How to write an output of a grep from an openssl command? - bash

Question

Consider you have list of thousand IP addresses in a text file - one per line. I want to be able to grab all possible anomalies from each IP address using openssl s_client command. So far, anomalies are certificate expired, self signed certificate, and issuer CN to include emailAddress=root#localhost.localdomain.
Overall, I want to be able to obtain concise error message per IP address if there is any. My current bash script looks like:
for ip in `awk '{print $1}' < general_certs.txt`; do
# Print IP address currently checking
echo -e $ip;
if timeout 30 openssl s_client -connect $ip:443| grep -i 'error' ; then
# Write error information and IP address to a file
echo `openssl s_client -connect $ip:443| grep -i 'error'` $ip >> general_errors;
else
# Write noerror information and IP address to another file
echo "noerror" $ip >> general_noerror;
fi;
done
First issue I have with the code is that it is not optimized and that I am skeptical if it returns accurate results. The end goal with the above script is to identify all untrusted certificate containing IPs.
Second issue I had with the above code that I could not echo $ip first because it would get truncated by the message itself. So, I ended up writing out $ip after the error message.
It is not necessary to use openssl if there is a more genuine solution to my question.

Answer 1

You can try to run them all in one shot by putting the processes in the background:
#!/bin/bash
max=100
counter=0
for ip in `awk '{print $1}' < general_certs.txt`; do
(( counter++ ))
(
results=$( timeout 30 openssl s_client -connect $ip:443 2> /dev/null )
if [ "$results" = "" ]; then
echo "$ip noresponse"
else
echo -n "$ip "
echo "$results" | grep -i 'error' || echo "noerror"
fi
) >> general_errors &
if [ $counter -eq $max ]; then
wait
counter=0
fi
done
wait
This was the input:
$ cat general_certs.txt
stackoverflow.com
redhat.com
google.com
8.8.8.8
vt.edu
bls.gov
8.8.4.4
This was the output:
$ cat general_errors
8.8.4.4 noerror
stackoverflow.com noerror
google.com noerror
vt.edu noerror
bls.gov noerror
redhat.com noerror
8.8.8.8 noresponse
If you have some that fail, I can test them.

Answer 2

If you're trying to get which ip's have a untrusted certificate, you could try, even if it's not the best option, with curl.
Something like:
for ip in `awk '{print $1}' < general_certs.txt`; do
echo -e $ip
curl https://${ip}:443 &> /dev/null
if [ $? == 51 ]; then
echo "upsis, https://${ip}:443 has a untrusted certificate" >> general_err
else
echo "yai, https://${ip}:443 doesn't have a untrusted certificate" >> general_noerr
fi
done
Notice that here you're only checking for unstrusted certificates ( error 51 in curl ), but the command could send any other error and it would go to general_noerror.