konklone/shaaaaaaaaaaaaa — pull request #30 by konklone (2014-09-02 06:27:46+00:00)
Title: Major refactor, full certificate chain, parse certs in Node

This is a total refactor of analyzing a cert chain for SHA-ness. It now downloads the full certificate chain and analyzes each certificate in the chain.

Instead of one big giant shell command that involves two `openssl` calls and greps for some mangy text to sift through for the signature algorithm, this process now has `openssl s_client` fetch the full certificate chain using -showcerts. Then, the resulting cert chain is parsed in JavaScript to grab each cert.

Old:

```
echo -n | openssl s_client -connect konklone.com:443 -servername konklone.com | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text | grep "Signature Algorithm"
```

New:

```
echo -n | openssl s_client -connect konklone.com:443 -servername konklone.com -showcerts
```

Followed by grabbing each cert from the cert chain through a JavaScript regex, `/(\-+BEGIN CERTIFICATE\-+[\s\S]*?\-+END CERTIFICATE\-+)/g`.

Each cert is then run through a Node library, [`node-x509`](https://github.com/yorkie/node-x509), to get the signature algorithm field. We take this opportunity to then fetch a few more useful fields from the X.509 metadata, like expiration date and subject name. I'm using @yorkie's fork, that was created to serve this [unmerged pull request](https://github.com/Southern/node-x509/pull/15).

For [checking `konklone.com`](https://shaaaaaaaaaaaaa.com/check/konklone.com), whose [full SSL Labs analysis is here](https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com), this now yields:

```json
{
"domain": "konklone.com",
"cert": {
"algorithm": "sha256",
"raw": "sha256WithRSAEncryption",
"good": true,
"expires": "2015-08-18T23:59:59.000Z",
"name": "www.konklone.com"
},
"intermediates": [
{
"algorithm": "sha384",
"raw": "sha384WithRSAEncryption",
"good": true,
"expires": "2029-02-11T23:59:59.000Z",
"name": "COMODO RSA Domain Validation Secure Server CA"
},
{
"algorithm": "sha384",
"raw": "sha384WithRSAEncryption",
"good": true,
"expires": "2020-05-30T10:48:38.000Z",
"name": "COMODO RSA Certification Authority"
}
]
}
```

Other domains appear to be work fine, and tests pass, but this very well may cough up unexpected errors on the wild world of certs out there. Then again, the last version was relying on a trivial `sed` regex, and my JavaScript regex can't be much worse than that. It is possible that `openssl x509 -text` was more resilient than `node-x509` will be, but I guess we'll find out!