Skip to main content

(Zwischen-)Zertifikat Key und Zertifikatsrequest per Script auf Plausibilität prüfen

Dieses Script prüft folgende Punkte:

  • mind. 4096 Bit Key
  • Passen CSR, CRT, KEY zusammen (openssl modulus / md5)?
  • Signatur-Hash prüfen
  • Passt das Intermediate-CRT zum CRT

Namenskonvention der Dateien:

  • meine-domain.de.key
  • meine-domain.de.crt
  • meine-domain.de.csr
  • meine-domain.de.intermediates
#!/bin/bash
#
# check if certificate, signing request and key match
#
# $Id: check-certificate.sh 524 2016-01-15 11:30:11Z magenbrot $
# zlFamous added intermediate and key size check
#

if [ "x$1" = "x" ]; then
echo "Usage: $0 <filename without .key, .crt, .csr or .intermediates>"
exit 1
fi

if [ -e $1.key ]; then
output="$1.key: `openssl rsa -noout -modulus -in $1.key | openssl md5 | cut -d" " -f2`"
key_size=`openssl rsa -noout -text -in $1.key | grep "Private-Key" | cut -d" " -f2 | cut -d"(" -f2`
if [ $key_size -lt 4096 ]; then
output="$output \e[39m(key size: \e[33m$key_size\e[39m bit)"
else
output="$output \e[39m(key size: \e[32m$key_size\e[39m bit)"
fi
echo -e $output
else
echo "$1.key: file not found"
fi

if [ -e $1.csr ]; then
echo -n "$1.csr: "
openssl req -noout -modulus -in $1.csr | openssl md5 | cut -d" " -f2
else
echo "$1.csr: file not found"
fi

if [ -e $1.crt ]; then
echo -n "$1.crt: "
openssl x509 -noout -modulus -in $1.crt | openssl md5 | cut -d" " -f2
else
echo "$1.crt: file not found"
fi

if [ -e $1.intermediates ]; then
echo -n "$1.intermediates: "
subject=`openssl x509 -noout -subject_hash -in $1.intermediates`
issuer=`openssl x509 -noout -issuer_hash -in $1.crt`
if [ "$subject" != "" -o "$issuer" != "" ]; then
if [ "$subject" == "$issuer" ]; then
signature=`openssl x509 -noout -text -in $1.intermediates | grep "Signature Algorithm:" | cut -d" " -f7 | head -n1`
echo -e "\e[32missuer matches subject \e[39m- signature hash: \e[32m$signature\e[39m"
else
echo -e "\e[31missuer doesn't match subject"
fi
fi
chown root:root $1.intermediates
chmod 0600 $1.key $1.csr $1.crt $1.intermediates
else
echo "$1.intermediates: file not found"
fi