From 93e450793ce289925dfd1d5e3b2d14e781f8dfd4 Mon Sep 17 00:00:00 2001 From: moparisthebest Date: Tue, 30 Sep 2014 22:31:17 -0400 Subject: SSL: implement public key pinning Option --pinnedpubkey takes a path to a public key in DER format and only connect if it matches (currently only implemented with OpenSSL). Provides CURLOPT_PINNEDPUBLICKEY for curl_easy_setopt(). Extract a public RSA key from a website like so: openssl s_client -connect google.com:443 2>&1 < /dev/null | \ sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey \ | openssl rsa -pubin -outform DER > google.com.der --- tests/certs/Server-localhost-sv.pub.der | Bin 0 -> 162 bytes tests/certs/Server-localhost.nn-sv.pub.der | Bin 0 -> 162 bytes tests/certs/Server-localhost0h-sv.pub.der | Bin 0 -> 162 bytes tests/certs/scripts/genserv.sh | 3 +++ 4 files changed, 3 insertions(+) create mode 100644 tests/certs/Server-localhost-sv.pub.der create mode 100644 tests/certs/Server-localhost.nn-sv.pub.der create mode 100644 tests/certs/Server-localhost0h-sv.pub.der (limited to 'tests/certs') diff --git a/tests/certs/Server-localhost-sv.pub.der b/tests/certs/Server-localhost-sv.pub.der new file mode 100644 index 000000000..7e89b51a1 Binary files /dev/null and b/tests/certs/Server-localhost-sv.pub.der differ diff --git a/tests/certs/Server-localhost.nn-sv.pub.der b/tests/certs/Server-localhost.nn-sv.pub.der new file mode 100644 index 000000000..b67ab96ed Binary files /dev/null and b/tests/certs/Server-localhost.nn-sv.pub.der differ diff --git a/tests/certs/Server-localhost0h-sv.pub.der b/tests/certs/Server-localhost0h-sv.pub.der new file mode 100644 index 000000000..2b071d3ad Binary files /dev/null and b/tests/certs/Server-localhost0h-sv.pub.der differ diff --git a/tests/certs/scripts/genserv.sh b/tests/certs/scripts/genserv.sh index a70da9c76..463952c57 100755 --- a/tests/certs/scripts/genserv.sh +++ b/tests/certs/scripts/genserv.sh @@ -75,6 +75,9 @@ echo "openssl rsa -in $PREFIX-sv.key -out $PREFIX-sv.key" $OPENSSL rsa -in $PREFIX-sv.key -out $PREFIX-sv.key -passin pass:secret echo pseudo secrets generated +echo "openssl rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der" +$OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der + echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -out $PREFIX-sv.crt -text -nameopt multiline -sha1" $OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -out $PREFIX-sv.crt -text -nameopt multiline -sha1 -- cgit v1.2.3