added usage type 1 and option to specify the port to connect to

debfx / check_dane

Nagios/Icinga plugin for checking DANE/TLSA records

GNU General Public License v3.0

13 stars 9 forks source link

added usage type 1 and option to specify the port to connect to #1

Closed pprasse closed 8 years ago

pprasse commented 8 years ago

added usage type 1 (service certificate constraint)
added option --host-port to specify the port to check in DNS This is useful if you have a LVS setup where the realserver serves on a different port than the service is exposed by the director. Example: Service www.actindo.biz:443, realserver 10.10.10.10 port 12345 Options would be: -H www.actindo.biz --host-port 443 --port 12345 -I 10.10.10.10

debfx commented 8 years ago

tlsa_record.usage==1 needs to imply --check-pkix.

I think it makes more sense to swap the meaning of -p and -P: So the standard options -H / -p define the public service (DNS record to lookup) and -I / -P the actual service to connect to.

debfx commented 8 years ago

I've pushed a bunch of commits that implement this.