Adds Certificate Transparency Log Scans to Scan Families #1107
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello CFSSL Maintainers, This PR is a part of the task to integrate scans for Certificate Transparency Logs. I am detailing out the design of the changes with this pull request which adds ability to integrate reports from Certificate Transparency APIs and implements an example scanner using SSLMate's CertSpotter API. Below I detail out my design process and the goals I wanted to achieve along with sample expected responses and future work. This patch also updates
golint
.Goals
The goal of the task is to display a cert transparency report listing certificates issued for a scanned hostname
API Changes & Consumption
cert-verbosity=bool
as a CLI argument for expanding the certificates usingcertinfo
apitoken=string
as a CLI argument to use an API token to use while running a specific scanner from the CT Family.Here are some examples:
CT Scanner Response with default cert verbosity (click arrow to expand)
CT Scanner response with cert-verbose=true (click arrow to expand)
Information reported in each Cert Transparency Scan report
The CFSSL scan of a host from the CT Logs returns a list of issuance object which contain the following fields. These fields are similar to what popular CT Log services like
crt.sh
display when a host name is searched.This PR introduces a new family of scanners called for Certificate Transparency scans which are available from the
-family=CT
argument on thecfssl
command line. Each Scanner interacting with the API service usinghttp
returns anAPIResponseStatus
with the list of issuance objects.Each Scanner implements intermediate structures which are used to marshal/unmarshal the responses from the CT Service APIs before finally packaging them into the
[]CTIssuance
. As an example, I use the SSLMate's CertSpotter API which is available as a rate limited free API and a paid API which uses a Bearer token based authentication to provide the CT Log issuance records.To make the CLI arguments for
cert-verbose=
andapitoken
available, we modify theScan()
method to consider not just theaddr, hostname
but also atoken
andbool
representing the need for a verbose certificate. While these attributes are not used in other scanners, there is a huge potential for them to be used with Issuance objects from multiple CT Log Scanners.As implemented in the
CertSpotterScan
, each request to the API service is asynchronous and passed through channels and goroutines.Handling Error Conditions
If the hostname is not a valid hostname
If the API is Rate Limited
Limitations
-apitoken
is intended to be used with a single-Scanner
and would need to be refactored for multipleapitoken
messages to be passed for all CT Scanners which would need different tokens.-auth
CLI argument which allows passing tokens, or other necessary authentication modes for these services and CFSSL services to be hosted in production.Signed-off-by: Sudheesh Singanamalla [email protected]