If you want to get rid the notices SSL certificate validation failed with ... messages, you can download the Root Certificate and upload it to Zeek.
Zeek uses Mozilla's list with Root CA's, but some applications store some Root CA's in their local datastore (e.g microsoft update, apple etc.). Hence Zeek cannot resolve properly the certificate.
You can run the bash script which search in the Certificate.
Then will extract the AIA URL and download the crt file.
Finally the bash script will execute the Python script and convert it to Zeek suitable format for SSL::root_certs.
Example:
./get_AIA.sh slscr.update.microsoft.com
Output:
["C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Product Root Certificate Authority 2018"] = "\x30\x82\x04\x62\x30\x82\x03\xE8\xA0\x03\x02\x01\x02\x02\x13\x33\x00\x00\x00\x04\xA1\xF5\xB5\x88\x3D\x3F\x00\x22\x00\x00\x00\x00\x00\x04\x30\x0A\x06\x08\x2A\x86\x48\xCE\x3D\x04\x03\x03\x30\x81\x94\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x13\x30\x11\x06\x03\x55\x04\x08\x13\x0A\x57\x61\x73\x68\x69\x6E\x67\x74\x6F\x6E\x31\x10\x30\x0E\x06\x03\x55\x04\x07\x13\x07\x52\x65\x64\x6D\x6F\x6E\x64\x31\x1E\x30\x1C\x06\x03\x55\x04\x0A\x13\x15\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x20\x43\x6F\x72\x70\x6F\x72\x61\x74\x69\x6F\x6E\x31\x3E\x30\x3C\x06\x03\x55\x04\x03\x13\x35\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x20\x45\x43\x43\x20\x50\x72\x6F\x64\x75\x63\x74\x20\x52\x6F\x6F\x74\x20\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x20\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x20\x32\x30\x31\x38\x30\x1E\x17\x0D\x31\x38\x30\x39\x32\x38\x32\x31\x33\x34\x32\x30\x5A\x17\x0D\x33\x33\x30\x39\x32\x38\x32\x31\x34\x34\x32\x30\x5A\x30\x81\x88\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x55\x53\x31\x13\x30\x11\x06\x03\x55\x04\x08\x13\x0A\x57\x61\x73\x68\x69\x6E\x67\x74\x6F\x6E\x31\x10\x30\x0E\x06\x03\x55\x04\x07\x13\x07\x52\x65\x64\x6D\x6F\x6E\x64\x31\x1E\x30\x1C\x06\x03\x55\x04\x0A\x13\x15\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x20\x43\x6F\x72\x70\x6F\x72\x61\x74\x69\x6F\x6E\x31\x32\x30\x30\x06\x03\x55\x04\x03\x13\x29\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x20\x45\x43\x43\x20\x55\x70\x64\x61\x74\x65\x20\x53\x65\x63\x75\x72\x65\x20\x53\x65\x72\x76\x65\x72\x20\x43\x41\x20\x32\x2E\x31\x30\x76\x30\x10\x06\x07\x2A\x86\x48\xCE\x3D\x02\x01\x06\x05\x2B\x81\x04\x00\x22\x03\x62\x00\x04\xFD\x39\x3E\xFB\x55\xAA\x15\x7B\xF9\x24\x17\xFF\xC9\x62\x0E\x1E\x73\x23\x66\xCC\xD0\x18\x47\xEA\xDA\xEE\x5A\xC4\x52\x72\xC8\x9A\x92\xF5\xED\x44\x4C\x0F\x76\x48\x48\x05\x99\x25\x19\xA6\x09\x46\xA6\x71\x5C\x5F\xAD\x7B\x91\x25\x77\x36\xC1\x83\x27\x02\x63\x90\xBB\x88\xFB\xCD\xED\x02\xE8\x0C\x28\xB5\xCB\x1B\x28\xAE\xFF\x07\x73\x58\x87\x2B\xFF\x63\xD1\x33\x4E\x61\x37\xEE\x15\x7C\x25\x40\xA3\x82\x02\x04\x30\x82\x02\x00\x30\x0E\x06\x03\x55\x1D\x0F\x01\x01\xFF\x04\x04\x03\x02\x01\x86\x30\x10\x06\x09\x2B\x06\x01\x04\x01\x82\x37\x15\x01\x04\x03\x02\x01\x00\x30\x1D\x06\x03\x55\x1D\x0E\x04\x16\x04\x14\x16\x41\xB1\x07\xC7\x8B\xF3\xD2\x06\x14\x90\x26\x0A\xDB\xB1\x2B\xC0\x44\x62\xC3\x30\x55\x06\x03\x55\x1D\x20\x04\x4E\x30\x4C\x30\x4A\x06\x04\x55\x1D\x20\x00\x30\x42\x30\x40\x06\x08\x2B\x06\x01\x05\x05\x07\x02\x01\x16\x34\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x69\x63\x72\x6F\x73\x6F\x66\x74\x2E\x63\x6F\x6D\x2F\x70\x6B\x69\x6F\x70\x73\x2F\x44\x6F\x63\x73\x2F\x52\x65\x70\x6F\x73\x69\x74\x6F\x72\x79\x2E\x68\x74\x6D\x00\x30\x13\x06\x03\x55\x1D\x25\x04\x0C\x30\x0A\x06\x08\x2B\x06\x01\x05\x05\x07\x03\x01\x30\x19\x06\x09\x2B\x06\x01\x04\x01\x82\x37\x14\x02\x04\x0C\x1E\x0A\x00\x53\x00\x75\x00\x62\x00\x43\x00\x41\x30\x0F\x06\x03\x55\x1D\x13\x01\x01\xFF\x04\x05\x30\x03\x01\x01\xFF\x30\x1F\x06\x03\x55\x1D\x23\x04\x18\x30\x16\x80\x14\x43\xEF\x70\x87\xB8\x9D\xBF\xEC\x88\x19\xDC\xC6\xC4\x6B\x75\x0D\x75\x34\x33\x08\x30\x7A\x06\x03\x55\x1D\x1F\x04\x73\x30\x71\x30\x6F\xA0\x6D\xA0\x6B\x86\x69\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x69\x63\x72\x6F\x73\x6F\x66\x74\x2E\x63\x6F\x6D\x2F\x70\x6B\x69\x6F\x70\x73\x2F\x63\x72\x6C\x2F\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x25\x32\x30\x45\x43\x43\x25\x32\x30\x50\x72\x6F\x64\x75\x63\x74\x25\x32\x30\x52\x6F\x6F\x74\x25\x32\x30\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x25\x32\x30\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x25\x32\x30\x32\x30\x31\x38\x2E\x63\x72\x6C\x30\x81\x87\x06\x08\x2B\x06\x01\x05\x05\x07\x01\x01\x04\x7B\x30\x79\x30\x77\x06\x08\x2B\x06\x01\x05\x05\x07\x30\x02\x86\x6B\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x69\x63\x72\x6F\x73\x6F\x66\x74\x2E\x63\x6F\x6D\x2F\x70\x6B\x69\x6F\x70\x73\x2F\x63\x65\x72\x74\x73\x2F\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x25\x32\x30\x45\x43\x43\x25\x32\x30\x50\x72\x6F\x64\x75\x63\x74\x25\x32\x30\x52\x6F\x6F\x74\x25\x32\x30\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x25\x32\x30\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x25\x32\x30\x32\x30\x31\x38\x2E\x63\x72\x74\x30\x0A\x06\x08\x2A\x86\x48\xCE\x3D\x04\x03\x03\x03\x68\x00\x30\x65\x02\x30\x3D\x6B\x1E\x33\xF6\x2B\x31\xB6\x58\x1F\x25\x8F\x7E\xF0\x75\xC3\xA6\xD9\xD3\xCA\x34\x3C\xB4\x60\x04\x38\xB9\x25\x9B\xA3\xD4\x42\x1D\x5C\xD8\xE8\x84\x99\x30\x76\xAE\xEC\x71\x6C\x61\x15\x24\x0D\x02\x31\x00\x9D\x4D\xAE\xC4\x64\x55\x22\x74\xAA\xBE\x32\xF3\x02\x74\x41\xF6\x39\x2D\x1E\x22\x6E\x9F\xE7\x5F\xF9\xE1\x46\xDD\x19\x67\x10\xA6\x69\xC9\xB7\x7B\xF4\x3F\x08\xFD\x73\x3B\x3C\xDB\x41\x67\x50\xBA"
-
Download the
Root Certificate. -
If it is in
PEMformat first run the command to convert it toDERformat.
cat o.pem | sed -n '/BEGIN/,/END/p' | openssl x509 -outform DER > o.der
-
Then run
python3 convert_DER_to_zeek.cert.py <file.der> -
Get the output of the above command and copy it to a
zeek script file. Output example of the converter:
["KSNGlobalRootCAECC"] = "\x30\x82\x02\x52\x30\x82\x01\xB4\xA0\x03\x02\x01\x02\x02\x10\x14\x69\xC4\x69\xB6\xD5\x4E\x90\x4D\x6B\x82\x01\x4E\xFF\x92\x91\x30\x0A\x06\x08\x2A\x86\x48\xCE\x3D\x04\x03\x03\x30\x3E\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x52\x55\x31\x12\x30\x10\x06\x03\x55\x04\x0A\x13\x09\x4B\x61\x73\x70\x65\x72\x73\x6B\x79\x31\x1B\x30\x19\x06\x03\x55\x04\x03\x13\x12\x4B\x53\x4E\x20\x47\x6C\x6F\x62\x61\x6C\x20\x52\x6F\x6F\x74\x20\x43\x41\x30\x1E\x17\x0D\x32\x30\x30\x36\x31\x32\x30\x39\x35\x32\x33\x36\x5A\x17\x0D\x33\x35\x30\x36\x31\x32\x31\x30\x30\x32\x33\x35\x5A\x30\x3E\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x52\x55\x31\x12\x30\x10\x06\x03\x55\x04\x0A\x13\x09\x4B\x61\x73\x70\x65\x72\x73\x6B\x79\x31\x1B\x30\x19\x06\x03\x55\x04\x03\x13\x12\x4B\x53\x4E\x20\x47\x6C\x6F\x62\x61\x6C\x20\x52\x6F\x6F\x74\x20\x43\x41\x30\x81\x9B\x30\x10\x06\x07\x2A\x86\x48\xCE\x3D\x02\x01\x06\x05\x2B\x81\x04\x00\x23\x03\x81\x86\x00\x04\x00\xA8\x6D\x41\xC0\xF8\x37\xA8\xBD\x84\xCB\xC6\x52\xE2\xD1\x07\x24\x05\x35\x77\x60\x5B\x7E\xAA\xC9\xFE\xDA\x07\x38\x4F\xB7\xB0\xA0\x5F\xD1\xA7\x96\x9C\x05\xE3\xC3\xDC\x50\x63\xBA\x63\xD9\x00\x0D\x0A\xAE\x4C\x0C\x90\xA4\x9E\x77\x11\xC6\x8B\x7F\xCC\xB9\x51\xD6\x46\x01\x1D\x22\xD3\x67\x41\xE8\x0B\xEE\xC7\xD6\xAA\xCD\xBA\x7B\x93\x02\xA9\x93\xFD\x8C\x6E\x7E\xA6\x04\xD7\x92\x2B\x77\x9F\xAB\xCD\x0D\x83\xC3\x2E\x5E\x9A\xD4\x3A\x9F\x72\x16\xF3\x2C\xA4\x24\x9B\x66\x65\xDB\x2D\x2D\x06\xC9\x45\x7F\x19\x01\x08\x68\xAE\xA7\x98\x4B\x9F\xA3\x51\x30\x4F\x30\x0B\x06\x03\x55\x1D\x0F\x04\x04\x03\x02\x01\x86\x30\x0F\x06\x03\x55\x1D\x13\x01\x01\xFF\x04\x05\x30\x03\x01\x01\xFF\x30\x1D\x06\x03\x55\x1D\x0E\x04\x16\x04\x14\x45\x31\xC5\x21\x7B\x9C\xCC\xBB\x8D\xFF\x73\x6D\x13\x94\x33\x51\x21\x3C\x8B\xDC\x30\x10\x06\x09\x2B\x06\x01\x04\x01\x82\x37\x15\x01\x04\x03\x02\x01\x00\x30\x0A\x06\x08\x2A\x86\x48\xCE\x3D\x04\x03\x03\x03\x81\x8B\x00\x30\x81\x87\x02\x42\x00\xC2\x28\x41\x40\x53\x00\xBD\x02\x97\x3E\x94\x41\x99\xAE\x70\xE3\x51\x00\x4C\x13\x3D\xFD\xC3\x58\x5A\xBA\x54\xF8\x5F\x82\x9C\x2C\xA1\xC6\x05\x6C\x61\x9F\xA9\x49\x3A\x13\x86\xDB\xA2\xCB\x65\xDC\x07\xF1\xEA\xBB\x00\x18\x70\x29\xF2\x43\xA5\xFD\xC8\x54\x73\x53\xCD\x02\x41\x75\x42\xDB\x08\xA2\xDA\xAA\x8C\xEC\x93\x33\xBF\x02\x6C\xB0\xEA\xCD\x88\x92\x3A\x37\x2E\x6A\x30\x46\xD5\x2B\x14\xAA\x93\x9D\xF8\x05\x0A\x03\x3C\x40\xE8\x81\x3F\xAF\x66\x7F\x67\x96\x65\xE4\x6C\xC3\x89\x30\xBA\xDD\x45\x43\x16\x84\x9F\xB2\x72\x31\x23\xFA\xD6\x80"
Create a Zeek script which will have structure like the below example:
redef SSL::root_certs += {
["KSNGlobalRootCAECC"] = "\x30\x82\x02\x52... ,
["test 2"] = "\x30\x82...
};
and load (@load) the zeek script file to your local.zeek .