Actions
Support #1356
closedcan suricata detect self-signed certificates
Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:
Description
we're trying to create a rule that drops self signed certificates. we've written the following but it only drops the packet. we want it to drop the entire stream.
drop tcp any any -> any any (msg:"Self-signed Certificate"; flow:to_client,established; content:"|14|"; offset:16; depth:4; nocase;)
this rule works great but unfortunately generates false positives.
drop tcp any any -> any any (msg:"Self-signed Certificate"; flow:to_client,established; content:"|03 01|"; offset:8; depth:4; nocase;)
do you guys have anything?
Actions