Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sslscan does not support dual certificate servers #322

Closed
tetlowgm opened this issue Dec 3, 2024 · 1 comment
Closed

sslscan does not support dual certificate servers #322

tetlowgm opened this issue Dec 3, 2024 · 1 comment

Comments

@tetlowgm
Copy link
Contributor

tetlowgm commented Dec 3, 2024

Servers can run with ECDSA and RSA certificates concurrently, but the certificate information only shows one.

An example of this:

$ sslscan google.com
...
  SSL Certificate:
Signature Algorithm: ecdsa-with-SHA256
ECC Curve Name:      prime256v1
ECC Key Strength:    128
...
Issuer:   WE2

This can be verified by hand with OpenSSL:

$ openssl s_client -connect google.com:443
...
subject=CN=*.google.com
issuer=C=US, O=Google Trust Services, CN=WE2
...
Peer signature type: ECDSA
...
Server public key is 256 bit
...

However, the server also supports RSA certificates:

$ openssl s_client -sigalgs "RSA-PSS+SHA512:RSA-PSS+SHA384:RSA-PSS+SHA256" -connect google.com:443
...
subject=CN=*.google.com
issuer=C=US, O=Google Trust Services, CN=WR2
...
Peer signature type: RSA-PSS
...
Server public key is 2048 bit
...

It would be nice if sslscan understood this and output information on both certificates.

@tetlowgm tetlowgm closed this as not planned Won't fix, can't repro, duplicate, stale Dec 7, 2024
@tetlowgm
Copy link
Contributor Author

tetlowgm commented Dec 7, 2024

Duplicate of #208

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant