cablint-ct

#!/usr/bin/ruby -Eutf-8:utf-8
# encoding: UTF-8
# Copyright 2015-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"). You may not
# use this file except in compliance with the License. A copy of the License
# is located at
#
#   http://aws.amazon.com/apache2.0/
#
# or in the "license" file accompanying this file. This file is distributed on
# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
require 'certlint'
require 'certlint/ct'

LOGS = {
  'pilot' => 'https://ct.googleapis.com/pilot',
  'aviator' => 'https://ct.googleapis.com/aviator',
  'rocketeer' => 'https://ct.googleapis.com/rocketeer',
  'certly' => 'https://log.certly.io',
  'digicert' => 'https://ct1.digicert-ct.com/log',
  'symantec' => 'https://ct.ws.symantec.com',
  'izenpe' => 'https://ct.izenpe.com',
  'wosign' => 'https://ct.wosign.com',
  'venafi' => 'https://ctlog.api.venafi.com',
  'akamai' => 'https://ct.akamai.com',
  'vega' => 'https://vega.ws.symantec.com'
}

log_url = ARGV[0]
unless log_url.include? '://'
  log_url = LOGS[log_url]
end

entry = ARGV[1].to_i

ct = CertLint::CT.new(log_url)
ct.get_entries(entry, entry).each do |e|
  if e['leaf_input'].entry_type == 0
    der = e['leaf_input'].raw_certificate
  else
    der = e['extra_data'].pre_certificate.raw_certificate
  end
  m = CertLint::CABLint.lint(der.to_s)
  m += CAAuth.CheckCAA(der) if ARGV[2] == "-CAA"
  m.each do |msg|
    puts "#{msg}\tCT:#{entry}"
  end
end