Add machinery to detect expired certificates

2 files changed, 39 insertions, 5 deletions

diff --git a/blacklist.txt b/blacklist.txt
index 6ddc6b9..9c0b4fd 100644
--- a/blacklist.txt
+++ b/blacklist.txt
@@ -36,3 +36,11 @@
 "VeriSign Class 3 Public Primary Certification Authority - G4"
 "VeriSign Class 3 Public Primary Certification Authority - G5"
 "VeriSign Universal Root Certification Authority"
+
+# Expired certificates
+# Not Valid Before: Tue May 30 10:48:38 2000
+# Not Valid After : Sat May 30 10:48:38 2020
+"AddTrust External Root"
+# Not Valid Before: Wed Mar 26 11:18:17 2008
+# Not Valid After : Wed Mar 25 11:03:10 2020
+"Staat der Nederlanden Root CA - G2"
diff --git a/certdata2pem.py b/certdata2pem.py
index 0b02b2a..5af0def 100644
--- a/certdata2pem.py
+++ b/certdata2pem.py
@@ -21,11 +21,17 @@
 # USA.
 
 import base64
+import datetime
+import io
 import os.path
+import pathlib
 import re
 import sys
 import textwrap
-import io
+
+DATE_FMT = "%a %b %d %H:%M:%S %Y"
+VERSION = pathlib.Path(__file__).parent / "VERSION"
+VERSION = datetime.datetime.strptime(VERSION.read_text().strip(), "%Y%m%d")
 
 objects = []
 
@@ -43,9 +49,6 @@ for line in io.open('certdata.txt', 'rt', encoding='utf8'):
         if line.startswith('BEGINDATA'):
             in_data = True
         continue
-    # Ignore comment lines.
-    if line.startswith('#'):
-        continue
     # Empty lines are significant if we are inside an object.
     if in_obj and len(line.strip()) == 0:
         objects.append(obj)
@@ -54,6 +57,17 @@ for line in io.open('certdata.txt', 'rt', encoding='utf8'):
         continue
     if len(line.strip()) == 0:
         continue
+    if line.startswith("# Not Valid Before: "):
+        line = line.replace("# Not Valid Before: ", "", 1).strip()
+        obj["before"] = datetime.datetime.strptime(line, DATE_FMT)
+        continue
+    if line.startswith("# Not Valid After : "):
+        line = line.replace("# Not Valid After : ", "", 1).strip()
+        obj["after"] = datetime.datetime.strptime(line, DATE_FMT)
+        continue
+    # Ignore comment lines.
+    if line.startswith('#'):
+        continue
     if in_multiline:
         if not line.startswith('END'):
             if type == 'MULTILINE_OCTAL':
@@ -97,13 +111,23 @@ if os.path.exists('blacklist.txt'):
 
 # Build up trust database.
 trust = dict()
+next_expiring = None
 for obj in objects:
     if obj['CKA_CLASS'] != 'CKO_NSS_TRUST':
         continue
     if obj['CKA_LABEL'] in blacklist:
         print("Certificate %s blacklisted, ignoring." % obj['CKA_LABEL'])
     elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR':
-        trust[obj['CKA_LABEL']] = True
+        if VERSION < obj["before"] or VERSION > obj["after"]:
+            print('!'*74)
+            print("EXPIRED BUT NOT BLACKLISTED CERTIFICATE FOUND: %s" % obj['CKA_LABEL'])
+            print('!'*74)
+        else:
+            if not next_expiring:
+                next_expiring = obj
+            elif obj['after'] < next_expiring['after']:
+                next_expiring = obj
+            trust[obj['CKA_LABEL']] = True
     elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED':
         print('!'*74)
         print("UNTRUSTED BUT NOT BLACKLISTED CERTIFICATE FOUND: %s" % obj['CKA_LABEL'])
@@ -113,6 +137,8 @@ for obj in objects:
               (obj['CKA_LABEL'], obj['CKA_TRUST_SERVER_AUTH'],
                obj['CKA_TRUST_EMAIL_PROTECTION']))
 
+print('Next expiring certificate:', next_expiring['CKA_LABEL'], next_expiring['after'])
+
 for obj in objects:
     if obj['CKA_CLASS'] == 'CKO_CERTIFICATE':
         if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]: