EV check script for domains

--===============5801211682640167929==
Content-Type: multipart/alternative; boundary="000000000000095505064a7dc02f"

--000000000000095505064a7dc02f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hey,

I have been wondering to what websites we can disable tls inspection
automatically.
There are sites like banks which has EV certificates.
It's pretty easy to just allow these sites to not be bumped by squid or any
other DPI systems.
In the past I had an issue with couple appliances which implement DPI and
TLS inspection.
All of them automatically inspect banks and many other sites without any
way other then
manually adding specific domains or ip addresses to the exceptions list.
I have the next example script in python:
```
import ssl
import socket
from cryptography import x509

def analyze_site_security(hostname):
    # 1. Define the standard EV OID
    EV_OID =3D "2.23.140.1.1"

    context =3D ssl.create_default_context()
    try:
        with socket.create_connection((hostname, 443), timeout=3D5) as sock=
:
            with context.wrap_socket(sock, server_hostname=3Dhostname) as
ssock:
                # Get the binary certificate
                bin_cert =3D ssock.getpeercert(binary_form=3DTrue)
                cert =3D x509.load_der_x509_certificate(bin_cert)

                # Extract Organization and Policy OIDs
                subject =3D cert.subject
                org_name =3D next((attr.value for attr in subject if
attr.oid.dotted_string =3D=3D "2.5.4.10"), "N/A")

                # Check for EV OIDs in extensions
                is_ev =3D False
                try:
                    policies =3D
cert.extensions.get_extension_for_oid(x509.oid.ExtensionOID.CERTIFICATE_POL=
ICIES)
                    for policy in policies.value:
                        if policy.policy_identifier.dotted_string =3D=3D EV=
_OID:
                            is_ev =3D True
                except:
                    pass

                return {
                    "site": hostname,
                    "is_ev_certified": is_ev,
                    "organization": org_name,
                    "tls_version": ssock.version(),
                    "likely_pci_entity": is_ev and (ssock.version() in
['TLSv1.2', 'TLSv1.3'])
                }
    except Exception as e:
        return {"error": str(e)}

# Testing it out
print(analyze_site_security("www.paypal.com"))
print(analyze_site_security("www.google.com"))
```

It can be converted and modify a bit to be an external_acl helper or
external service that will get couple details on the connection like ip
address+port+domain and will just trigger a tls inspection bypass for the
relevant sites automatically.

I hope it helps anyone.

Eliezer
----
=D7=90=D7=9C=D7=99=D7=A2=D7=96=D7=A8 =D7=A7=D7=A8=D7=95=D7=99=D7=98=D7=95=
=D7=A8=D7=95
=D7=AA=D7=9E=D7=99=D7=9B=D7=94 =D7=98=D7=9B=D7=A0=D7=99=D7=AA, =D7=9E=D7=A9=
=D7=99=D7=91 =D7=94=D7=A8=D7=95=D7=97 =D7=95=D7=9E=D7=95=D7=A8=D7=99=D7=93 =
=D7=94=D7=92=D7=A9=D7=9D
=D7=A0=D7=99=D7=99=D7=93: 052-8704261
=D7=9E=D7=99=D7=99=D7=9C: [email protected]

--000000000000095505064a7dc02f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hey,<br clear=3D"all"></div><div><br></div><div>I hav=
e been wondering to what websites we can disable tls inspection automatical=
ly.</div><div>There are sites like banks which has EV certificates.<br>It&#=
39;s pretty easy to just allow these sites to not be bumped by squid or any=
 other DPI systems.<br>In the past I had an issue with couple appliances wh=
ich implement=C2=A0DPI and TLS inspection.<br>All of them automatically ins=
pect banks and many other sites without any way other then<br>manually addi=
ng specific domains or ip addresses to the exceptions list.</div><div>I hav=
e the next example script in python:<br>```<br>import ssl<br>import socket<=
br>from cryptography import x509<br><br>def analyze_site_security(hostname)=
:<br>=C2=A0 =C2=A0 # 1. Define the standard EV OID<br>=C2=A0 =C2=A0 EV_OID =
=3D &quot;2.23.140.1.1&quot;<br>=C2=A0 =C2=A0 <br>=C2=A0 =C2=A0 context =3D=
 ssl.create_default_context()<br>=C2=A0 =C2=A0 try:<br>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 with socket.create_connection((hostname, 443), timeout=3D5) as sock=
:<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 with context.wrap_socket(soc=
k, server_hostname=3Dhostname) as ssock:<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 # Get the binary certificate<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 bin_cert =3D ssock.getpeercert(binar=
y_form=3DTrue)<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 c=
ert =3D x509.load_der_x509_certificate(bin_cert)<br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 # Extract Organization and Policy OIDs<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject =3D cert.subject<br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 org_name =3D next((=
attr.value for attr in subject if attr.oid.dotted_string =3D=3D &quot;2.5.4=
.10&quot;), &quot;N/A&quot;)<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 <br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 #=
 Check for EV OIDs in extensions<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 is_ev =3D False<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 try:<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 policies =3D cert.extensions.get_extension_for_oid(x50=
9.oid.ExtensionOID.CERTIFICATE_POLICIES)<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 for policy in policies.value:<br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 if policy.policy_identifier.dotted_string =3D=3D EV_OID:<br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 is_ev =3D True<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 except:<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 pass<br><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 return {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 &quot;site&quot;: hostname,<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &quot;is_ev_certified&=
quot;: is_ev,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 &quot;organization&quot;: org_name,<br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &quot;tls_version&quot;: s=
sock.version(),<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 &quot;likely_pci_entity&quot;: is_ev and (ssock.version() in =
[&#39;TLSv1.2&#39;, &#39;TLSv1.3&#39;])<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 except Exception as e:<br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 return {&quot;error&quot;: str(e)}<br><br># Testin=
g it out<br>print(analyze_site_security(&quot;<a href=3D"http://www.paypal.=
com">www.paypal.com</a>&quot;))<br>print(analyze_site_security(&quot;<a hre=
f=3D"http://www.google.com">www.google.com</a>&quot;))<br>```<br><br>It can=
 be converted and modify=C2=A0a bit to be an external_acl helper or externa=
l service that will get couple details on the connection like ip address+po=
rt+domain and will just trigger a tls inspection bypass for the relevant si=
tes automatically.<br><br>I hope it helps anyone.<br><br>Eliezer</div><div>=
<div dir=3D"rtl" class=3D"gmail_signature" data-smartmail=3D"gmail_signatur=
e"><div dir=3D"ltr"><div dir=3D"rtl" style=3D"color:rgb(34,34,34)">----</di=
v><div dir=3D"rtl" style=3D"color:rgb(34,34,34)">=D7=90=D7=9C=D7=99=D7=A2=
=D7=96=D7=A8 =D7=A7=D7=A8=D7=95=D7=99=D7=98=D7=95=D7=A8=D7=95</div><div dir=
=3D"rtl" style=3D"color:rgb(34,34,34)">=D7=AA=D7=9E=D7=99=D7=9B=D7=94 =D7=
=98=D7=9B=D7=A0=D7=99=D7=AA, =D7=9E=D7=A9=D7=99=D7=91 =D7=94=D7=A8=D7=95=D7=
=97 =D7=95=D7=9E=D7=95=D7=A8=D7=99=D7=93 =D7=94=D7=92=D7=A9=D7=9D</div><div=
 dir=3D"rtl" style=3D"color:rgb(34,34,34)">=D7=A0=D7=99=D7=99=D7=93: 052-87=
04261</div><div dir=3D"rtl" style=3D"color:rgb(34,34,34)">=D7=9E=D7=99=D7=
=99=D7=9C: <a href=3D"mailto:[email protected]" target=3D"_blank">ngtech=
[email protected]</a></div></div></div></div></div>

--000000000000095505064a7dc02f--

--===============5801211682640167929==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

--===============5801211682640167929==--