banshee/web-collection/network/tls/certificate

Certificate of a TLS service

Reads the certificate a server presents on a port, and tries what it accepts in protocols and ciphers: the days before expiry, the chain, the name, the key, the signature, the old protocols and weak ciphers accepted, and TLS 1.3. Ten watches are offered, each one set on the probe.

It serves a web site or an API (443), and any other TLS port: LDAPS (636), SMTPS (465), WinRM (5986), Remote Desktop (3389).

Versions

Generic: any server whose port starts with TLS, or with an RDP negotiation, whatever its software. TLS 1.0 to 1.3 are tried; a server that speaks only SSLv3 is not read.

How it works

The collector makes handshakes with the host on the port set, and sends nothing else: no request, no account, no secret. It ignores the TLS profile of the probe, since its role is to test what the server presents.

A handshake that offers everything the poller speaks (TLS 1.0 to 1.3, the 22 ciphers) reads the certificate and judges it without refusing it: its days before expiry, whether the chain reaches an authority the poller's system knows, whether it is complete, whether the server's certificate bears the expected name, whether it is self-signed, its key, and the signatures of the chain.
One handshake per version, TLS 1.0, 1.1, 1.2 and 1.3, each offering only that version: the server accepts it or refuses it.
At the highest version under TLS 1.3 the server accepts, one handshake per weak cipher (RC4, 3DES), each offered alone.

The added authorities (certificate:authorities, PEM blocks CERTIFICATE) count beside those of the poller's system: a certificate issued by the authority of a company is then trusted. They change nothing else: neither the chain, nor the name, nor the other outputs.
The expected name is certificate:name when set, otherwise the name of the host's address; it is also the name announced to the server, which then presents the right certificate when it serves several. An IP address without a name is judged on the addresses of the certificate.
A key too short: RSA under 2048 bits, or a curve under 256 bits.
SHA-1 is looked for in every signature of the chain, except the one a root authority bears on itself, which nobody checks.
Remote Desktop (certificate:rdp): the connection starts with an RDP negotiation, 19 fixed bytes, before the handshake. Nothing else is sent: the authentication that follows the handshake is never started.
A server that refuses the connection, does not speak TLS on the port, or with which no handshake succeeds, stops the collector as unreachable: the probe never says "OK" of a server it could not read.

Prerequisites

The port reachable from the poller.
Nothing on the server: the collector reads what any client sees.

Variables

Name	Label	Says	Default
`certificate:port`	Port	the TLS port of the service: 443, 636, 465, 3389, 5986	`443`
`certificate:name`	Expected name	the name the certificate must bear, when it differs from the address of the host, also announced to the server; optional	—
`certificate:authorities`	Added authorities	the certificates, in PEM blocks, of the authorities that issue for this service beside those of the system; optional	—
`certificate:rdp`	Remote Desktop	the handshake follows an RDP negotiation; on for port 3389	off

Outputs

Name	Label	Unit	Per instance
`days-left`	Days before expiry	d	no
`trusted`	Certificate trusted	—	no
`chain`	Chain	—	no
`name`	Name matches	—	no
`self-signed`	Self-signed	—	no
`weak-key`	Key too short	—	no
`sha1`	SHA-1 signature	—	no
`old-protocols`	Old protocols accepted	—	no
`weak-suites`	Weak ciphers accepted	—	no
`tls13`	TLS 1.3 accepted	—	no

days-left is negative once the certificate has expired. chain is complete or incomplete; old-protocols and weak-suites are none or the list found (TLS 1.0, TLS 1.1); the others are yes or no.

Watches

Name	Title	Kind	Defaults	Checked by default
`expiring`	Expiry close	below a threshold, on `days-left`	warning below 30 d, critical below 7 d	yes
`untrusted`	Certificate not trusted	state to avoid, on `trusted`	warning on `no`	no: check it once the authorities of a private issuer are added
`chain-incomplete`	Incomplete chain	expected value, on `chain`	warning when not `complete`	yes
`name-mismatch`	Name does not match	expected value, on `name`	critical when not `yes`	yes
`self-signed`	Self-signed certificate	state to avoid, on `self-signed`	warning on `yes`	no
`weak-key`	Key too short	state to avoid, on `weak-key`	warning on `yes`	yes
`sha1`	SHA-1 signature	state to avoid, on `sha1`	warning on `yes`	yes
`old-protocols`	Old protocol accepted	expected value, on `old-protocols`	warning when not `none`	yes
`weak-suites`	Weak cipher accepted	expected value, on `weak-suites`	warning when not `none`	yes
`tls13`	Recent protocol refused	expected value, on `tls13`	warning when not `yes`	no

Limits

A certificate issued by the authority of a company is not trusted unless that authority is in the system of the poller or set in certificate:authorities.
What the poller does not speak is not read: a server that speaks only SSLv3 stops the collector as unreachable; a cipher with a DHE exchange is never tried.
STARTTLS (SMTP on 25 and 587, LDAP on 389, IMAP, POP) is not opened: only a port that starts with TLS, or with an RDP negotiation, is read.
Only the five weak ciphers are tried one by one; the other ciphers a server accepts are not listed.