Changeset 73 for trunk

Timestamp:

11/12/14 15:19:33 (10 years ago)

Author:

tim

Message:

added PKCS12 capabilities to clonecertchain

Location:

trunk/bin

Files:

• bletchley-clonecertchain (modified) (3 diffs)
• bletchley-decode (modified) (1 diff)
• bletchley-http2py (modified) (1 diff)

trunk/bin/bletchley-clonecertchain

@@ -1 +1 @@
 #!/usr/bin/env python3
-
+#-*- mode: Python;-*-
+#
 # Requires Python 3+
+
 
 '''
@@ -188 +190 @@
     description="An experimental script which attempts to clone an SSL server's"
     " entire certificate chain, ideally altering only the keys and signatures"
-    " along the way.  The script prints results to stdout, starting with a PEM"
+    " along the way.  The script prints results to stdout, starting with a PKCS7 (PEM)"
     " key (the fake server private key) followed by the newly forged certificate"
     " chain, also in PEM format.  (The new intermediate and root private keys are"
-    " not currently printed, but will likely be somehow availble in a future"
+    " not currently printed, but will likely be somehow available in a future"
     " version.)")
 
 parser.add_argument('host', nargs=1, default=None,
                     help='IP address or host name of server')
-parser.add_argument('port', nargs='?', default=443,
+parser.add_argument('port', nargs='?', type=int, default=443,
                     help='TCP port number of SSL service (default: 443)')
+parser.add_argument(
+    '--p12', dest='p12_filename', type=str, required=False, default=None,
+    help='If specified, a PKCS12 file will be written with the generated certificates'
+    ' and server key (in addition to normal PKCS7 output).  NOTE: the file specified'
+    ' will be overwritten without prompting if it already exists.')
+parser.add_argument(
+    '--p12password', dest='p12_password', type=str, required=False, default='bletchley',
+    help='If specified along with the --p12 argument, the PKCS12 file will use this password'
+    ' to encrypt the server private key.  (Otherwise, the password "bletchley" is used).')
 options = parser.parse_args()
 
@@ -214 +225 @@
 for c in fake_chain:
     print(OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, c).decode('utf-8'))
+
+if options.p12_filename:
+    p12_file = open(options.p12_filename, 'w+b')
+
+    p12 = OpenSSL.crypto.PKCS12()
+    p12.set_ca_certificates(fake_chain[1:])
+    p12.set_privatekey(fake_key)
+    p12.set_certificate(fake_chain[0])
+
+    p12_file.write(p12.export(passphrase=options.p12_password.encode('utf-8')))
+    p12_file.close()

trunk/bin/bletchley-decode

@@ -1 +1 @@
 #!/usr/bin/env python3
-
+#-*- mode: Python;-*-
+#
 # Requires Python 3+
 

trunk/bin/bletchley-http2py

@@ -1 +1 @@
 #!/usr/bin/env python3
-
+#-*- mode: Python;-*-
+#
 # Requires Python 3+