Add a tool for pretty-printing certificates.

Examples:

  # Fetches the certificate chain for www.google.com and pretty prints it
  ./print_certificates.py www.google.com

  # Pretty prints all the certificates contained in certs.pem, followed by
  # the single DER-encoded certificate foo.crt
  ./print_certificates.py certs.pem foo.crt

Change-Id: I3719d1bd3bddc262829f4e6afd7309a205f15c4b
Reviewed-on: https://chromium-review.googlesource.com/585570Reviewed-by: Matt Mueller <mattm@chromium.org>
Commit-Queue: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#491090}

net/tools/print_certificates.py

+#!/usr/bin/python
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""Pretty-prints certificates as an openssl-annotated PEM file.
+
+Usage: print_certificates.py [SOURCE]...
+
+Each SOURCE can be one of:
+  (1) A server name such as www.google.com.
+  (2) A PEM [*] file containing one or more CERTIFICATE blocks
+  (3) A binary file containing DER-encoded certificate
+
+When multiple SOURCEs are listed, all certificates in them are concatenated. If
+no SOURCE is given then data will be read from stdin.
+
+[*] Parsing of PEM files is relaxed - leading indentation whitespace will be
+stripped (needed for copy-pasting data from NetLogs).
+"""
+
+import base64
+import os
+import re
+import subprocess
+import sys
+
+
+def read_file_to_string(path):
+  with open(path, 'r') as f:
+    return f.read()
+
+
+def read_certificates_data_from_server(hostname):
+  """Uses openssl to fetch the PEM-encoded certificates for an SSL server."""
+  p = subprocess.Popen(["openssl", "s_client", "-showcerts",
+                        "-servername", hostname,
+                        "-connect", hostname + ":443"],
+                        stdin=subprocess.PIPE,
+                        stdout=subprocess.PIPE,
+                        stderr=subprocess.PIPE)
+  result = p.communicate()
+
+  if p.returncode == 0:
+    return result[0]
+
+  sys.stderr.write("Failed getting certificates for %s:\n%s\n" % (
+      hostname, result[1]))
+  return ""
+
+
+def read_sources_from_commandline():
+  """Processes the command lines and returns an array of all the sources
+  bytes."""
+  sources_bytes = []
+
+  if len(sys.argv) == 1:
+    # If no commonand-line arguments were given to the program, read input from
+    # stdin.
+    sources_bytes.append(sys.stdin.read())
+  else:
+    for arg in sys.argv[1:]:
+      # If the argument identifies a file path, read it
+      if os.path.exists(arg):
+        sources_bytes.append(read_file_to_string(arg))
+      else:
+        # Otherwise treat it as a web server address.
+        sources_bytes.append(read_certificates_data_from_server(arg))
+
+  return sources_bytes
+
+
+def strip_indentation_whitespace(text):
+  """Strips leading whitespace from each line."""
+  stripped_lines = [line.lstrip() for line in text.split("\n")]
+  return "\n".join(stripped_lines)
+
+
+def strip_all_whitespace(text):
+  pattern = re.compile(r'\s+')
+  return re.sub(pattern, '', text)
+
+
+def extract_certificates_from_pem(pem_bytes):
+  certificates_der = []
+
+  regex = re.compile(
+      r'-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----', re.DOTALL)
+
+  for match in regex.finditer(pem_bytes):
+    cert_der = base64.b64decode(strip_all_whitespace(match.group(1)))
+    certificates_der.append(cert_der)
+
+  return certificates_der
+
+
+def extract_certificates(source_bytes):
+  if "BEGIN CERTIFICATE" in source_bytes:
+    return extract_certificates_from_pem(source_bytes)
+
+  # Otherwise assume it is the DER for a single certificate
+  return [source_bytes]
+
+
+def pretty_print_certificate(certificate_der):
+  p = subprocess.Popen(["openssl", "x509", "-text", "-inform", "DER",
+                        "-outform", "PEM"],
+                        stdin=subprocess.PIPE,
+                        stdout=subprocess.PIPE,
+                        stderr=subprocess.PIPE)
+  result = p.communicate(certificate_der)
+
+  if p.returncode == 0:
+    return result[0]
+
+  # Otherwise failed.
+  sys.stderr.write("Failed: %s\n" % result[1])
+  return ""
+
+
+def pretty_print_certificates(certificates_der):
+  result = ""
+  for i in range(len(certificates_der)):
+    certificate_der = certificates_der[i]
+    pretty = pretty_print_certificate(certificate_der)
+    result += """===========================================
+Certificate%d
+===========================================
+%s
+""" % (i, pretty)
+  return result
+
+
+def main():
+  sources_bytes = read_sources_from_commandline()
+
+  certificates_der = []
+  for source_bytes in sources_bytes:
+    certificates_der.extend(extract_certificates(source_bytes))
+
+  print pretty_print_certificates(certificates_der)
+
+
+if __name__ == "__main__":
+  main()