omniti-labs/reconnoiter — pull request #87 by pamaddox (2012-07-09 21:36:56+00:00)
Title: SSL Corrections

Three changes:

1) A small fix to lua.c to remove a debug statement that was filling up the log

2) The default-ca-chain.crt file was out of date and generating errors. I replaced it with a more recent one from http://curl.haxx.se/docs/caextract.html. These are extracted from Mozilla, circa late June, 2012. This will cause these errors to stop.

3) Added functionality to check the "header_Host" field against the CN value and SAN values that are found in certificates in the HTTP check; this will allow people to check to verify that the certificate from the site matches what is expected. I also added a metric for "cert_subject_alternative_names" to the HTTP check so that users can see what the certificate is reporting as acceptable headers.