Skip to content

Latest commit

 

History

History
76 lines (52 loc) · 2.5 KB

README.md

File metadata and controls

76 lines (52 loc) · 2.5 KB
Raw

cercat

certcat is for Certificate Catcher. It's monitors issued certificates from CertStream stream and send an alert to Slack if a domain matchs a specified regexp.

               websocket    +----------+   POST
CertSteam <-----------------> cercat   +-----------> Slack
                            | (regexp) |
                            +----------+

screenshot

It's highly inspired by CertStreamMonitor, the first idea was to improve performances for catching with a Golang version.

Configuration

Two methods are available for configuration and can be mixed :

  • config file
  • environment variables (they override values in config file)

With config file

---
SlackWebhookURL: "" #Slack Webhook URL
SlackIconURL: "" #Slack Icon (Avatar) URL
SlackUsername: "" #Slack Username
Regexp: ".*\\.fr$" #Regexp to match. Can't be empty. It uses Golang regexp format
Workers: 20 #Number of workers for consuming feed from CertStream

With env vars

  • SLACKWEBHOOKURL: Slack Webhook URL
  • SLACKICONURL: Slack Icon (Avatar) URL
  • SLACKUSERNAME: Slack Username
  • REGEXP: Regexp to match, if empty, '.*' is used. Use Golang regexp format
  • WORKERS: Number of workers for consuming feed from CertStream

Run

usage: cercat [<flags>]

Flags:
      --help                   Show context-sensitive help (also try --help-long and --help-man).
  -c, --configfile=CONFIGFILE  config file

Docker

You can run with Docker :

docker run -d -e SLACKWEBHOOKURL=https://hooks.slack.com/services/XXXXX -e REGEXP=".*fr$" issif/cercat:latest

Logs

2020/04/14 17:29:40 [INFO]  : A certificate for 'www.XXXX.fr' has been issued : {"domain":"www.XXXX.fr","SAN":["www.XXXX.fr"],"issuer":"Let's Encrypt","Addresses":["XX.XX.XX.183","XX.XX.XX.182"]}
2020/04/14 17:29:41 [INFO]  : A certificate for 'XXXX.fr' has been issued : {"domain":"XXXX.fr","SAN":["mail.XXXX.fr","XXXX.fr","www.XXXX.fr"],"issuer":"Let's Encrypt","Addresses":["XX.XX.XX.108"]}

Profiles, Traces and Metrics

The service opens port 6060 for profiles, traces and expvar. Go to http://localhost:6060/debug/pprof and http://localhost:6060/debug/vars.

License

MIT

Author

Thomas Labarussias - @Issif