cert-deets/cert_deets.py

#!python3
"""
Return the Akamai property and version for a given site
"""
import argparse
import socket
import ssl
import sys
from typing import Any
from urllib.parse import urlparse

from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from tabulate import tabulate

SAN_GROUPING = 4


def display_error(
    site: str,
    error: Any = None,
) -> None:
    """
    Print a generic error
    """
    print(f"ERROR: Could not find a certificate for {site}")
    if error:
        print(str(error))


if __name__ == "__main__":

    def parseargs() -> argparse.Namespace:
        """
        Parse the CLI

        Returns:
            argparse.Namespace: parsed arguments
        """
        parser = argparse.ArgumentParser()

        parser.add_argument("site", help="site to lookup")

        return parser.parse_args()

    def main() -> int:
        """
        Main entrypoint

        Returns:
            int: return value
        """
        args = parseargs()

        parts = urlparse(args.site, scheme="https")

        if not parts.netloc:
            parts = parts._replace(netloc=args.site)

        if not parts.port:
            parts = parts._replace(netloc=f"{parts.netloc}:443")

        if not parts.hostname or not parts.port:
            display_error(args.site, "Cannot parse hostname")
            return 1

        endpoint = f"{parts.hostname}:{parts.port}"

        try:
            pem_data = ssl.get_server_certificate(
                (parts.hostname, parts.port),
            ).encode("utf-8")
        except (
            ConnectionRefusedError,
            ssl.CertificateError,
            ssl.SSLError,
            socket.gaierror,
        ) as error:
            display_error(endpoint, error)
            return 2

        if not pem_data:
            display_error(endpoint, "Cannot fetch PEM data")
            return 3

        cert = x509.load_pem_x509_certificate(pem_data, default_backend())

        sans = [
            f"DNS:{dns}"
            for dns in cert.extensions.get_extension_for_class(
                x509.SubjectAlternativeName
            ).value.get_values_for_type(x509.DNSName)
        ]
        sans.extend(
            [
                f"IP:{ip}"
                for ip in cert.extensions.get_extension_for_class(
                    x509.SubjectAlternativeName
                ).value.get_values_for_type(x509.IPAddress)
            ]
        )

        sangroups = [
            sans[group : group + SAN_GROUPING]
            for group in range(0, len(sans), SAN_GROUPING)
        ]

        table = [
            ["Common name", cert.subject.rfc4514_string()],
            ["SANs", tabulate(sangroups, tablefmt="plain")],
            ["Valid from", cert.not_valid_before_utc],
            ["Valid to", cert.not_valid_after_utc],
            ["Issuer", cert.issuer.rfc4514_string()],
            [
                "SHA1 fingerprint",
                ":".join([format(i, "02x") for i in cert.fingerprint(hashes.SHA1())]),
            ],
        ]

        print(tabulate(table, tablefmt="plain"))

        return 0

    sys.exit(main())