Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Packetbeat] Add SHA1 Fingerprints of TLS Certificates #8180

Closed
andrewkroh opened this issue Aug 31, 2018 · 0 comments
Closed

[Packetbeat] Add SHA1 Fingerprints of TLS Certificates #8180

andrewkroh opened this issue Aug 31, 2018 · 0 comments
Assignees
@adriansr
Labels
enhancement Packetbeat

Comments

@andrewkroh
Copy link
Member

andrewkroh commented Aug 31, 2018 •
edited
Loading

As a user I'd like to be able to search for certificates based on SHA1 fingerprints. For example if I want to query for certificates matching a SSL blacklist like https://sslbl.abuse.ch/ then I need to have a fingerprint in Elasticsearch.

Packetbeat should probably also support SHA256 hashing as well. Some apps are moving to using that.
@adriansr adriansr self-assigned this Sep 18, 2018
@adriansr adriansr mentioned this issue Sep 19, 2018
Merged
adriansr added a commit to adriansr/beats that referenced this issue Sep 21, 2018
@adriansr
Calculate fingerprints of TLS certificates (elastic#8180)
5165d2f 
This patch adds support to calculate fingerprints to the TLS parser in
packetbeat. The feature is controlled by a new configuration option:
```
fingerprints: [sha1, sha256]
```

Valid values are `sha1`, `sha256` and `md5`.

Closes elastic#8180
adriansr added a commit that referenced this issue Sep 21, 2018
@adriansr
Calculate fingerprints of TLS certificates (#8353)
8563a5a 
This patch adds support to calculate fingerprints to the TLS parser in
Packetbeat. The feature is controlled by a new configuration option:
```
fingerprints: [sha1, sha256]
```

Valid values are `sha1`, `sha256` and `md5`. Default is `sha1`.

Closes #8180
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@adriansr adriansr

Labels
enhancement Packetbeat
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@andrewkroh @adriansr