frankencert | Adversarial Testing of Certificate Validation | TLS library

by sumanj Python Version: Current License: No License

X-Ray Key Features Code Snippets Community Discussions(10)Vulnerabilities Install Support

kandi X-RAY | frankencert Summary

frankencert is a Python library typically used in Security, TLS applications. frankencert has no bugs, it has no vulnerabilities and it has low support. However frankencert build file is not available. You can download it from GitHub.

Frankencerts are specially crafted SSL certificates for testing certificate validation code in SSL/TLS implementations. The technique is described in detail in the 2014 IEEE Symposium on Security and Privacy (Oakland) paper - Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations by Chad Brubaker, Suman Jana, Baishakhi Ray, Sarfraz Khurshid, and Vitaly Shmatikov.

Support

Quality

Security

License

Reuse

Support

frankencert has a low active ecosystem.

It has 157 star(s) with 53 fork(s). There are 18 watchers for this library.

It had no major release in the last 6 months.

There are 1 open issues and 3 have been closed. On average issues are closed in 36 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of frankencert is current.

Quality

frankencert has 0 bugs and 0 code smells.

Security

frankencert has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

frankencert code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

frankencert does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

frankencert releases are not available. You will need to build from source code and install.

frankencert has no build file. You will be need to create the build yourself to build the component from source.

Installation instructions, examples and code snippets are available.

frankencert saves you 3824 person hours of effort in developing the same functionality from scratch.

It has 8153 lines of code, 937 functions and 32 files.

It has medium code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed frankencert and discovered the below as its top functions. This is intended to give you an instant insight into frankencert implemented functionality, and help decide if they suit your requirements.

Generate certificate certificates
Generate a certificate
Generate a private key
Time of the certificate
Recursively recycle a certificate
Parse config file
Load seed certificates
Decorate a function to require dependencies
Return a cryptography certificate signing request
Return a cryptography backend
Creates a function that returns an assertion function
Raises an exception from the error queue
Convert bytes to native representation
Return a string representation of a character
Return a cryptography cryptography CertificateRevocationList object
Convert to cryptography x509 x509
Find the given meta tag
Dump certificates to a path
Read a file
Find the version string
Returns the SSLE relay version
Generates RSA keys
Generate a dsa keypair

Get all kandi verified functions for this library.

frankencert Key Features

No Key Features are available at this moment for frankencert.

frankencert Examples and Code Snippets

No Code Snippets are available at this moment for frankencert.

Community Discussions

Trending Discussions on TLS

TLS v1.2 Cipher Suites in .NET 6 / GET Request Timeout

Azure Pipelines local agent failing to connect with SSL error

Fixing git HTTPS Error: "bad key length" on macOS 12

npm notice Beginning October 4, 2021, all connections to the npm registry - including for package installation - must use TLS 1.2 or higher

nexus-staging-maven-plugin: maven deploy failed: An API incompatibility was encountered while executing

Unable to log egress traffic HTTP requests with the istio-proxy

How to force TLS 1.2 usage for PhpMailer 5.2

Error Importing "mongodb" with typescript

Find the missing module

vvv.test not loading (nor any of my sites) when running vagrant up

QUESTION

TLS v1.2 Cipher Suites in .NET 6 / GET Request Timeout

Asked 2022-Mar-30 at 12:52

I am currently trying to connect to an AWS REST API which requires at least TLS v1.2. The documentation stats that clients must also support cipher suites with perfect forward secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE).

When sending a GET request using the HttpClient, the connection simply times out. I have set the TLS version explicitely to TLSv1.2 like this:

...

ANSWER

Answered 2022-Mar-30 at 12:52

We finally found the reason for this. Windows did not have the required cypher suites enabled. We have used IISCrypto to enable the corresponding cypher suites and all is ok now.

It looks like it's possible to force .NET to TLS 1.2, even though it was not enabled on the server itself.

Source https://stackoverflow.com/questions/70338951

QUESTION

Azure Pipelines local agent failing to connect with SSL error

Asked 2022-Mar-29 at 19:29

We have an on premise server (Windows Server 2012 R2) with an Azure Pipelines agent running on it. Today (31st Jan 2022) this agent could not longer connect to our Azure DevOps organisation.

Judging by the log files, I assume this is because it is trying to connect with an older TLS version, which as of today is no longer available - https://devblogs.microsoft.com/devops/azure-devops-services-to-require-tls-1-2/

So I followed the instructions on how to make sure TLS 1.2 was enabled, and confirmed my settings in the registry editor and by running the PowerShell script suggested here - https://docs.microsoft.com/en-us/security/engineering/solving-tls1-problem#update-windows-powershell-scripts-or-related-registry-settings

All seems ok, yet it still fails to connect with the same issue. The machine has been restarted as well. If I try the URL it is requesting in the in built Internet Explorer browser, it fails, but with Chrome it succeeds, so it must still be trying to connect with TLS 1.2, but I don't know why. I've tried reinstalling the agent (with the latest build) as well but it fails on the same error. Any suggestions?

...

ANSWER

Answered 2022-Jan-31 at 23:27

Enabling below Cyphers with IISCrypto on the server helped us fix the issue

Cipher Suites

TLS 1.2 (suites in server-preferred order) TLS

_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f) DH 2048 bits FS 256 TLS
DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) DH 2048 bits FS 128

This from Vijay's solution

Source https://stackoverflow.com/questions/70929356

QUESTION

Fixing git HTTPS Error: "bad key length" on macOS 12

Asked 2022-Mar-29 at 17:34

I am using a company-hosted (Bitbucket) git repository that is accessible via HTTPS. Accessing it (e.g. git fetch) worked using macOS 11 (Big Sur), but broke after an update to macOS 12 Monterey. *

After the update of macOS to 12 Monterey my previous git setup broke. Now I am getting the following error message:

...

ANSWER

Answered 2021-Nov-02 at 07:12

Unfortunately I can't provide you with a fix, but I've found a workaround for that exact same problem (company-hosted bitbucket resulting in exact same error). I also don't know exactly why the problem occurs, but my best guess would be that the libressl library shipped with Monterey has some sort of problem with specific (?TLSv1.3) certs. This guess is because the brew-installed openssl v1.1 and v3 don't throw that error when executed with /opt/homebrew/opt/openssl/bin/openssl s_client -connect ...:443

To get around that error, I've built git from source built against different openssl and curl implementations:

install autoconf, openssl and curl with brew (I think you can select the openssl lib you like, i.e. v1.1 or v3, I chose v3)
clone git version you like, i.e. git clone --branch v2.33.1 https://github.com/git/git.git
cd git
make configure (that is why autoconf is needed)
execute LDFLAGS="-L/opt/homebrew/opt/openssl@3/lib -L/opt/homebrew/opt/curl/lib" CPPFLAGS="-I/opt/homebrew/opt/openssl@3/include -I/opt/homebrew/opt/curl/include" ./configure --prefix=$HOME/git (here LDFLAGS and CPPFLAGS include the libs git will be built against, the right flags are emitted by brew on install success of curl and openssl; --prefix is the install directory of git, defaults to /usr/local but can be changed)
make install
ensure to add the install directory's subfolder /bin to the front of your $PATH to "override" the default git shipped by Monterey
restart terminal
check that git version shows the new version

This should help for now, but as I already said, this is only a workaround, hopefully Apple fixes their libressl fork ASAP.

Source https://stackoverflow.com/questions/69734654

QUESTION

npm notice Beginning October 4, 2021, all connections to the npm registry - including for package installation - must use TLS 1.2 or higher

Asked 2022-Mar-22 at 09:17

I am getting this warning from github on my npm project build process... I tried searching on the internet and also read the blog link posted by github - but I could not find the solution to it anywhere. Am I missing something ?

Warning seen

npm notice Beginning October 4, 2021, all connections to the npm registry - including for package installation - must use TLS 1.2 or higher. You are currently using plaintext http to connect. Please visit the GitHub blog for more information: https://github.blog/2021-08-23-npm-registry-deprecating-tls-1-0-tls-1-1/

...

ANSWER

Answered 2021-Sep-10 at 15:18

Besides updating your version of node to an active or current LTS you want to ensure your NPM registry is set to an HTTPS endpoint:

Source https://stackoverflow.com/questions/69044064

QUESTION

nexus-staging-maven-plugin: maven deploy failed: An API incompatibility was encountered while executing

Asked 2022-Feb-11 at 22:39

This worked fine for me be building under Java 8. Now under Java 17.01 I get this when I do mvn deploy.

mvn install works fine. I tried 3.6.3 and 3.8.4 and updated (I think) all my plugins to the newest versions.

Any ideas?

...

ANSWER

Answered 2022-Feb-11 at 22:39

Update: Version 1.6.9 has been released and should fix this issue! 🎉

This is actually a known bug, which is now open for quite a while: OSSRH-66257. There are two known workarounds:

1. Open Modules

As a workaround, use --add-opens to give the library causing the problem access to the required classes:

Source https://stackoverflow.com/questions/70153962

QUESTION

Unable to log egress traffic HTTP requests with the istio-proxy

Asked 2022-Feb-11 at 10:45

I am following this guide.

Ingress requests are getting logged. Egress traffic control is working as expected, except I am unable to log egress HTTP requests. What is missing?

...

ANSWER

Answered 2022-Feb-07 at 17:14

AFAIK istio collects only ingress HTTP logs by default.

In the istio documentation there is an old article (from 2018) describing how to enable egress traffic HTTP logs.

Please keep in mind that some of the information may be outdated, however I believe this is the part that you are missing.

Source https://stackoverflow.com/questions/71018977

QUESTION

How to force TLS 1.2 usage for PhpMailer 5.2

Asked 2022-Feb-04 at 09:50

Recently the 3rd party email service provider I was using made a change. They disabled support for TLS 1.0 and TLS 1.1.

I provide support for an ancient system that still uses php 5.3 and phpmailer 5.2.

My tests indicates that TLS 1.2 is enabled.

But, the PHPMailer code cannot connect to the email server after the disabling of TLS 1.0 and 1.1

Also, note that I am not a full time php expert.

Is there a way to make PHPMailer 5.2 use tls 1.2?

...

ANSWER

Answered 2021-Nov-07 at 14:47

It's not up to PHPMailer, its up to the version of PHP that you're using to run it, so the solution is to update your PHP version. The major changes relating to TLS were largely in PHP 5.6, so upgrading to that would be a good intermediate point if you're really stuck with this legacy version.

Source https://stackoverflow.com/questions/69873422

QUESTION

Error Importing "mongodb" with typescript

Asked 2022-Jan-25 at 18:41

When compiling any typescript program that just imports mongodb, i get 12 errors like:

...

ANSWER

Answered 2022-Jan-06 at 15:48

I'm unable to reproduce your problem in my local environment, so I think it is a problem probably related to some other package in your project.

As suggested on this issue, you should try deleting your package-lock.json and generating it again with npm.

Source https://stackoverflow.com/questions/70607218

QUESTION

Find the missing module

Asked 2022-Jan-16 at 19:31

My question: when building a minimal JRE, how can one make sure that no required module is missing?

To illustrate the question, here is an example where I want to build a minimal JRE for my project. Let's assume for this example that logback is my only dependency.

I run the following command to see what modules are required:

...

ANSWER

Answered 2022-Jan-16 at 19:31

The JAR you're using there has "no module descriptor" (see first line of output) and thus can't tell you what modules it depends on, so you have to find out yourself. The canonical tool for that is jdeps but it may not be enough.

Static Dependencies

I wrote a jdeps tutorial that gets you started, but the interesting bit is this section. The gist is this command:

Source https://stackoverflow.com/questions/70664036

QUESTION

vvv.test not loading (nor any of my sites) when running vagrant up

Asked 2022-Jan-07 at 21:03

Ever since I've upgraded my Mac to Monteray, I've been having issues with Vagrant.

Initially, I use to see a vBoxManage error on terminal when running vagrant up. I posted a question on this on SO previously, see here for details.

Today, I uninstalled VirtualBox again (removed VirtualBox VMs folder and moved application to trash) and reinstalled VirtualBox 6.1.3 for OS X hosts` (link here).

I then ran vagrant up on terminal and it successfully compiled:

After seeing the famous green teddy, I tried going to vvv.test but, the page doesn't load. I've tried accessing URLs of sites that have been provisioned before, but they too do not load.

I've also ran vagrant up --debug, and nothing concerning was seen.

My Vagrant version is 2.2.19

Unsure what steps to take next?

Edit:

Steps taken:

Have ran vagrant up --provision to provision sites in config.yml file (config.yml file can be seen below)
Have tried to access website-dev.test, page doesn't load
Have tried to access vvv.test, page doesn't load
Have ran vagrant reload --provision and repeated steps 2 and 3, but same results
Have ran vagrant halt and vagrant up and repeated steps 2 and 3, but same results

I don't believe there's an issue in my config.yml file, as before Monteray update, everything was working fine (and I've made no changes to my yml file since). But, to cover all scenario's, here is my config.yml file:

...

ANSWER

Answered 2021-Dec-15 at 18:33

Thanks to guidance from @Tinxuanna, I've managed to solve the issue (finally!).

For anyone else having similar issues, here's what I did:

Access the /etc/hosts folder
Find file called hosts and open it in a text editor.
Remove the IP addresses related to vagrant (I kept a backup of the original file just in case)
After saving hosts file the IP addresses removed, I ran vagrant up --provision
I then ran vagrant up
Then accessed vvv.test
You're done!

Source https://stackoverflow.com/questions/70192942

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install frankencert

Install OpenSSL libraries and utilities if you don’t have them already. On Ubuntu this can be performed with sudo apt-get install libssl-dev. Install the python3-setuptools package used by PyOpenSSL with sudo apt-get install python3-setuptools. The frankencert generator needs a modified version of PyOpenSSL. We have included the source for our modified version of PyOpenSSL. You will need to install it in order to use the frankencert generator. First, uninstall any other version of PyOpenSSL that you may have installed on your computer. Go to the pyopenssl-19.1.0 directory and build/install PyOpenSSL by issuing sudo python3 setup.py install. Once you have the patched pyOpenSSL set up, to generate frankencerts, use the franken_generate.py script: python3 franken_generate.py seed_certs_dir ca_cert output_dir count [config_file]. Example usage: python3 franken_generate.py ../utils/test_certs/ ../utils/rootCA_key_cert.pem ../output/ 30. seed_certs_dir: Frankencert generator needs a set of seed certificates. Any SSL cert in PEM fromat can act as a seed cert. seed_certs_dir can be any directory containing the seed certs stored as PEM files. ca_cert: You will also need to create a self-signed CA certificate to sign the frankencerts. You can either use the included sample CA certificate utils/rootCA_key_cert.pem or use the utils/create_new_ca.sh script to create your own root CA. For any root CA that you use for frankencert generation, make sure that your SSL certificate validation code treats its certificate as a trusted root certificate. output_dir: It will contain the generated frankencerts. The frankencerts will be named as frankencert-<number>.pem. count: Number of frankencerts to be generated. config_file: An optional argument to tune the frankencert generation process. Take a look at the utils/sample_franken.conf for a sample config file. To test your SSL/TLS client with the generated frankencerts, you should use the utils/test_ssl_server.py script to set up an SSL server that can present the generated frankencerts as part of the SSL handshake. Example usage: python3 test_ssl_server.py ../output/frankencert-0.pem 443. If you want to perform differential testing (i.e., compare your SSL/TLS client’s behavior with other libraries' behaviors for a given frankencert), you can do so by running SSL clients using those libraries (some samples are available in utils/differential_testing_sample_clients.tar.gz) and connecting to a server serving the frankencert. The following example shows how to do this for OpenSSL. Start a SSL server serving the target frankencert using: ./test_ssl_server.py frankencert_name port_no, where frankencert_name is the path of the target frankencert and port_no is the port the server will listen to. Use the command openssl s_client -CAfile ca_cert -connect host_name:port_no to connect to the server and check the certificate verification result printed on the console. The ca_cert argument should be the CA certificate you used to generate the frankencert, port_no should be the same one that you used for running test_ssl_server, and host_name should be either localhost or the name of the host running the test_ssl_server script.
Install OpenSSL libraries and utilities if you don’t have them already. On Ubuntu this can be performed with sudo apt-get install libssl-dev.
Install the python3-setuptools package used by PyOpenSSL with sudo apt-get install python3-setuptools.
The frankencert generator needs a modified version of PyOpenSSL. We have included the source for our modified version of PyOpenSSL. You will need to install it in order to use the frankencert generator. First, uninstall any other version of PyOpenSSL that you may have installed on your computer. Go to the pyopenssl-19.1.0 directory and build/install PyOpenSSL by issuing sudo python3 setup.py install.
Once you have the patched pyOpenSSL set up, to generate frankencerts, use the franken_generate.py script: python3 franken_generate.py seed_certs_dir ca_cert output_dir count [config_file]. Example usage: python3 franken_generate.py ../utils/test_certs/ ../utils/rootCA_key_cert.pem ../output/ 30. The arguments are explained below.
seed_certs_dir: Frankencert generator needs a set of seed certificates. Any SSL cert in PEM fromat can act as a seed cert. seed_certs_dir can be any directory containing the seed certs stored as PEM files. You can either use tools like ZMap (https://zmap.io/) to collect SSL seed certificates, or use some of the SSL certs available from https://www.eff.org/observatory. Please note that these are not our tools and repositories - you may want to contact their respective developers and maintainers to ensure that your usage of the certificates they collected is compatible with the intended purpose. You do not need access to the corresponding private keys to use the certs as seeds. For your convenience, we have included a tarball containing around 1000 seed certificates in `utils/sample_seed_certs.tar.gz`.
ca_cert: You will also need to create a self-signed CA certificate to sign the frankencerts. You can either use the included sample CA certificate utils/rootCA_key_cert.pem or use the utils/create_new_ca.sh script to create your own root CA. For any root CA that you use for frankencert generation, make sure that your SSL certificate validation code treats its certificate as a trusted root certificate. VERY IMPORTANT: this root certificate should be trusted ONLY during testing. If you accidentally or intentionally deploy SSL/TLS with this certificate still among the trusted root certificates, your SSL/TLS connections may be vulnerable to server impersonation and man-in-the-middle attacks. Be sure to REMOVE this certificate from your trusted root certificates once the testing is finished.
output_dir: It will contain the generated frankencerts. The frankencerts will be named as frankencert-<number>.pem.
count: Number of frankencerts to be generated.
config_file: An optional argument to tune the frankencert generation process. Take a look at the utils/sample_franken.conf for a sample config file.
To test your SSL/TLS client with the generated frankencerts, you should use the utils/test_ssl_server.py script to set up an SSL server that can present the generated frankencerts as part of the SSL handshake. Example usage: python3 test_ssl_server.py ../output/frankencert-0.pem 443
If you want to perform differential testing (i.e., compare your SSL/TLS client’s behavior with other libraries' behaviors for a given frankencert), you can do so by running SSL clients using those libraries (some samples are available in utils/differential_testing_sample_clients.tar.gz) and connecting to a server serving the frankencert. The following example shows how to do this for OpenSSL.
Start a SSL server serving the target frankencert using: ./test_ssl_server.py frankencert_name port_no, where frankencert_name is the path of the target frankencert and port_no is the port the server will listen to.
Use the command openssl s_client -CAfile ca_cert -connect host_name:port_no to connect to the server and check the certificate verification result printed on the console. The ca_cert argument should be the CA certificate you used to generate the frankencert, port_no should be the same one that you used for running test_ssl_server, and host_name should be either localhost or the name of the host running the test_ssl_server script.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: