TLS 1.3 — handshake, certificate chain, আর ভরসার গণিত

openssl subprocess-এ — crypto-library dependency নেই:

#!/usr/bin/env python3
"""cert_chain.py DOMAIN [WARN_DAYS] — chain tree + expiry + SAN check"""
import datetime, re, subprocess, sys


def pem_certs(host, port=443):
    out = subprocess.run(
        ['openssl', 's_client', '-connect', f'{host}:{port}',
         '-servername', host, '-showcerts'],
        input='', capture_output=True, text=True, timeout=15).stdout
    return re.findall(r'-----BEGIN CERTIFICATE-----.*?'
                      r'-----END CERTIFICATE-----', out, re.S)


def describe(pem):
    out = subprocess.run(
        ['openssl', 'x509', '-noout', '-subject', '-issuer',
         '-startdate', '-enddate', '-ext', 'subjectAltName'],
        input=pem + '\n', capture_output=True, text=True).stdout
    d = {}
    for line in out.strip().splitlines():
        if '=' in line:
            k, _, v = line.partition('=')
            d[k.split()[-1]] = v.strip()
    d['sans'] = [s[4:] for s in re.findall(r'DNS:[^,\s]+', out)]
    return d


def days_left(not_after):
    dt = datetime.datetime.strptime(not_after, '%b %d %H:%M:%S %Y %Z')
    return (dt.replace(tzinfo=datetime.timezone.utc)
            - datetime.datetime.now(datetime.timezone.utc)).days


def matches(host, sans):
    for san in sans:
        if san.startswith('*.') and host.endswith(san[1:]) \
                and host.count('.') > san.count('.'):
            return True
        if san == host:
            return True
    return False


host = sys.argv[1] if len(sys.argv) > 1 else 'example.com'
warn = int(sys.argv[2]) if len(sys.argv) > 2 else 30
certs = pem_certs(host)
if not certs:
    sys.exit(f'{host}: handshake/certificate পাওয়া যায়নি')

names = ['LEAF'] + [f'intermediate {i}' for i in range(1, len(certs))] \
        + ['ROOT']
print(f'{host}-এর chain ({len(certs)} certs):\n')
for i, pem in enumerate(certs):
    c = describe(pem)
    left = days_left(c['enddate'])
    flag = 'EXPIRING-SOON!' if left < warn else 'ok'
    print(f'{"    " * i}└─ {names[i]}')
    print(f'{"    " * i}    subject : {c["subject"]}')
    print(f'{"    " * i}    issuer  : {c["issuer"]}')
    if c['sans']:
        print(f'{"    " * i}    SAN     : {", ".join(c["sans"][:6])}')
    print(f'{"    " * i}    expiry  : {c["enddate"]} ({left} দিন) {flag}\n')

leaf = describe(certs[0])
print(f'hostname check : {host} vs SAN → '
      f'{"MATCH" if matches(host, leaf["sans"]) else "MISMATCH"}')
print('root-in-store: s_client-এর Verify return code দেখুন (0 = ok)')

Run:

python3 cert_chain.py github.com 30
# github.com-এর chain (3 certs):
#
# └─ LEAF
#       subject : CN = *.github.com
#       issuer  : CN = Sectigo ECC Domain Validation Secure Server CA
#       SAN     : *.github.com, github.com, *.githubusercontent.com
#       expiry  : Mar 18 23:59:59 2027 GMT (205 দিন) ok
#     └─ intermediate 1 ...
#         └─ ROOT ...
# hostname check : github.com vs SAN → MATCH

নিজে বাড়ান: (১) openssl verify দিয়ে full-chain verification; (২) multi-domain batch mode + monitoring exit-codes; (৩) crt.sh CT-log query — এই domain-এ আর কোন cert issued?