install certificate transparency go | zuhdi.org

Install Google Certificate Transparency Go

Environment

  • Debian 9.5 x64
  • GVM2 v0.10.6
  • Go 1.9.7

Excerpt

Pre-requisite Install Go

Log 2018 / 11

1. GO* env

root@athos:~# env | grep GO
GOPATH=/root/.gvm/pkgsets/go1.9.7/global
GOROOT=/root/.gvm/gos/go1.9.7

2. Pre

root@athos:~# apt-get update && apt-get -y upgrade && apt-get -y dist-upgrade

root@athos:~# go get github.com/google/trillian

root@athos:~# cd $GOPATH/src/github.com/google/trillian

root@athos:~/.gvm/pkgsets/go1.9.7/global/src/github.com/google/trillian# \
> go get -t -u -v ./...
github.com/google/trillian (download)
github.com/golang/protobuf (download)
github.com/grpc-ecosystem/grpc-gateway (download)
(truncated)

3. ./ctclient

3.1. Build ctclient.go

git clone \
  https://github.com/google/certificate-transparency-go.git

root@athos:~# git clone \
>   https://github.com/google/certificate-transparency-go.git
Cloning into 'certificate-transparency-go'...
remote: Enumerating objects: 32, done.
remote: Counting objects: 100% (32/32), done.
remote: Compressing objects: 100% (27/27), done.
remote: Total 10009 (delta 6), reused 15 (delta 5), pack-reused 9977
Receiving objects: 100% (10009/10009), 7.88 MiB | 3.24 MiB/s, done.
Resolving deltas: 100% (5208/5208), done.

go build \
  certificate-transparency-go/client/ctclient/ctclient.go ; \
  chmod a+x ctclient

root@athos:~# go build \
>   certificate-transparency-go/client/ctclient/ctclient.go ; \
>   chmod a+x ctclient

3.2. ./ctclient --help

root@athos:~# ./ctclient
Need command argument
Usage: ctclient [options] <cmd>
where cmd is one of:
   sth           retrieve signed tree head
   upload        upload cert chain and show SCT (needs -cert_chain)
   getroots      show accepted roots
   getentries    get log entries (needs -first and -last)
   inclusion     get inclusion proof (needs -leaf_hash and optionally -size)
   consistency   get consistency proof (needs -size and -prev_size, optionally 
                 -tree_hash and -prev_hash)

root@athos:~# ./ctclient --help

3.3. Basic Usage

3.3.1. Retrieve Signed Tree Head

./ctclient --log_uri https://ct.googleapis.com/testtube sth

root@athos:~# ./ctclient --log_uri https://ct.googleapis.com/testtube sth
2018-11-04 11:52:36.484 +0000 UTC (timestamp 1541332356484): 
  Got STH for V1 log (size=38093049) at https://ct.googleapis.com/testtube, 
  hash 85fdc3b37f71c70719ffad8b73e9ed300e3e364bd9ed6b7be38336bc354e33f1
Signature: Hash=SHA256 Sign=ECDSA 
  Value=30460221009befc1d8c9082c41f6895aeff1f88ebe810a3dfd3938e05233f1f0dae7d0e8
  60022100f6647d29631910cfa65c856df8167919654108850a121a8339c37732960f6cc7

3.3.2. Show Accepted Roots

./ctclient --log_uri  \
  https://ct.googleapis.com/testtube getroots

root@athos:~# ./ctclient --log_uri  \
>   https://ct.googleapis.com/testtube getroots

3.3.3. Get Log Entries

./ctclient --log_uri https://ct.googleapis.com/testtube \
  -first 15887722 -last 15887722 getentries 

root@athos:~# ./ctclient --log_uri https://ct.googleapis.com/testtube \
>   -first 15887722 -last 15887722 getentries
Index=15887722 Timestamp=1522197062400 (2018-03-28 00:31:02.4 +0000 UTC) 
  pre-certificate from issuer with keyhash 
  25ec31d428b56d5f8d9b09432ad80276097501a242e17ec6ea5c95810c712c02:
Certificate:
(truncated)

4. ./scanlog

4.1. Build scanlog.go

git clone \
  https://github.com/google/certificate-transparency-go.git

root@athos:~# git clone \
>   https://github.com/google/certificate-transparency-go.git
Cloning into 'certificate-transparency-go'...
remote: Enumerating objects: 41, done.
remote: Counting objects: 100% (41/41), done.
remote: Compressing objects: 100% (33/33), done.
remote: Total 10021 (delta 9), reused 24 (delta 8), pack-reused 9980
Receiving objects: 100% (10021/10021), 7.89 MiB | 2.36 MiB/s, done.
Resolving deltas: 100% (5214/5214), done.

go build \
  certificate-transparency-go/scanner/scanlog/scanlog.go ; \
  chmod a+x scanlog

root@athos:~# go build \
>   certificate-transparency-go/scanner/scanlog/scanlog.go ; \
>   chmod a+x scanlog

4.2. ./scanlog --help

root@athos:~# ./scanlog --help
Usage of ./scanlog:
  -alsologtostderr
        log to standard error as well as files
  -batch_size int
        Max number of entries to request at per call to get-entries (default 1000)
  -dump_dir string
        Directory to store matched certificates in
(truncated)

4.3. Basic Usage

./ctclient --log_uri https://ct.googleapis.com/testtube \
  -first 15887722 -last 15887722 getentries | \
  grep -e "Serial Number:" -e "Subject:"

root@athos:~# ./ctclient --log_uri https://ct.googleapis.com/testtube \
>   -first 15887722 -last 15887722 getentries | \
>   grep -e "Serial Number:" -e "Subject:"
        Serial Number: 21859471173912533165521148950917689069833966 
          (0xfaef36523b1412678db2f938645642148eee)
        Subject: CN=beta.aplussites.org

./scanlog -log_uri https://ct.googleapis.com/testtube \
  -start_index 15000000 \
  -num_workers 10000 \
  -parallel_fetch 10 \
  -serial_number 21859471173912533165521148950917689069833966

root@athos:~# ./scanlog -log_uri https://ct.googleapis.com/testtube \
>   -start_index 15000000 \
>   -num_workers 10000 \
>   -parallel_fetch 10 \
>   -serial_number 21859471173912533165521148950917689069833966
2018/11/06 03:47:11 Using SerialNumber matcher on 
  21859471173912533165521148950917689069833966
2018/11/06 03:57:53 Process precert at index 15887722: CN: 'beta.aplussites.org' 
  Issuer: Fake LE Intermediate X1
^C

Hugo. Malte Kiefer & Zuhdi Najib.