eMudhra 证书包检查

https://emudhra.we-have-a-problem.com/

当然，你的浏览器做得没错，但 TLS 发生的地方可不止浏览器一处。所以你需要检查证书包可能藏身的所有地方。真是麻烦！

抱歉，我没有现成的解决方案。但如果你只想检查某个特定语言开箱即用时是否行为正确，这里有一些简单的示例程序。如果一切正常，每个程序都会静默地不返回任何内容（因为这是 Unix 的方式）；如果它能连接到已知的恶意站点，则会报告错误。

该工具将使用给定框架/语言的默认设置，但你也可以指定一个替代证书包来进行检查。如果它知道如何显示，就会显示它使用了哪个证书包/路径。

示例

Go

$ go run emudhra.go
$ go run emudhra.go /tmp/cert.pem.bad 
BAD: successful connection to https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
BAD: successful connection to https://dv-g3b-emudhra.we-have-a-problem.com/
exit status 2
$

Java

$ java emudhra.java 
Using CA file: /opt/homebrew/Cellar/openjdk/23.0.2/libexec/openjdk.jdk/Contents/Home/lib/security/cacerts
BAD: successful connection to https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
BAD: successful connection to https://dv-g3b-emudhra.we-have-a-problem.com/
$ java emudhra.java  /etc/ssl/cert.pem
Using CA file: /etc/ssl/cert.pem
$

考虑按照此处的说明，将中间证书添加到你的 blocked.certs 中。

Node

$ node emudhra.js
$ node emudhra.js /tmp/cert.pem.bad 
BAD: successful connection to https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
BAD: successful connection to https://dv-g3b-emudhra.we-have-a-problem.com/
$

Perl

$ perl emudhra.pl 
Using SSL_ca_file: /private/etc/ssl/cert.pem
$ perl emudhra.pl /tmp/cert.pem.bad 
Using SSL_ca_file: /tmp/cert.pem.bad
BAD: successful connection to https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
BAD: successful connection to https://dv-g3b-emudhra.we-have-a-problem.com/
$

Python

$ python3 emudhra.py
Using CA file: /opt/homebrew/etc/openssl@4/cert.pem
$ python3 emudhra.py /tmp/cert.pem.bad 
Using CA file: /tmp/cert.pem.bad
BAD: successful connection to https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
BAD: successful connection to https://dv-g3b-emudhra.we-have-a-problem.com/
$

Ruby

$ ruby emudhra.rb 
Using CA file: /usr/lib/ssl/cert.pem
$ ruby emudhra.rb /tmp/cert.pem.bad 
Using CA file: /tmp/cert.pem.bad
BAD: successful connection to https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
BAD: successful connection to https://dv-g3b-emudhra.we-have-a-problem.com/
$

Curl

$ sh emudhra.sh 
Used CA file: /etc/ssl/certs/ca-certificates.crt
$ sh emudhra.sh
/tmp/cert.pem.bad 
Used CA file: /tmp/cert.pem.bad
BAD: successful connection to https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
BAD: successful connection to https://dv-g3b-emudhra.we-have-a-problem.com/
$

注意：在 macOS 上，你可以让 curl(1) 使用原生后端，这样在所有情况下都会拒绝连接：

$ CURL_SSL_BACKEND=secure-transport sh emudhra.sh /tmp/cert.pem.bad 
Used CA file: 
$ 

Rust

$ cd rs
$ cargo run
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.35s
     Running `target/debug/rs`
$ cargo run -- /tmp/cert.pem.bad 
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.17s
     Running `target/debug/rs /tmp/cert.pem.bad`
$

在其依赖项的某个地方，Rust 会对被入侵的中间证书进行实际的阻止列表检查，因此即使使用信任 eMudhra 根证书的证书包，它也无法连接。