pki // ssl acceptance testing

copy/paste dehydrated domains file(s) to domains.txt on your workstation or any other remote place you want to test the 6-layered service from

vi domains.txt

easy-peasy with curl

    for domain in `cat domains.txt`; do
            echo $domain
            curl -sI https://$domain/ | head -1
            echo
    done; unset domain

implicit ssl

check ssl tunnel against any port and service, e.g. for https

    for domain in `cat domains.txt`; do
            echo $domain
            echo Q | openssl s_client -connect $domain:443 2>/dev/null | openssl x509 -noout -text
            echo
    done; unset domain

same goes for submissions (with an s) and imaps — that’s optimal

    grep submissions /etc/services
    grep imaps /etc/services

starttls

a casual MX talks STARTTLS tho – check the certificate provided through SMTP STARTTLS

    for domain in `cat domains.txt`; do
            echo $domain
            echo Q | openssl s_client -starttls smtp -name ehlo.domain.tld -connect $domain:25 | openssl x509 -noout -text
            echo
    done; unset domain

# -crlf

same goes for submission (without an s) and imap — that’s not optimal

    grep submission /etc/services
    grep imap /etc/services

through a proxy

    proxytunnel -p $squid:8080 -d nethence.com:443 -a 7000

    echo Q | openssl s_client -connect localhost:7000 -servername nethence.com | openssl x509 -noout -text | less

on the squid machine

    ls -lhF /var/spool/squid/ssl_db/certs/

resources

https://stevenrombauts.be/2018/12/test-smtp-with-telnet-or-openssl/

pki // ssl acceptance testing

easy-peasy with curl

implicit ssl

starttls

through a proxy

resources

s_client

proxy

theory on troubles

troubles

moar