{"id":13582496,"url":"https://github.com/mozilla/tls-observatory","last_synced_at":"2025-05-15T06:08:20.961Z","repository":{"id":20641939,"uuid":"23923847","full_name":"mozilla/tls-observatory","owner":"mozilla","description":"An observatory for TLS configurations, X509 certificates, and more.","archived":false,"fork":false,"pushed_at":"2024-07-01T08:18:08.000Z","size":183203,"stargazers_count":539,"open_issues_count":66,"forks_count":86,"subscribers_count":53,"default_branch":"master","last_synced_at":"2025-05-13T06:41:25.708Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mozilla.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-09-11T15:23:25.000Z","updated_at":"2025-05-12T06:40:57.000Z","dependencies_parsed_at":"2022-07-07T19:30:54.973Z","dependency_job_id":"a9b5eefd-805e-40de-8eb2-5cba9eb2b67c","html_url":"https://github.com/mozilla/tls-observatory","commit_stats":{"total_commits":960,"total_committers":43,"mean_commits":"22.325581395348838","dds":0.5645833333333333,"last_synced_commit":"7bc42856d2e5594614b56c2f55baf42bb9751b3d"},"previous_names":[],"tags_count":86,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Ftls-observatory","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Ftls-observatory/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Ftls-observatory/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozilla%2Ftls-observatory/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mozilla","download_url":"https://codeload.github.com/mozilla/tls-observatory/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254283350,"owners_count":22045141,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T15:02:46.259Z","updated_at":"2025-05-15T06:08:15.942Z","avatar_url":"https://github.com/mozilla.png","language":"Go","funding_links":[],"categories":["Index","Go"],"sub_categories":["Security"],"readme":"# Mozilla TLS Observatory\n\n[![What's Deployed](https://img.shields.io/badge/whatsdeployed-stage,prod-green.svg)](https://whatsdeployed.io/s-LVL)\n[![CircleCI](https://circleci.com/gh/mozilla/tls-observatory/tree/master.svg?style=svg)](https://circleci.com/gh/mozilla/tls-observatory/tree/master)\n\nThe Mozilla TLS Observatory is a suite of tools for analysis and inspection on Transport Layer Security (TLS) services. The components of TLS Observatory include:\n\n- [EV Checker](https://tls-observatory.services.mozilla.com/static/ev-checker.html) - Tool for Certificate Authorities (CAs) who request a root certificate enabled for Extended Validation (EV).\n- [Certificate Explainer](https://tls-observatory.services.mozilla.com/static/certsplainer.html) - Web UI that parses fields of X.509 certificates\n- `tlsobs` - CLI tool for issuing scans of a website\n- `tlsobs-api` - HTTP webserver receiving website scan requests and displaying results\n- `tlsobs-runner` - Service that schedules website scans\n- `tlsobs-scanner` - Service that performs scans and analysis of websites\n\nWant the WebUI? Check out [Mozilla's Observatory](https://observatory.mozilla.org) !\n\n* [Mozilla TLS Observatory](#mozilla-tls-observatory)\n  * [Getting started](#getting-started)\n    * [Using the tlsobs client from Docker](#using-the-tlsobs-client-from-docker)\n  * [Developing](#developing)\n    * [Create the database](#create-the-database)\n    * [Starting the API and Scanner](#starting-the-api-and-scanner)\n    * [Run a scan locally](#run-a-scan-locally)\n    * [Configuration](#configuration)\n      * [tlsobs-api](#tlsobs-api)\n      * [tlsobs-scanner](#tlsobs-scanner)\n      * [tlsobs-runner](#tlsobs-runner)\n  * [API Endpoints](#api-endpoints)\n    * [POST /api/v1/scan](#post-apiv1scan)\n    * [GET /api/v1/results](#get-apiv1results)\n    * [GET /api/v1/certificate](#get-apiv1certificate)\n    * [POST /api/v1/certificate](#post-apiv1certificate)\n    * [GET /api/v1/paths](#get-apiv1paths)\n    * [GET /api/v1/truststore](#get-apiv1truststore)\n    * [GET /api/v1/issuereecount](#get-apiv1issuereecount)\n    * [GET /api/v1/__heartbeat__](#get-apiv1heartbeat)\n    * [GET /api/v1/__stats__](#get-apiv1stats)\n  * [Database Queries](#database-queries)\n  * [Core contributors](#contributors)\n  * [License](#license)\n\n## Getting started\n\nYou can use the TLS Observatory to compare your site against the mozilla guidelines.\nIt requires Golang 1.15+ to be installed:\n\n```bash\n$ go version\ngo version go1.15 linux/amd64\n\n$ export GOPATH=\"$HOME/go\"\n$ mkdir $GOPATH\n\n$ export PATH=$GOPATH/bin:$PATH\n```\n\nThen get the binary:\n\n```bash\n$ go get github.com/mozilla/tls-observatory/tlsobs\n```\n\nAnd scan using our hosted service:\n\n```bash\n$ tlsobs tls-observatory.services.mozilla.com\nScanning tls-observatory.services.mozilla.com (id 13528951)\nRetrieving cached results from 20h33m1.379461888s ago. To run a new scan, use '-r'.\n\n--- Certificate ---\nSubject  C=US, O=Mozilla Corporation, CN=tls-observatory.services.mozilla.com\nSubjectAlternativeName\n- tls-observatory.services.mozilla.com\nValidity 2016-01-20T00:00:00Z to 2017-01-24T12:00:00Z\nSHA1     FECA3CA0F4B726D062A76F47635DD94A37985105\nSHA256   315A8212CBDC76FF87AEB2161EDAA86E322F7C18B27152B5CB9206297F3D3A5D\nSigAlg   ECDSAWithSHA256\nKey      ECDSA 384bits P-384\nID       1281826\n\n--- Trust ---\nMozilla Microsoft Apple Android\n   ✓        ✓       ✓      ✓\n\n--- Chain of trust ---\nC=US, O=Mozilla Corporation, CN=tls-observatory.services.mozilla.com (id=1281826)\n└──C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA (id=5922)\n   └──C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA (id=41)\n\n\n\n--- Ciphers Evaluation ---\nprio cipher                        protocols pfs                curves\n1    ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2   ECDH,P-256,256bits prime256v1\n2    ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2   ECDH,P-256,256bits prime256v1\nOCSP Stapling        false\nServer Side Ordering true\nCurves Fallback      false\n\n--- Analyzers ---\n* Mozilla evaluation: modern\n  - for modern level: consider adding ciphers ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, ECDHE-RSA-CHACHA20-POLY1305, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES256-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-RSA-AES128-SHA256\n  - for modern level: consider enabling OCSP stapling\n  - for modern level: increase priority of ECDHE-ECDSA-AES256-GCM-SHA384 over ECDHE-ECDSA-AES128-GCM-SHA256\n  - for modern level: fix ciphersuite ordering, use recommended modern ciphersuite\n  - oldest clients: Firefox 27, Chrome 30, IE 11 on Windows 7, Edge 1, Opera 17, Safari 9, Android 5.0, Java 8\n* Grade: A (93/100)\n```\n\nThe analysis at the end tell you what need to be changed to reach the old, intermediate or modern level. We recommend to target the intermediate level by default, and modern if you don't care about old clients.\n\n### Using the tlsobs client from Docker\n\nA docker container also exists that contains the CLI, API, Scanner and Runner.\nFetch is from `docker pull mozilla/tls-observatory`.\n\n```bash\n$ docker pull mozilla/tls-observatory\n$ docker run -it mozilla/tls-observatory tlsobs accounts.firefox.com\n```\n\n## Developing\n\nYou can use the Kubernetes configuration provided in https://github.com/mozilla/tls-observatory/tree/master/kubernetes , or alternatively, you can do the following:\n\nYou can use the `mozilla/tls-observatory` docker container for development:\n\n```bash\n$ docker pull mozilla/tls-observatory\n$ docker run -it mozilla/tls-observatory /bin/bash\nroot@05676e6789dd:~# cd $GOPATH/src/github.com/mozilla/tls-observatory\nroot@05676e6789dd:/go/src/github.com/mozilla/tls-observatory# make\n```\n\nHowever, even with the docker container, you will need to setup your own\npostgresql database. See below.\n\nTo build a development environment from scratch, you will need Go 1.15 or above.\nYou can set it up on your own machine or via the `golang:1.15` Docker\ncontainer.\n\nRetrieve a copy of the source code using `go get`, to place it directly\nunder `$GOPATH/src/github.com/mozilla/tls-observatory`, then use `make`\nto build all components.\n\n```bash\n$ docker run -it golang:1.15\n\nroot@c63f11b8852b:/go# go get github.com/mozilla/tls-observatory\npackage github.com/mozilla/tls-observatory: no buildable Go source files in /go/src/github.com/mozilla/tls-observatory\n\nroot@c63f11b8852b:/go# cd $GOPATH/src/github.com/mozilla/tls-observatory\n\nroot@c63f11b8852b:/go/src/github.com/mozilla/tls-observatory# make\n```\n\n`make` runs the tests and compiles the scanner, api, command line client\nand runner. The resulting binaries are placed under `$GOPATH/bin`.\n\n### Create the database\n\nTLS Observatory uses PostgreSQL \u003e 9.4. To create a database, use the\nschema in `database/schema.sql`.\n\n```bash\npostgres=# create database observatory;\nCREATE DATABASE\n\npostgres=# \\c observatory\nYou are now connected to database \"observatory\" as user \"postgres\".\n\npostgres=# \\i /go/src/github.com/mozilla/tls-observatory/database/schema.sql\n```\n\nThis automatically creates all tables, indexes, users and grants to work\nwith the default configuration.\n\n### Starting the API and Scanner\n\nFirst symlink the configuration to /etc/observatory and the cipherscan\nexecutable to /opt/cipherscan, as follows:\n\n```bash\nroot@c63f11b8852b:/# ln -s $GOPATH/src/github.com/mozilla/tls-observatory/conf /etc/tls-observatory\nroot@c63f11b8852b:/# ln -s $GOPATH/src/github.com/mozilla/tls-observatory/cipherscan /opt/cipherscan\n```\n\nThen start `tlsobs-api` and `tlsobs-scanner`. The API will listen on port 8083,\non localhost (or 172.17.0.2 if you're running in Docker).\n\n### Run a scan locally\n\nTo run a scan using the local scanner, set the `-observatory` flag of the `tlsobs`\nclient to use the local API, as follows:\n\n```bash\n$ tlsobs -observatory http://172.17.0.2:8083 ulfr.io\n```\n\n### Configuration\n\n#### tlsobs-api\n\nCustomize the configuration file under `conf/api.cfg` and using the following\nenvironment variables:\n\n* `TLSOBS_API_ENABLE` set to `on` or `off` to enable or disable the API\n* `TLSOBS_POSTGRES` is the hostname or IP of the database server (eg. `mypostgresdb.example.net`)\n* `TLSOBS_POSTGRESDB` is the name of the database (eg. `observatory`)\n* `TLSOBS_POSTGRESUSER` is the database user (eg. `tlsobsapi`)\n* `TLSOBS_POSTGRESPASS` is the database user password (eg. `mysecretpassphrase`)\n\n#### tlsobs-scanner\n\nCustomize the configuration file under `conf/scanner.cfg` and using the\nfollowing environment variables:\n\n* `TLS_AWSCERTLINT_DIR` set where awslabs/certlint directory exists\n* `TLSOBS_SCANNER_ENABLE` set to `on` or `off` to enable or disable the scabber\n* `TLSOBS_POSTGRES` is the hostname or IP of the database server (eg. `mypostgresdb.example.net`)\n* `TLSOBS_POSTGRESDB` is the name of the database (eg. `observatory`)\n* `TLSOBS_POSTGRESUSER` is the database user (eg. `tlsobsscanner`)\n* `TLSOBS_POSTGRESPASS` is the database user password (eg. `mysecretpassphrase`)\n\n#### tlsobs-runner\n\nRuns regular tests against target sites and sends notifications.\n\nSee `conf/runner.yaml` for an example of configuration. Some configuration\nparameters can also be provided through environment variables:\n\n* `TLSOBS_RUNNER_SMTP_HOST` is the hostname of the smtp server (eg. `mypostfix.example.net`)\n* `TLSOBS_RUNNER_SMTP_PORT` is the port of the smtp server (eg. `587`)\n* `TLSOBS_RUNNER_SMTP_FROM` is the from address of email notifications sent by the runner (eg. `mynotification@tlsobservatory.example.net`)\n* `TLSOBS_RUNNER_SMTP_AUTH_USER` is the smtp authenticated username (eg `tlsobsrunner`)\n* `TLSOBS_RUNNER_SMTP_AUTH_PASS` is the smtp user password (eg. `mysecretpassphrase`)\n* `TLSOBS_RUNNER_SLACK_WEBHOOK` is the slack webhook (eg. `https://hooks.slack.com/services/not/a/realwebhook`)\n* `TLSOBS_RUNNER_SLACK_USERNAME` is the what the message sender's username will be (eg. `tlsbot`)\n* `TLSOBS_RUNNER_SLACK_ICONEMOJI` is the what the message sender's icon will be (eg. `:telescope:`)\n\n## API Endpoints\n\n### POST /api/v1/scan\n\nSchedule a scan of a given target.\n\n```bash\n$ curl -X POST 'https://tls-observatory.services.mozilla.com/api/v1/scan?target=ulfr.io\u0026rescan=true'\n```\n\n**Parameters**:\n\n* `target` is the FQDN of the target site. eg. `google.com`. Do not use protocol handlers or query strings.\n* `rescan` asks for a rescan of the target when set to true.\n* `params` JSON object in which each key represents one of TLS Observatory's workers. The value under each key will be passed as the parameters to the corresponding worker. For example, `{\"ev-checker\": {\"oid\": \"foo\"}}` will pass `{\"oid\": \"foo\"}` to the ev-checker worker. The following workers accept parameters:\n  * ev-checker: Expects a JSON object with the following keys:\n    * oid: the oid of the EV policy to check\n    * rootCertificate: the root certificate to check against, in PEM format\n\nFor example, with curl:\n\n```\ncurl -X POST \"http://localhost:8083/api/v1/scan?target=mozilla.org\u0026rescan=true\u0026params=%7B%0A%20%20%22ev-checker%22%3A%20%7B%0A%20%20%22rootcertificate%22%3A%20%22-----BEGIN%20CERTIFICATE-----%5CnMIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs%5CnMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3%5Cnd3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j%5CnZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL%5CnMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3%5CnLmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug%5CnRVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm%5Cn%2B9S75S0tMqbf5YE%2Fyc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW%5CnPNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG%2B%2BMXs2ziS4wblCJEM%5CnxChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB%5CnIk5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx%2BmM0aBhakaHPQNAQTXKFx01p8VdteZOE3%5CnhzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg%5CnEsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH%2FBAQDAgGGMA8GA1UdEwEB%2FwQF%5CnMAMBAf8wHQYDVR0OBBYEFLE%2Bw2kD%2BL9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA%5CnFLE%2Bw2kD%2BL9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec%5CnnzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe%2FEW1ntlMMUu4kehDLI6z%5CneM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF%5CnhS9OMPagMRYjyOfiZRYzy78aG6A9%2BMpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2%5CnYzi9RKR%2F5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2%2FS6cCZdkGCe%5CnvEsXCS%2B0yx5DaMkHJ8HSXPfqIbloEpw8nL%2Be%2FIBcm2PN7EeqJSdnoDfzAIJ9VNep%5Cn%2BOkuE6N36B9K%5Cn-----END%20CERTIFICATE-----%22%2C%0A%20%20%22oid%22%3A%20%222.16.840.1.114412.22.1%22%0A%7D%0A%7D\"\n```\n\n**Output**: a `json` document containing the Scan ID.\n\n**Caching**: When `rescan` is not `true`, if a scan of the target was done over the last 24 hours, the scan ID is returned. Use `rescan=true` to force a rescan within 24 hours of the previous scan.\n\n**Rate Limits**: Each target can only be scanned every 3 minutes with `rescan=true`.\n\n### GET /api/v1/results\n\nRetrieve scan results by its ID.\n\n```bash\ncurl https://tls-observatory.services.mozilla.com/api/v1/results?id=12302333\n```\n\n**Parameters**:\n\n* `id` is the Scan ID\n\n**Output**: a `json` document containing the scan results and the ID of the end-entity certificate.\n\n### GET /api/v1/certificate\n\nRetrieve a certificate by its ID.\n\n```bash\ncurl https://tls-observatory.services.mozilla.com/api/v1/certificate?id=1\n```\n\n**Parameters**:\n\n* `id` is the Certificate ID\n* `sha256` the hexadecimal checksum of the DER certificate (only if `id` is not\n  provided)\n\n**Output**: a `json` document containing the parsed certificate and its raw X509 version encoded with base64.\n\n### POST /api/v1/certificate\n\nPublish a certificate.\n\n```bash\ncurl -X POST -F certificate=@example.pem https://tls-observatory.services.mozilla.com/api/v1/certificate\n```\n\n**Parameters**:\n\n* `certificate` is a POST multipart/form-data parameter that contains the PEM encoded certificate.\n\n**Output**: a `json` document containing the parsed certificate and its raw X509 version encoded with base64.\n\n**Caching**: Certificates are only stored once. The database uses the SHA256 hash of the DER (binary) certificate to identify duplicates. Posting a certificate already stored in database returns the stored version.\n\n### GET /api/v1/paths\n\nRetrieve the paths from a certificate to one of multiple roots.\n\n```bash\ncurl https://tls-observatory.services.mozilla.com/api/v1/paths?id=1\n```\n\n**Parameters**:\n\n* `id` is the ID of the certificate to start the path at.\n* `sha256` the hexadecimal checksum of the DER certificate (only if `id` is not\n  provided)\n\n**Output**: a `json` document containing the paths document. Each entry in the path contains the current certificate and an array of parents, if any exist.\n\n### GET /api/v1/truststore\n\nRetrieve all the certificates in a given truststore.\n\n```bash\ncurl https://tls-observatory.services.mozilla.com/api/v1/truststore?store=mozilla\u0026format=pem\n```\n\n**Parameters**:\n\n* `store` is the store to retrieve certificates from. \"mozilla\", \"android\", \"apple\", \"microsoft\" and \"ubuntu\" are allowed.\n* `format`, either \"pem\" or \"json\".\n\n**Output**: if `format` is pem, a series of PEM-format certificates. If `format` is json, a json array of certificate objects, each with the same format of `/api/v1/certificate`.\n\n### GET /api/v1/issuereecount\n\nRetrieve the count of end-entity certificates that chain to the specified certificate. This is used to evaluate weight of a given issuer in the web pki.\n\n```bash\ncurl https://tls-observatory.services.mozilla.com/api/v1/issuereecount?id=1\n```\n\n**Parameters**:\n\n* `id` is the ID of the certificate to start the path at.\n* `sha256` the hexadecimal checksum of the DER certificate (only if `id` is not\n  provided)\n\n**Output**: a `json` document containing the certificate itself under `issuer` and the count of end-entity certs under `eecount`.\n\n\n### GET /api/v1/__heartbeat__\n\nReturns a 200 OK.\n\n```bash\ncurl https://tls-observatory.services.mozilla.com/api/v1/__heartbeat__\nI iz alive.\n```\n\n### GET /api/v1/__stats__\n\nReturns usage statistics in json (default) or text format.\n\nBy default, this endpoint returns stale data, refreshed the last time the\nendpoint was called, so it's possible to not have the latest available\nstatistics. Use the query parameter `details=full` to get the real-time stats,\nbut be aware that this is expensive and often times out.\n\n```bash\ncurl https://tls-observatory.services.mozilla.com/api/v1/__stats__?format=text\u0026details=full\n\npending scans: 7\n\nlast 24 hours\n-------------\n- distinct targets: 21873\n- certs seen:       16459\n- certs added:      7886\n\nhourly scans\n------------\n2017-02-08T15:00:00Z    5\n2017-02-08T14:00:00Z    64\n2017-02-08T13:00:00Z    928\n2017-02-08T12:00:00Z    1969\n2017-02-08T11:00:00Z    1957\n2017-02-08T10:00:00Z    1982\n2017-02-08T09:00:00Z    2013\n2017-02-08T08:00:00Z    2031\n2017-02-08T07:00:00Z    2153\n2017-02-08T06:00:00Z    1860\n2017-02-08T05:00:00Z    1869\n2017-02-08T04:00:00Z    1944\n2017-02-08T03:00:00Z    1959\n2017-02-08T02:00:00Z    907\n2017-02-08T01:00:00Z    32\n2017-02-08T00:00:00Z    55\n2017-02-07T23:00:00Z    41\n2017-02-07T22:00:00Z    46\n2017-02-07T21:00:00Z    60\n2017-02-07T20:00:00Z    76\n2017-02-07T19:00:00Z    66\n2017-02-07T18:00:00Z    67\n2017-02-07T17:00:00Z    56\n```\n\n## Database Queries\n\n### Find certificates signed by CAs identified by their SHA256 fingerprint\n\n```sql\nSELECT certificates.id, certificates.subject, certificates.issuer\nFROM certificates INNER JOIN trust ON (certificates.id=trust.cert_id)\nWHERE trust.issuer_id in (\n    SELECT id FROM certificates\n    WHERE sha256_fingerprint IN (\n        'E7685634EFACF69ACE939A6B255B7B4FABEF42935B50A265ACB5CB6027E44E70',\n        'A4B6B3996FC2F306B3FD8681BD63413D8C5009CC4FA329C2CCF0E2FA1B140305'\n    ))\nAND certificates.is_ca='false';\n```\n\n### List signature algorithms of trusted certs\n\n```sql\nSELECT signature_algo, count(*)\nFROM certificates INNER JOIN trust ON (certificates.id=trust.cert_id)\nWHERE is_ca='false'\nAND trust.trusted_mozilla='true'\nGROUP BY signature_algo\nORDER BY count(*) DESC;\n```\n\n### Show expiration dates of trusted SHA-1 certificates\n\n```sql\nSELECT  extract('year' FROM date_trunc('year', not_valid_after)) as expiration_year,\n        extract('month' FROM date_trunc('month', not_valid_after)) as expiration_month,\n        count(*)\nFROM    certificates\n    INNER JOIN trust ON (certificates.id=trust.cert_id)\nWHERE is_ca='false'\n    AND trust.trusted_mozilla='true'\n    AND signature_algo='SHA1WithRSA'\nGROUP BY date_trunc('year', not_valid_after),\n         date_trunc('month', not_valid_after)\nORDER BY date_trunc('year', not_valid_after) ASC,\n         date_trunc('month', not_valid_after) ASC;\n```\n\n### Count trusted SHA-1 certs seen over the last month on TOP1M sites\n\n```sql\nSELECT distinct(certificates.id) as \"id\", cisco_umbrella_rank, domains, not_valid_before, not_valid_after, last_seen, signature_algo\nFROM certificates\n    INNER JOIN trust ON (certificates.id=trust.cert_id)\nWHERE is_ca='false'\n    AND trust.trusted_mozilla='true'\n    AND signature_algo='SHA1WithRSA'\n    AND cisco_umbrella_rank \u003c 1000000\n    AND last_seen \u003e NOW() - INTERVAL '1 month'\n    AND not_valid_after \u003e NOW()\nORDER BY cisco_umbrella_rank ASC;\n```\n\n### List issuer, subject and SAN of Mozilla|Firefox certs not issued by Digicert\n\n```sql\nSELECT certificates.id,\n       issuer-\u003e'o'-\u003e\u003e0 AS Issuer,\n       subject-\u003e\u003e'cn' AS Subject,\n       san AS SubjectAltName\nFROM certificates\n      INNER JOIN trust ON (trust.cert_id=certificates.id),\n     jsonb_array_elements_text(x509_subjectAltName) AS san\nWHERE jsonb_typeof(x509_subjectAltName) != 'null'\n      AND ( subject#\u003e\u003e'{cn}' ~ '\\.(firefox|mozilla)\\.'\n            OR\n            san ~ '\\.(firefox|mozilla)\\.'\n          )\n      AND trust.trusted_mozilla='true'\n      AND certificates.not_valid_after\u003enow()\n      AND cast(issuer#\u003e\u003e'{o}' AS text) NOT LIKE '%DigiCert Inc%'\nGROUP BY certificates.id, san\nORDER BY certificates.id ASC;\n```\n\n### Find count of targets that support the SEED-SHA ciphersuite\n\n```sql\nSELECT COUNT(DISTINCT(target))\nFROM scans, jsonb_array_elements(conn_info-\u003e'ciphersuite') as ciphersuites\nWHERE jsonb_typeof(conn_info) != 'null'\nAND ciphersuites-\u003e\u003e'cipher'='SEED-SHA';\n```\n\n### Find intermediate CA certs whose root is trusted by Mozilla\n\n```sql\nSELECT id, subject\nFROM certificates\nWHERE is_ca=True\n  AND subject!=issuer\n  AND issuer IN (\n      SELECT subject\n      FROM certificates\n      WHERE in_mozilla_root_store=True\n  )\nGROUP BY subject, sha256_fingerprint;\n```\n\n### Find CA certs treated as EV in Firefox\n\nThe list is CA Certs that get EV treatment in Firefox can be [found here](https://dxr.mozilla.org/mozilla-central/source/security/certverifier/ExtendedValidation.cpp).\n\n```sql\nSELECT id, subject\nFROM certificates,\n     jsonb_array_elements_text(x509_certificatePolicies) AS cpol\nWHERE jsonb_typeof(x509_certificatePolicies) != 'null'\n  AND cpol IN ('1.2.392.200091.100.721.1','1.2.616.1.113527.2.5.1.1','1.3.159.1.17.1',\n               '1.3.6.1.4.1.13177.10.1.3.10','1.3.6.1.4.1.13769.666.666.666.1.500.9.1',\n               '1.3.6.1.4.1.14370.1.6','1.3.6.1.4.1.14777.6.1.1','1.3.6.1.4.1.14777.6.1.2',\n               '1.3.6.1.4.1.17326.10.14.2.1.2','1.3.6.1.4.1.17326.10.8.12.1.2',\n               '1.3.6.1.4.1.22234.2.14.3.11','1.3.6.1.4.1.22234.2.5.2.3.1',\n               '1.3.6.1.4.1.22234.3.5.3.1','1.3.6.1.4.1.22234.3.5.3.2','1.3.6.1.4.1.23223.1.1.1',\n               '1.3.6.1.4.1.29836.1.10','1.3.6.1.4.1.34697.2.1','1.3.6.1.4.1.34697.2.2',\n               '1.3.6.1.4.1.34697.2.3','1.3.6.1.4.1.34697.2.4','1.3.6.1.4.1.36305.2',\n               '1.3.6.1.4.1.40869.1.1.22.3','1.3.6.1.4.1.4146.1.1','1.3.6.1.4.1.4788.2.202.1',\n               '1.3.6.1.4.1.6334.1.100.1','1.3.6.1.4.1.6449.1.2.1.5.1','1.3.6.1.4.1.782.1.2.1.8.1',\n               '1.3.6.1.4.1.7879.13.24.1','1.3.6.1.4.1.8024.0.2.100.1.2','2.16.156.112554.3',\n               '2.16.528.1.1003.1.2.7','2.16.578.1.26.1.3.3','2.16.756.1.83.21.0',\n               '2.16.756.1.89.1.2.1.1','2.16.756.5.14.7.4.8','2.16.792.3.0.3.1.1.5',\n               '2.16.792.3.0.4.1.1.4','2.16.840.1.113733.1.7.23.6','2.16.840.1.113733.1.7.48.1',\n               '2.16.840.1.114028.10.1.2','2.16.840.1.114404.1.1.2.4.1','2.16.840.1.114412.2.1',\n               '2.16.840.1.114413.1.7.23.3','2.16.840.1.114414.1.7.23.3')\n  AND is_ca='true';\n```\n\n### Evaluate the quality of TLS configurations of top sites\n\nThis query uses the top1m ranking analyzer to retrieve the Mozilla evaluation of top sites.\n\n```sql\nobservatory=\u003e SELECT COUNT(DISTINCT(target)), output-\u003e\u003e'level' AS \"Mozilla Configuration\"\nFROM scans\n  INNER JOIN analysis ON (scans.id=analysis.scan_id)\nWHERE has_tls=true\n  AND target IN ( SELECT target\n                  FROM scans\n                  INNER JOIN analysis ON (scans.id=analysis.scan_id)\n                  WHERE worker_name='top1m'\n                    AND CAST(output-\u003e'target'-\u003e\u003e'rank' AS INTEGER) \u003c 10000\n                    AND timestamp \u003e NOW() - INTERVAL '1 month')\n  AND worker_name='mozillaEvaluationWorker'\n  AND timestamp \u003e NOW() - INTERVAL '1 month'\nGROUP BY has_tls, output-\u003e\u003e'level'\nORDER BY COUNT(DISTINCT(target)) DESC;\n\n count | Mozilla Configuration\n-------+-----------------------\n  3689 | intermediate\n  1906 | non compliant\n  1570 | bad\n    15 | old\n(4 rows)\n\n```\n\n### Count Top 1M sites that support RC4\n```sql\nSELECT COUNT(DISTINCT(target))\nFROM scans,\n     jsonb_array_elements(conn_info-\u003e'ciphersuite') as ciphersuites\nWHERE jsonb_typeof(conn_info) = 'object'\n  AND jsonb_typeof(conn_info-\u003e'ciphersuite') = 'array'\n  AND ciphersuites-\u003e\u003e'cipher' LIKE 'RC4-%'\n  AND target IN ( SELECT target\n                  FROM scans\n                       INNER JOIN analysis ON (scans.id=analysis.scan_id)\n                  WHERE worker_name='top1m'\n                    AND CAST(output-\u003e'target'-\u003e\u003e'rank' AS INTEGER) \u003c 1000000\n                    AND timestamp \u003e NOW() - INTERVAL '1 month')\n  AND timestamp \u003e NOW() - INTERVAL '1 month';\n  ```\n\n### Count Top 1M sites that support TLSv1.2\n```sql\nSELECT ciphersuites-\u003e'protocols' @\u003e '[\"TLSv1.2\"]'::jsonb AS \"Support TLS 1.2\", COUNT(DISTINCT(target))\nFROM scans,\n     jsonb_array_elements(conn_info-\u003e'ciphersuite') as ciphersuites\nWHERE jsonb_typeof(conn_info) = 'object'\n  AND jsonb_typeof(conn_info-\u003e'ciphersuite') = 'array'\n  AND target IN ( SELECT target\n                  FROM scans\n                       INNER JOIN analysis ON (scans.id=analysis.scan_id)\n                  WHERE worker_name='top1m'\n                    AND CAST(output-\u003e'target'-\u003e\u003e'rank' AS INTEGER) \u003c 1000000\n                    AND timestamp \u003e NOW() - INTERVAL '1 month')\n  AND timestamp \u003e NOW() - INTERVAL '1 month'\nGROUP BY ciphersuites-\u003e'protocols' @\u003e '[\"TLSv1.2\"]'::jsonb;\n```\n\n### Count end-entity certificates by issuer organizations\n```sql\nSELECT COUNT(*), issuer#\u003e'{o}'-\u003e\u003e0\nFROM certificates\n  INNER JOIN trust ON (certificates.id=trust.cert_id)\nWHERE certificates.is_ca = false\n  AND trust.trusted_mozilla=true\n  AND trust.is_current = true\nGROUP BY issuer#\u003e'{o}'-\u003e\u003e0\nORDER BY count(*) DESC;\n```\n\n### Count sites in the top 10k that are impacted by the Symantec distrust in Firefox 60\nnote: in Firefox 63, the not_valid_before condition will be removed\n```sql\nSELECT COUNT(DISTINCT(target))\nFROM scans\n  INNER JOIN analysis ON (scans.id=analysis.scan_id)\n  INNER JOIN certificates ON (scans.cert_id=certificates.id)\nWHERE has_tls=true\n  AND target IN ( SELECT target\n                  FROM scans\n                  INNER JOIN analysis ON (scans.id=analysis.scan_id)\n                  WHERE worker_name='top1m'\n                    AND CAST(output-\u003e'target'-\u003e\u003e'rank' AS INTEGER) \u003c 10000\n                    AND timestamp \u003e NOW() - INTERVAL '1 week')\n  AND worker_name='symantecDistrust'\n  AND timestamp \u003e NOW() - INTERVAL '1 week'\n  AND not_valid_before \u003c '2016-06-01'\nGROUP BY has_tls, output-\u003e\u003e'isDistrusted'\nORDER BY COUNT(DISTINCT(target)) DESC;\n```\n\n## Contributing\n\nWe're always happy to help new contributors. You can find us in `#observatory` on `irc.mozilla.org` ([Mozilla Wiki](https://wiki.mozilla.org/IRC)).\n\n### Dependencies\n\nWe currently vendor dependencies in `vendor/`.\n\nUsing a golang version with [`go mod`](https://golang.org/ref/mod#mod-commands),run `make vendor` update vendored dependencies.\n\n## Contributors\n\n * Julien Vehent\n * Dimitris Bachtis (original dev)\n * Adrian Utrilla\n\n## License\n\n * Mozilla Public License Version 2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozilla%2Ftls-observatory","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmozilla%2Ftls-observatory","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozilla%2Ftls-observatory/lists"}