DigiCert G1 根证书 2026 年 4 月 15 日退役：Web PKI 最大规模信任迁移实战指南

#!/usr/bin/env python3
"""
G1 根证书影响检测器
检测域名列表中是否存在仍链向 DigiCert G1 根证书的 TLS 证书
"""

import ssl
import socket
import sys
from cryptography import x509
from cryptography.hazmat.backends import default_backend

# DigiCert G1 根证书的 SHA-1 指纹
G1_ROOT_FINGERPRINTS = {
    "A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436": "DigiCert Global Root CA",
    "039EEDB80BE7A03C9098A350E285216D35A2": "DigiCert High Assurance EV Root CA",
    "0CE7E0E517D846FE8FE560FC199D5B5A8": "DigiCert Assured ID Root CA",
}

def get_certificate_chain(hostname: str, port: int = 443) -> list:
    """获取目标主机的完整证书链"""
    context = ssl.create_default_context()
    context.check_hostname = False
    context.verify_mode = ssl.CERT_NONE
    
    try:
        with socket.create_connection((hostname, port), timeout=10) as sock:
            with context.wrap_socket(sock, server_hostname=hostname) as ssock:
                # 获取对端证书链（PEM 格式）
                chain = ssock.getpeercert(chain=True)
                if chain:
                    return [x509.load_der_x509_cert(cert, default_backend()) 
                            for cert in chain]
                # 备选方案：通过二进制数据获取
                der_cert = ssock.getpeercert(binary_form=True)
                if der_cert:
                    return [x509.load_der_x509_cert(der_cert, default_backend())]
    except Exception as e:
        return []

def check_g1_in_chain(chain: list) -> dict:
    """检查证书链中是否包含 G1 根证书"""
    result = {
        'has_g1': False,
        'g1_root_name': None,
        'chain_info': []
    }
    
    for cert in chain:
        # 计算 SHA-1 指纹
        fingerprint = cert.fingerprint(hashes.SHA1()).hex().upper()
        # 格式化为 OpenSSL 风格（冒号分隔）
        fp_formatted = ':'.join(fingerprint[i:i+2] for i in range(0, len(fingerprint), 2))
        
        subject = cert.subject.get_attributes_for_oid(x509.oid.NameOID.COMMON_NAME)
        subject_cn = subject[0].value if subject else str(cert.subject)
        
        result['chain_info'].append({
            'subject': subject_cn,
            'fingerprint': fp_formatted,
            'is_g1': fp_formatted in G1_ROOT_FINGERPRINTS
        })
        
        if fp_formatted in G1_ROOT_FINGERPRINTS:
            result['has_g1'] = True
            result['g1_root_name'] = G1_ROOT_FINGERPRINTS[fp_formatted]
    
    return result

def main():
    # 从命令行参数或文件读取域名列表
    if len(sys.argv) > 1:
        domains = sys.argv[1:]
    else:
        # 默认测试域名
        domains = ['example.com', 'www.example.com']
    
    affected = []
    clean = []
    errors = []
    
    for domain in domains:
        print(f"[*] 检查 {domain}...", end=' ', flush=True)
        chain = get_certificate_chain(domain)
        
        if not chain:
            print("❌ 无法获取证书链")
            errors.append(domain)
            continue
        
        result = check_g1_in_chain(chain)
        
        if result['has_g1']:
            print(f"⚠️  发现 G1 根: {result['g1_root_name']}")
            affected.append({
                'domain': domain,
                'g1_root': result['g1_root_name'],
                'chain': result['chain_info']
            })
        else:
            print("✅ 未受影响")
            clean.append(domain)
    
    # 输出汇总
    print(f"\n{'='*60}")
    print(f"检查完成: {len(domains)} 个域名")
    print(f"  受影响 (G1 链): {len(affected)}")
    print(f"  未受影响: {len(clean)}")
    print(f"  检查失败: {len(errors)}")
    
    if affected:
        print(f"\n⚠️  受影响的域名:")
        for item in affected:
            print(f"  - {item['domain']} → {item['g1_root']}")
    
    if errors:
        print(f"\n❌ 检查失败的域名:")
        for d in errors:
            print(f"  - {d}")

if __name__ == '__main__':
    # 需要: pip install cryptography
    from cryptography.hazmat.primitives import hashes
    main()

# 扫描本机所有证书文件
find /etc/ssl /etc/letsencrypt /etc/nginx -name "*.pem" -o -name "*.crt" 2>/dev/null | \
  while read f; do
    echo "=== $f ==="
    openssl x509 -in "$f" -noout -subject -issuer -dates 2>/dev/null
    echo ""
  done

# 扫描所有监听 TLS 端口的本地服务
ss -tlnp | grep LISTEN | awk '{print $4}' | sed 's/.*://' | sort -u | \
  while read port; do
    echo "=== Port $port ==="
    echo | openssl s_client -connect "localhost:$port" -showcerts 2>/dev/null | \
      grep -E "^\s+[0-9]+ s:|^\s+[0-9]+ i:"
    echo ""
  done

{
  "certificates": [
    {
      "domain": "www.example.com",
      "issuer": "DigiCert",
      "root_hierarchy": "G2",
      "valid_from": "2025-01-01",
      "valid_to": "2026-01-01",
      "eku": ["serverAuth"],
      "deployment": ["nginx-primary", "aws-elb"],
      "auto_renewal": true,
      "owner": "ops-team@example.com",
      "last_verified": "2026-04-01"
    }
  ]
}