{"id":21573710,"url":"https://github.com/syss-research/clone-cert","last_synced_at":"2025-04-10T16:11:31.446Z","repository":{"id":45745661,"uuid":"84198867","full_name":"SySS-Research/clone-cert","owner":"SySS-Research","description":"Simple shell script to \"clone\" X.509 certificates","archived":false,"fork":false,"pushed_at":"2025-03-24T13:44:05.000Z","size":60,"stargazers_count":100,"open_issues_count":1,"forks_count":38,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-03-24T13:51:25.301Z","etag":null,"topics":["security","tool","x509"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SySS-Research.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-03-07T12:54:05.000Z","updated_at":"2025-03-24T13:44:09.000Z","dependencies_parsed_at":"2022-09-01T22:51:46.112Z","dependency_job_id":null,"html_url":"https://github.com/SySS-Research/clone-cert","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fclone-cert","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fclone-cert/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fclone-cert/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SySS-Research%2Fclone-cert/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SySS-Research","download_url":"https://codeload.github.com/SySS-Research/clone-cert/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248251020,"owners_count":21072685,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["security","tool","x509"],"created_at":"2024-11-24T12:07:45.968Z","updated_at":"2025-04-10T16:11:31.432Z","avatar_url":"https://github.com/SySS-Research.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"clone-cert.sh\n=============\n\nThis is a simple shell script that retrieves the X.509 certificate\nassociated with a TLS wrapped TCP port and uses `openssl` to create a\nsimilar certificate by replacing the public key and fixing the signature.\n\nThis is particularly useful if you want to demonstrate why self-signed\ncertificates cannot provide any security. Of course, the fingerprint of the\ncloned certificate will be different... but who checks the fingerprint of a\nself-signed certificate by hand?\n\nYou can also clone certificates that are not self-signed. In that case, the\nserial number is replaced by a newly generated one (because browsers keep\ntrack of the serial numbers they encounter and will notice that something\nfishy is going on), and the issuer is changed (for the same reason). The\nfake issuer will have the first capital letter O replace by a zero or a\nlower case L replaced by a capital i or have the last character replaced by\na space and will thus look inconspicuous to a casual observer.\n\nThe new fake issueing CA will be generated on the fly unless you provide\none.\n\nCertificates containing either an RSA or an EC public key are supported.\nSNI is also supported. Run `./clone-cert.sh` for more information about the\nusage.\n\nExample\n-------\n\nRun the script:\n\n    $ ./clone-cert.sh www.example.com:443\n    /tmp/www.example.com:443_0.key\n    /tmp/www.example.com:443_0.cert\n\nThe new certificate is in `/tmp/www.example.com:443_0.cert` and the corresponding\nprivate key is in `/tmp/www.example.com:443_0.key`. Their difference is only in\nthe RSA modulus and the signature:\n\n\t$ diff \u003c(openssl x509 -in /tmp/www.example.com:443_0.cert -noout -text) \\\n           \u003c(openssl s_client -connect www.example.com:443 \u003c /dev/null 2\u003e /dev/null \\\n             | openssl x509 -noout -text)\n\t16,33c16,33\n\t\u003c                     00:c3:59:26:a5:ed:1c:2b:75:3a:0c:a2:ab:49:43:\n\t\u003c                     e8:1a:cd:24:64:4a:11:5a:fe:94:10:57:2a:af:f6:\n\t\u003c                     28:a0:0a:32:3e:09:a2:1c:60:f0:39:62:40:78:3b:\n\t\u003c                     9f:69:0e:ca:64:71:72:f5:00:16:ba:63:57:2b:85:\n\t\u003c                     dd:fb:2b:93:28:7f:fe:77:9f:a6:ff:6e:38:9b:65:\n\t\u003c                     94:c4:34:59:53:33:4d:47:58:88:e1:fb:55:c8:48:\n\t\u003c                     6d:19:e6:f3:84:6d:34:cd:93:88:e5:d2:70:2c:bc:\n\t\u003c                     cd:d6:f3:56:8a:7f:04:a5:b5:c6:8c:bd:f2:b5:ef:\n\t\u003c                     d5:c7:ab:5a:83:ea:f2:b9:f6:9f:9e:73:55:bf:a2:\n\t\u003c                     14:03:f4:01:3c:11:48:9c:da:69:7e:e4:9c:01:5b:\n\t\u003c                     a7:03:2d:6c:dc:62:4a:72:ba:a5:18:5b:d5:64:4e:\n\t\u003c                     8a:65:b5:f1:6f:fa:76:eb:8e:c0:5d:4a:44:bf:65:\n\t\u003c                     6e:55:b1:1d:b4:dc:3f:56:db:5e:e4:2a:8b:e4:21:\n\t\u003c                     53:90:28:87:14:85:9e:93:82:3b:3a:e0:0f:fc:b5:\n\t\u003c                     35:46:52:db:6e:6e:11:68:78:9b:07:02:7d:12:49:\n\t\u003c                     e9:8a:47:07:f9:74:59:5d:4f:13:b2:40:6b:82:b1:\n\t\u003c                     08:ef:62:ef:92:b7:67:2d:6e:10:33:2f:8d:e8:aa:\n\t\u003c                     25:2f\n\t---\n\t\u003e                     00:b3:40:96:2f:61:63:3e:25:c1:97:ad:65:45:fb:\n\t\u003e                     ef:13:42:b3:2c:99:86:f4:b5:80:0b:76:dc:06:38:\n\t\u003e                     2c:1f:a3:62:55:5a:36:76:de:ae:5d:fc:e2:e5:b4:\n\t\u003e                     e6:ec:5d:ca:ee:ca:df:50:16:24:2c:ee:fc:9a:b6:\n\t\u003e                     8c:f6:a8:b3:ac:7a:08:7b:2a:1f:ad:5f:e7:fa:96:\n\t\u003e                     59:25:ab:90:b0:f8:c2:3f:13:04:26:74:68:0f:c6:\n\t\u003e                     78:2a:95:8a:5f:42:f2:0e:ed:52:a6:eb:68:23:89:\n\t\u003e                     e5:43:f8:6d:12:1b:62:42:7b:a8:05:f3:59:c4:5e:\n\t\u003e                     d6:c5:cc:46:c0:4b:19:b9:2d:4a:71:72:24:1e:5e:\n\t\u003e                     55:44:93:ab:78:a1:47:4d:a5:dc:07:5a:9c:67:f4:\n\t\u003e                     11:68:12:2f:d3:28:71:bc:ad:72:05:3c:16:75:d4:\n\t\u003e                     f8:72:58:ba:19:f1:dc:09:ed:f1:18:c6:92:2f:7d:\n\t\u003e                     bc:16:0b:37:8d:8a:ef:1b:6f:4f:b9:e0:7a:54:98:\n\t\u003e                     bf:b5:b6:cf:bb:aa:93:7f:0a:7f:1f:56:eb:a9:d8:\n\t\u003e                     e1:db:d5:39:d8:18:5b:d1:f2:64:33:d0:d6:c4:23:\n\t\u003e                     ff:09:ab:6d:71:ce:da:cf:c1:17:9c:23:be:2c:af:\n\t\u003e                     2f:92:1c:3f:90:08:89:58:f2:b1:e1:10:6f:83:2e:\n\t\u003e                     f7:9f\n\t67,81c67,81\n\t\u003c          66:9e:dc:08:c6:81:2e:91:80:d7:7a:27:a9:0f:fb:72:89:53:\n\t\u003c          21:b8:37:e9:f1:d6:d2:e8:98:08:01:29:ef:eb:74:19:30:6f:\n\t\u003c          b0:a0:8d:c3:09:ec:06:cf:65:59:0e:8f:45:a4:8f:70:b2:8a:\n\t\u003c          a3:71:d8:0f:eb:87:95:be:ba:22:76:3d:3c:33:62:c4:28:34:\n\t\u003c          6e:1a:be:de:8e:50:87:95:9c:85:ad:bf:91:b4:06:55:d6:b9:\n\t\u003c          e2:f7:26:a1:5e:b9:57:f4:97:97:0f:08:9e:8f:36:6e:85:9c:\n\t\u003c          aa:69:78:93:c0:aa:2a:ac:62:44:3f:eb:b3:4a:ee:6b:c9:63:\n\t\u003c          91:af:64:3f:8b:f1:b9:15:49:12:12:e4:7a:0f:ac:8c:7e:dc:\n\t\u003c          e8:b3:2b:ad:37:e4:d9:90:34:e0:1d:b8:5e:5c:fb:e2:fa:ed:\n\t\u003c          a2:11:0c:00:5b:e3:29:c6:51:7d:d6:1b:06:73:56:25:fe:20:\n\t\u003c          17:28:bb:dd:5c:8e:a6:bc:cf:a2:cf:56:75:f7:f0:cc:e2:c4:\n\t\u003c          28:57:9b:79:6c:5d:c5:63:0b:a5:47:4d:78:66:5b:0f:36:60:\n\t\u003c          49:70:44:75:0a:d1:76:52:9a:81:ee:02:13:39:ea:cc:a5:a1:\n\t\u003c          45:23:02:91:36:03:e3:46:2e:c8:ce:2c:83:1f:73:b8:e4:96:\n\t\u003c          e3:2b:97:3b\n\t---\n\t\u003e          84:a8:9a:11:a7:d8:bd:0b:26:7e:52:24:7b:b2:55:9d:ea:30:\n\t\u003e          89:51:08:87:6f:a9:ed:10:ea:5b:3e:0b:c7:2d:47:04:4e:dd:\n\t\u003e          45:37:c7:ca:bc:38:7f:b6:6a:1c:65:42:6a:73:74:2e:5a:97:\n\t\u003e          85:d0:cc:92:e2:2e:38:89:d9:0d:69:fa:1b:9b:f0:c1:62:32:\n\t\u003e          65:4f:3d:98:db:da:d6:66:da:2a:56:56:e3:11:33:ec:e0:a5:\n\t\u003e          15:4c:ea:75:49:f4:5d:ef:15:f5:12:1c:e6:f8:fc:9b:04:21:\n\t\u003e          4b:cf:63:e7:7c:fc:aa:dc:fa:43:d0:c0:bb:f2:89:ea:91:6d:\n\t\u003e          cb:85:8e:6a:9f:c8:f9:94:bf:55:3d:42:82:38:4d:08:a4:a7:\n\t\u003e          0e:d3:65:4d:33:61:90:0d:3f:80:bf:82:3e:11:cb:8f:3f:ce:\n\t\u003e          79:94:69:1b:f2:da:4b:c8:97:b8:11:43:6d:6a:25:32:b9:b2:\n\t\u003e          ea:22:62:86:0d:a3:72:7d:4f:ea:57:3c:65:3b:2f:27:73:fc:\n\t\u003e          7c:16:fb:0d:03:a4:0a:ed:01:ab:a4:23:c6:8d:5f:8a:21:15:\n\t\u003e          42:92:c0:34:a2:20:85:88:58:98:89:19:b1:1e:20:ed:13:20:\n\t\u003e          5c:04:55:64:ce:9d:b3:65:fd:f6:8f:5e:99:39:21:15:e2:71:\n\t\u003e          aa:6a:88:82\n\n\nAuthor\n------\n\nAdrian Vollmer, 2017-2019\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsyss-research%2Fclone-cert","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsyss-research%2Fclone-cert","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsyss-research%2Fclone-cert/lists"}