Merge pull request #13 from chris-short/hsts

HSTS

Author: chris-short

certcheck.go

@@ -2,9 +2,7 @@
 //
 // go run certcheck.go https://chrisshort.net
 //
-// go run certcheck.go https://chrisshort.net 30
-//
-
+// go run certcheck.go https://chrisshort.net
 package main
 
 import (
@@ -29,9 +27,11 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Parse the URL and number of days
 	url := os.Args[1]
 	var days int = -1 // Default value if days argument is not provided
 
+	// Check if the number of days argument is provided
 	if len(os.Args) == 3 {
 		daysStr := os.Args[2]
 		var err error
@@ -44,19 +44,22 @@ func main() {
 
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: true, // allow self-signed certificates
+			// This is required to allow self-signed certificates
+			InsecureSkipVerify: true,
 		},
 	}
 
 	client := &http.Client{Transport: tr}
 
+	// Check if the URL is valid
 	resp, err := client.Get(url)
 	if err != nil {
 		fmt.Printf("Error connecting to %s: %s\n", url, err)
 		os.Exit(1)
 	}
 	defer resp.Body.Close()
 
+	// Check if the response was successful
 	certs := resp.TLS.PeerCertificates
 	var validChain bool = true
 	for i := 0; i < len(certs)-1; i++ {
@@ -72,6 +75,7 @@ func main() {
 		fmt.Printf("Valid from: %s\n", cert.NotBefore)
 		fmt.Printf("Valid until: %s", cert.NotAfter)
 
+		// Check if the certificate is expired
 		if days != -1 {
 			daysLeft := int(time.Until(cert.NotAfter).Hours() / 24)
 			if daysLeft <= days {
@@ -90,6 +94,12 @@ func main() {
 		fmt.Printf("IP Addresses: %v\n", cert.IPAddresses)
 		fmt.Printf("Signature algorithm: %s\n", cert.SignatureAlgorithm.String())
 
+		// Obtain the cipher information
+		state := resp.TLS
+		if state != nil {
+			fmt.Printf("Cipher in use: %s\n", tls.CipherSuiteName(state.CipherSuite))
+		}
+
 		// Print KeyUsage information if available
 		if cert.KeyUsage != 0 {
 			fmt.Println("KeyUsage:")
@@ -100,9 +110,16 @@ func main() {
 		fingerprint := sha256.Sum256(cert.Raw)
 		fmt.Printf("Fingerprint (SHA-256): %s\n", hex.EncodeToString(fingerprint[:]))
 
+		// Check if the HSTS header is present
+		hstsHeader := resp.Header.Get("Strict-Transport-Security")
+		if hstsHeader != "" {
+			fmt.Println("HSTS Header:", hstsHeader)
+		}
+
 		fmt.Println("-----")
 	}
 
+	// Print the validity of the certificate chain
 	if validChain {
 		color.Set(color.Bold, color.FgGreen)
 		fmt.Println("Certificate chain is valid and in the correct order.")
@@ -112,6 +129,7 @@ func main() {
 	}
 }
 
+// printKeyUsage prints the key usage flags of a certificate.
 func printKeyUsage(keyUsage x509.KeyUsage) {
 	usageStrings := []string{
 		"Digital Signature",
@@ -125,13 +143,15 @@ func printKeyUsage(keyUsage x509.KeyUsage) {
 		"Decipher Only",
 	}
 
+	// Print the key usage flags of a certificate.
 	for i, usage := range usageStrings {
 		if keyUsage&(1<<i) != 0 {
 			fmt.Printf("- %s\n", usage)
 		}
 	}
 }
 
+// parseDays parses the number of days from a string.
 func parseDays(daysStr string) (int, error) {
 	days, err := strconv.Atoi(daysStr)
 	if err != nil {