如何从openssl命令写入grep的输出？

Question

Consider you have list of thousand IP addresses in a text file - one per line. I want to be able to grab all possible anomalies from each IP address using openssl s_client command. So far, anomalies are certificate expired, self signed certificate, and issuer CN to include emailAddress=root@localhost.localdomain.

Overall, I want to be able to obtain concise error message per IP address if there is any. My current bash script looks like:

for ip in `awk '{print $1}' < general_certs.txt`; do 
# Print IP address currently checking
echo -e $ip;
    if timeout 30 openssl s_client -connect $ip:443| grep -i 'error' ; then
# Write error information and IP address to a file
        echo `openssl s_client -connect $ip:443| grep -i 'error'` $ip >> general_errors;
    else
# Write noerror information and IP address to another file
        echo "noerror" $ip >> general_noerror;
    fi;
done

First issue I have with the code is that it is not optimized and that I am skeptical if it returns accurate results. The end goal with the above script is to identify all untrusted certificate containing IPs.

Second issue I had with the above code that I could not echo $ip first because it would get truncated by the message itself. So, I ended up writing out $ip after the error message.

It is not necessary to use openssl if there is a more genuine solution to my question.

Answer 1

You can try to run them all in one shot by putting the processes in the background:

#!/bin/bash
max=100
counter=0
for ip in `awk '{print $1}' < general_certs.txt`; do 
    (( counter++ ))
    (
        results=$( timeout 30 openssl s_client -connect $ip:443 2> /dev/null )
        if [ "$results" = "" ]; then
            echo "$ip noresponse"
        else 
            echo -n "$ip "
            echo "$results" | grep -i 'error' || echo "noerror"
        fi
    )  >> general_errors &
    if [ $counter -eq $max ]; then
        wait
        counter=0
    fi
done
wait

This was the input:

$ cat general_certs.txt 
stackoverflow.com
redhat.com
google.com
8.8.8.8
vt.edu
bls.gov
8.8.4.4

This was the output:

$ cat general_errors
8.8.4.4 noerror
stackoverflow.com noerror
google.com noerror
vt.edu noerror
bls.gov noerror
redhat.com noerror
8.8.8.8 noresponse

If you have some that fail, I can test them.

Answer 2

If you're trying to get which ip's have a untrusted certificate, you could try, even if it's not the best option, with curl .

Something like:

for ip in `awk '{print $1}' < general_certs.txt`; do 
  echo -e $ip                                                                                                                                                     

  curl https://${ip}:443 &> /dev/null                                                                                                                             

  if [ $? == 51 ]; then                                                             
    echo "upsis, https://${ip}:443 has a untrusted certificate" >> general_err
  else                                                                              
    echo "yai, https://${ip}:443 doesn't have a untrusted certificate" >> general_noerr
  fi
done

Notice that here you're only checking for unstrusted certificates ( error 51 in curl ), but the command could send any other error and it would go to general_noerror .