releases)
- [Commits](https://github.com/fatih/color/compare/v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/fatih/color
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-09-22 02:10:55 +00:00
Mat ByczkowskiandGitHub ff8636de0a Merge pull request #236 from square/mbyczkowski-patch-1 
Bump Go version
list v1.12.2-rc.1 		2021-07-28 10:27:15 -07:00
Mat Byczkowski c296587ca6 Bump Go version 2021-07-27 18:27:11 -07:00
Mat ByczkowskiandGitHub f28bcb2ecb Merge pull request #232 from square/dependabot/go_modules/github.com/fatih/color-1.12.0 
Bump github.com/fatih/color from 1.10.0 to 1.12.0
 2021-07-27 18:23:38 -07:00
dependabot[bot]andGitHub 93d5548183 Bump github.com/fatih/color from 1.10.0 to 1.12.0 
Bumps [github.com/fatih/color](https://github.com/fatih/color) from 1.10.0 to 1.12.0.
- [Release notes](https://github.com/fatih/color/releases)
- [Commits](https://github.com/fatih/color/compare/v1.10.0...v1.12.0)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-07-28 01:19:26 +00:00
Mat ByczkowskiandGitHub 214780665e Merge pull request #235 from elyscape/fix-postgres-panic 
Avoid nil deref when using Postgres StartTLS
 2021-07-27 18:18:22 -07:00
Eli Young 1f83e9e088 Add missing module checksum 2021-07-15 13:10:08 -07:00
Eli Young 908eebe3d9 Avoid nil deref when using Postgres StartTLS 
Fixes #234
 2021-07-15 13:04:33 -07:00
Mat ByczkowskiandGitHub aea8d76741 Merge pull request #230 from square/dependabot/add-v2-config-file 
Upgrade to GitHub-native Dependabot
 2021-05-10 14:08:51 -07:00
dependabot-preview[bot]andGitHub c568ffefff Upgrade to GitHub-native Dependabot 2021-04-29 15:17:50 +00:00
Mat ByczkowskiandGitHub 6b5d52f4d9 Merge pull request #228 from square/dependabot/go_modules/github.com/stretchr/testify-1.7.0 
Bump github.com/stretchr/testify from 1.6.1 to 1.7.0
 2021-04-26 09:55:08 -07:00
dependabot-preview[bot]andGitHub f494a7a5f2 Bump github.com/stretchr/testify from 1.6.1 to 1.7.0 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.6.1 to 1.7.0.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.6.1...v1.7.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2021-01-14 05:37:36 +00:00
Mat ByczkowskiandGitHub 27b80f54cd Merge pull request #227 from square/dependabot/go_modules/github.com/fatih/color-1.10.0 
Bump github.com/fatih/color from 1.9.0 to 1.10.0
 2020-11-05 21:42:31 -08:00