y509 validate example.com:443 --json
{
"host": "example.com",
"trust": {
"level": "self-anchored",
"trusted": false,
"anchor": "Internal Root CA",
"error": "x509: certificate signed by unknown authority"
},
"presentation": {
"ok": false,
"findings": [
{
"problem": "missing issuer",
"subject": "*.example.com",
"fetchUrls": ["http://yr2.i.lencr.org/"]
}
]
},
"chain": [{ "index": 0, "daysUntilExpiry": 43, "…": "…" }]
}
two checks worth wiring up
# Fail the build on a chain that verifies but is mis-served.
$ y509 validate example.com:443 --json | jq -e '.presentation.ok'
# Warn 30 days out, without parsing prose.
$ y509 validate example.com:443 --json | jq '.chain[0].daysUntilExpiry < 30'
--json exists because that number cannot carry the answer. A script reading
only the exit code cannot tell an internal PKI from a chain that does not link up, and
it learns nothing at all about how the chain was served, which is the finding you most
likely came for.
chain is in the order the certificates were presented, not
sorted, because sorting is what destroys the evidence presentation reports on.
or as a step, without the jq
- uses: kanywst/y509@v1
with:
target: example.com:443
fail-on: untrusted,mis-served,expiring
The action downloads a release, verifies its checksum, and fails the job on whichever
findings you name. Anything you leave out is still reported, as a warning rather than an
error, so fail-on: none turns the same step into a scheduled monitor.