getcert

#!/bin/bash

# Copyright (C) 2017,2020, 2023 Timothe Litt, litt _at__ acm ddot org
#
# Get SSL/TLS certificate from a server

#shellcheck disable=SC2016
VERSION='$Id$'

SELF="$(basename "$0")"

PORT=
CA="$SSL_CERT_FILE"
[ -z "$CA" ] && CA="$CURL_CA_BUNDLE"
[ -z "$CA" ] && CA="/etc/pki/tls/certs/ca_bundle.pem"
DUMP="cat"
ALL=
CTYPE=
STARTTLS=
OUTPUT=
PROTO=
FOUNDCERT=
IDENT=
IPVER=

function version() {
    local ID="$1"
    if [[ "$ID" =~ [[:xdigit:]]{24}([[:xdigit:]]{4})([[:xdigit:]]{4})([[:xdigit:]]{4})([[:xdigit:]]{4}) ]]; then
        printf "%s-%s-%s-%s" "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}" "${BASH_REMATCH[4]}"
    else
        printf "%s" "$ID"
    fi
}

function usage() {
    cat <<EOF
Usage: $SELF [-aCcdophs] server[:port]

 Get SSL/TLS certificate from server & output as PEM
 Version $(version "$VERSION")

 Options:
  4             Only use IPv4
  6             Only use IPv6
  a             Report all certificates (including intermediates)
  C: bundle     CA bundle file for verification
  c: type       Type of certificate to request (dual certificate hosts)
  d             Decode certificate (as well as PEM)
  i             Include minimal identifying information with PEM
  o FILE        Output to FILE (default is stdout)
  p: port       Port number for connection (or use server:port)
  s: proto      STARTTLS for proto: one of smtp, pop3, imap, ftp
  t: tlsver     TLS version: ssl, 1, 1.1, 1.2, 1.3

 Establishes an SSL/TLS connection to the specified server and obtains
 the server's X.509 certificate.  The certificate (in PEM) format is
 written to stdout (or FILE), optionally with text decoding.

 The PEM output (with or without -i) is suitable for input to any
 OpenSSL tool and most applications that require certificates.  Those
 that don't ignore text outside the PEM blocks will reject input
 with the information added by -i.

 See ssl_info if more complete (but less cryptic/cluttered than OpenSSL's)
 information about the certificate/connection is desired.

 When working with dual-certificate servers, use -c RSA and -c ECDSA to
 select the desired certificate.

 Requires: OpenSSL

See LICENSE for license.
EOF
    exit 1;
}

while getopts "46aC:c:dhio:p:s:t:" opt; do
    case "$opt" in
        4)
            IPVER="-4"
            ;;
        6)
            IPVER="-6"
            ;;
        a)
            ALL="-showcerts"
            ;;
        C)
            CA="$OPTARG"
            ;;
        c)
            CTYPE="$OPTARG"
            ;;
        d)
            DUMP="openssl x509 -text"
            ;;
        i)
            IDENT="1"
            ;;
        o)
            OUTPUT="$OPTARG"
            ;;
        p)
            PORT="$OPTARG"
            ;;
        s)
            STARTTLS=("-starttls" "$OPTARG")
            ;;
        t)
            case "$OPTARG" in
                ssl) PROTO="-ssl3";;
                1)   PROTO="-tls1";;
                1.1) PROTO="-tls1_1";;
                1.2) PROTO="-tls1_2";;
                1.3) PROTO="-tls1_3";;
                *)
                    echo "$OPTARG: Not ssl, 1, 1.1, 1.2, or 1.3" >&2
                    exit 1;;
            esac
            ;;
        h)
            usage
            ;;
        *)
            echo "$SELF -h for usage" >&2
            exit 1
            ;;
    esac
done
shift $((OPTIND-1))

if [ -n "$CTYPE" ]; then
    if [[ $CTYPE =~ ^(EC|ECDSA|ec|ecdsa)$ ]]; then
        CTYPE="ECDSA+SHA1:ECDSA+SHA224:ECDSA+SHA384:ECDSA+SHA256:ECDSA+SHA512"
    elif [[ $CTYPE =~ ^(RSA|rsa)$ ]]; then
         if openssl list -public-key-algorithms | grep -q "RSA-PSS" ; then
             CTYPE="RSA-PSS+SHA512:RSA-PSS+SHA384:RSA-PSS+SHA256:RSA+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA224:RSA+SHA1"
         else
             CTYPE="RSA+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA224:RSA+SHA1"
         fi
    else
        echo "Unknown certificate type $CTYPE" >&2
        exit 1;
    fi
    CTYPE=(-sigalgs "$CTYPE")
fi

SERVER="$1"
[ -n "$SERVER" ] || usage
shift

if [[ -z "$PORT" &&  "$SERVER" =~ ^([^:]+):([^:]+)$ ]]; then
    SERVER="${BASH_REMATCH[1]}"
    PORT="${BASH_REMATCH[2]}"
fi
[ -z "$PORT" ] && PORT="443"

[ -n "$OUTPUT" ] && exec >"$OUTPUT"

function exit_trap() {
    err="$?"
    if [[ -n "$ERRS" ]]; then
        if [ -z "$FOUNDCERT" ]; then
            if grep -q 'alert handshake failure' "$ERRS"; then
                echo "Unable to establish TLS connection to $SERVER:$PORT with specified parameters" >&22
            else
                local -A seen
                while IFS='' read -r line; do
                    if [[ "$line" =~ ^[0-9]+:([^:]+):[^:]+:[^:]+:([^:]+):([^:]+): ]]; then
                        str="OpenSSL:${BASH_REMATCH[1]}:${BASH_REMATCH[2]}:${BASH_REMATCH[3]}"
                        if [ -z "${seen["$str"]}" ]; then
                            echo "$str" >&22
                           seen["$str"]="1"
                        fi
                    else
                        echo "$line" >&22
                    fi
                done <"$ERRS"
            fi
        fi
        rm -f "$ERRS"
    fi
    exit $err
}
ERRS="$(mktemp 2>/dev/null || mktemp -t ssl_info.XXXXXX)" || exit 3
trap "exit_trap" EXIT
exec 22>&2-
exec 2>"$ERRS"

cmd=("openssl" "s_client")
[ -n "$IPVER" ]          && cmd+=("$IPVER")
cmd+=("-connect" "$SERVER:$PORT" "-servername" "$SERVER")
[ -n "$CA" ]             && cmd+=("-CAfile" "$CA")
[ -n "$ALL" ]            && cmd+=("$ALL")
[ "${#STARTTLS}" -gt 0 ] && cmd+=("${STARTTLS[@]}")
[ "${#CTYPE}" -gt 0 ]    && cmd+=("${CTYPE[@]}")
[ -n "$PROTO" ]          && cmd+=("$PROTO")

nl=$'\n'
begmark="^--+BEGIN( TRUSTED)? CERTIFICATE"
endmark="^--+END"
cert=""
incert=

while IFS='' read -r line ; do
    if [ "$line" = "no peer certificate available" ]; then
        exit 1
    fi
    if [ -n "$incert" ]; then
        if [[ $line =~ $endmark ]]; then
            FOUNDCERT="1"
            [ -n "$IDENT" ] && <<<"$cert$line" openssl x509 -subject -ext subjectAltName -issuer \
                                                            -serial  -enddate -noout | \
                sed -e's/^subject=/Subject: /;s/X509v3 Subject Alternative Name:/  Also : /;s/^issuer=/Issuer : /;s/^serial=/Serial : /;s/^notAfter=/Expires: /'
            <<<"$cert$line" $DUMP
            cert=""
            incert=""
        else
            cert+="$line$nl"
        fi
    elif [[ $line =~ $begmark ]]; then
        incert="1"
        cert="$line$nl"
    fi
done < <("${cmd[@]}" </dev/null )

if [ -n "$FOUNDCERT" ]; then
    exit 0
else
    echo "No certificates were provided by the server" >&2
    exit 1
fi