FiloSottile / FiloSottile/intermediates

RFE: Export `compressedPEMPool` or provide a function to return a collection of x509.Certificate (intermediate) values

Open
#3 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
60
Forks
5
PR merge metrics
No merged PRs in 30d

Description

Hi @FiloSottile,

Please consider exporting this value for use by importing projects:

https://github.com/FiloSottile/intermediates/blob/d8fb8425a9e98ca5502e50f054bda2a229503785/intermediates.go#L31-L32

or provide a function to return a collection of x509.Certificate values.

In particular, the monitoring plugin I'm working on evaluates certificates for a set of known issues and reports them as part of a Nagios plugin's output. I'm currently adding support for listing confirmed invalid or missing certificates in a given certificate chain and am using AIA-sourced certificates to accomplish this. Due to the way the plugin is executed, it is *possible* that many iterations of the plugin could be executed very close together.

I'm aware that it's possible to retrieve the [Subjects for certificates in a x509.CertPool](https://pkg.go.dev/crypto/x509#CertPool.Subjects), but with that functionality deprecated I wasn't sure how long it would remain viable. In addition to checking Subject/Issuer values, I'm also using the retrieved certificates to verify the signature of existing certs in the evaluated chain (which can be as few as just the leaf cert), so having only the Subject values did not seem to provide all functionality I was looking for.

While I've observed that some of the intermediates available via those AIA URLs are already protected by a proxy (e.g., Cloudflare), I'm opting to only have the plugin retrieve those intermediates if a proxy URL is specified. My assumption is that a Nagios instance running many checks close together might unintentionally trip a rate limit if all plugin executions retrieve the intermediates via AIA URLs directly.

For sysadmins who prefer to not use a proxy (and thus opt out of retrieving intermediates via AIA URLs), having the plugin use the intermediates provided by this package would provide the desired behavior without the external resource requests.

Please let me know if I can clarify anything.

Thanks in advance for your time and consideration!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.