diff --git a/website/content/en/cgi/fingerprints.cgi b/website/content/en/cgi/fingerprints.cgi index 2dd58ce23d..bc99be8985 100755 --- a/website/content/en/cgi/fingerprints.cgi +++ b/website/content/en/cgi/fingerprints.cgi @@ -1,57 +1,58 @@ #!/usr/bin/perl -T # # Display current HTTPS/SSL/TLS certificate fingerprints. # Should be replaced with something better. # # $FreeBSD$ require "./cgi-lib.pl"; require "./cgi-style.pl"; $ENV{PATH} = '/bin:/usr/bin'; # There is an internal post-renew propagation window of about 5-10 minutes. # However, the script is expensive so we leverage the cache. The problem # is that people could come here immediately after a fingerprint mismatch # so we have to be quick to update. print "Cache-control: public; max-age=120\n"; # 2 minutes print &short_html_header("FreeBSD HTTPS/SSL/TLS Server Certificate Fingerprints"); print qq{

FreeBSD HTTPS/SSL/TLS Server Certificate Fingerprints

\n}; print qq{

The FreeBSD Project makes use of Let's Encrypt certificates for many of its HTTPS/SSL/TLS services. These certificates are automatically updated every 60 days. The current certificate fingerprints of significant services are listed below.

\n}; # Note: These are all case sensitive. Use lower case to match the file names. +&Fingerprint('git.freebsd.org'); &Fingerprint('svn.freebsd.org'); &Fingerprint('download.freebsd.org'); &Fingerprint('pkg.freebsd.org'); print qq{

These fingerprints may be helpful in situations where automatic verification is not available.

\n}; print &html_footer; exit 0; sub Fingerprint { my ($domain) = @_; my $message; my $sha1, $sha256; if ( -e "/etc/clusteradm/acme-certs/$domain.crt" ) { $sha1 = `/usr/bin/openssl x509 -fingerprint -noout -sha1 -in /etc/clusteradm/acme-certs/$domain.crt`; $sha256 = `/usr/bin/openssl x509 -fingerprint -noout -sha256 -in /etc/clusteradm/acme-certs/$domain.crt`; chomp($sha1); chomp($sha256); $sha1 =~ s/^.*=//; $sha256 =~ s/^.*=//; } else { $sha1 = 'Error'; $sha256 = 'Error'; } $message = qq{

The fingerprints of the current $domain certificate are:

\n}; $message .= qq{
}; $message .= qq{}; $message .= qq{}; $message .= qq{}; $message .= qq{
HashFingerprint
SHA1$sha1
SHA256$sha256
\n}; print $message; }