Project

General

Profile

Actions
Copy link

Feature #296

closed
CW PC

Matching SSL/TLS certificate details

Feature #296: Matching SSL/TLS certificate details

Added by Chris Wakelin almost 15 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Pierre Chifflier
Target version:
1.3beta1
Effort:
Difficulty:
Label:

Description

I was wondering whether Suricata could have payload keywords to match part of a TLS/SSL certificate such as "subject", "issuer" etc. The idea is to allow things like

content:"GoDaddy.com"; ssl_issuer;

07/01/2011-18:00:00.123456 [**] /O=*.openinfosecfoundation.org/OU=Domain Control Validated/CN=*.openinfosecfoundation.org [**] /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 [**] 123.234.56.78:12345 -> 67.19.104.51:443

I think the keywords would make rule-writing easier, and the log may allow us to validate them (retrospectively) and flag up those that don't validate as suspicious.

Actions
Copy link

Also available in: PDF Atom