# Adding SSL certs to Bro 2.0 **URL:** \ **Category:** Zeek\ **Created:** [November 16, 2011, 5:28pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098 "2011-11-16T17:28:39Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Mathew\_Binkley](https://avatars.discourse-cdn.com/v4/letter/m/47e85d/32.png) [@Mathew\_Binkley](https://community.zeek.org/u/Mathew_Binkley)\ **Post date:** [November 16, 2011, 5:28pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/1 "2011-11-16T17:28:39Z")
Hi! I've been testing the 2.0 beta (kudos, btw). My alarm files is getting tons of SSL::Invalid\_Server\_Cert from our own local certs, doegrid certs, cern.ch, [fnal.gov](http://fnal.gov), presumably because the root CA cert for those is not included with either Bro or the OS. I see share/bro/base/protocols/ssl/mozilla-ca-list has a bundle of root CA certs. Is there a way to add our own to that or to a separate file?   How is that file generated? Thanks. Mat ---
**Author:** ![sridhar\_basam1](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sridhar\_basam1](https://community.zeek.org/u/sridhar_basam1)\ **Post date:** [November 16, 2011, 5:35pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/2 "2011-11-16T17:35:37Z")
share/bro/site/local.bro redef the list to append your local entries. Sridhar ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 16, 2011, 6:16pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/3 "2011-11-16T18:16:40Z")
> Hi! I've been testing the 2.0 beta (kudos, btw). Great, thanks! > I see share/bro/base/protocols/ssl/mozilla-ca-list has a bundle of root > CA certs. Is there a way to add our own to that or to a separate file? > How is that file generated? Thanks. We have a exercise from the workshop that specifically addresses this situation. We will be posting the workshop material really soon too. Ultimately, you need to take a DER formatted version of your root public key and convert it to Bro's hex string representation and add it to the SSL::root\_certs table. Like this.... redef SSL::root\_certs += {   ["your root certificates subject"] = "\x30\x82\x03\x75\x30\x82\"; }; You can add that to the bottom of your local.bro file as Sridhar recommended.   .Seth ---
**Author:** ![Lou\_Ruppert1](https://avatars.discourse-cdn.com/v4/letter/l/73ab20/32.png) [@Lou\_Ruppert1](https://community.zeek.org/u/Lou_Ruppert1)\ **Post date:** [November 16, 2011, 9:16pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/4 "2011-11-16T21:16:58Z")
The semicolon at the end of the second line errors. Removing it causes it to work. If anyone's interested, I have a sloppy python script that will take a "standard" .pem cert and output a valid "redef SSL::root\_certs += {..." stanza like the one Seth wrote. I tested it with the cacert root sig and it's happy with my certs now. 🙂 -Lou ---
**Author:** ![Mathew\_Binkley](https://avatars.discourse-cdn.com/v4/letter/m/47e85d/32.png) [@Mathew\_Binkley](https://community.zeek.org/u/Mathew_Binkley)\ **Post date:** [November 16, 2011, 9:25pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/5 "2011-11-16T21:25:01Z")
I would definitely be interested. Mat ---
**Author:** ![Mathew\_Binkley](https://avatars.discourse-cdn.com/v4/letter/m/47e85d/32.png) [@Mathew\_Binkley](https://community.zeek.org/u/Mathew_Binkley)\ **Post date:** [November 17, 2011, 1:14am UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/6 "2011-11-17T01:14:36Z")
I heard back from some of the guys at FNAL, and they pointed out the FNAL CA cert is part of the IGTF distro:   [http://www.igtf.net](http://www.igtf.net) and 3 tarball of certs at:    [https://dist.eugridpma.info/distribution/igtf/current/accredited/](https://dist.eugridpma.info/distribution/igtf/current/accredited/) That covers most of the major scientific/research CA's I know of. Adding those to Bro would complement the list of commercial CA's extracted from Mozilla. Mat ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 17, 2011, 2:40am UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/7 "2011-11-17T02:40:22Z")
Ah, cool. I think this might make a good contribution to the upcoming contributed scripts repository. We are still trying to iron out the details about how it will work, but it is coming. The Mozilla root CA list might even get moved to the contributed scripts repository eventually so that we can keep it updated more easily between releases.   .Seth ---
**Author:** ![Stephane\_Chazelas](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Stephane\_Chazelas](https://community.zeek.org/u/Stephane_Chazelas)\ **Post date:** [February 8, 2012, 5:54pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/8 "2012-02-08T17:54:21Z")
2011-11-16 13:16:40 -0500, Seth Hall: [...] > \> I see share/bro/base/protocols/ssl/mozilla-ca-list has a bundle of root > \> CA certs. Is there a way to add our own to that or to a separate file? > \> How is that file generated? Thanks. > > We have a exercise from the workshop that specifically addresses this situation. We will be posting the workshop material really soon too. > > Ultimately, you need to take a DER formatted version of your root public key and convert it to Bro's hex string representation and add it to the SSL::root\_certs table. Like this.... > > redef SSL::root\_certs += { >   ["your root certificates subject"] = "\x30\x82\x03\x75\x30\x82\"; > }; [...] In case it may be of some help to anyone, here is a script to convert a PEM CA cert bundle such as /etc/ssl/certs/ca-certificates.crt as found on debian based system to bro's format: \ #! /usr/bin/perl use Encode; use Crypt::OpenSSL::X509; while (\<\>) {   if (/BEGIN /) {     $p="";     $inside=1;   }   p \.= \_ if $inside;   if (/END /) {     $c = Crypt::OpenSSL::X509-\>new\_from\_string(p\);     @s = map \{ \_-\>as\_string } reverse @{$c-\>subject\_name-\>entries};     s/[\\,]/\\$&/g for @s;     $s = join ",", @s;     $s = encode("UTF-8", $s);     s =\~ s/\[\\200\-\\377\]/sprintf\("\\\\%X",ord&)/ge;     x = join "", map \{ "\\\\x" \. uc\_ } unpack("(H2)\*", $c-\>as\_string(Crypt::OpenSSL::X509::FORMAT\_ASN1));     print "\t[\"$s\"] = \"$x\",\n"; $inside = 0;   } } \ (this gives the same output as found in the mozilla-ca.bro file) Then, I have a /etc/ca-certificates/update.d/bro-cacerts to update Bro's root\_certs everytime the system CA certs are updated: \ #! /bin/sh - BRO\_CERTSTORE=/usr/local/share/bro/site/certs.bro if [-f /etc/default/cacerts]; then     . /etc/default/cacerts fi echo if ["$cacerts\_updates" != yes] || ["$CACERT\_UPDATES" = disabled]; then     echo "updates of cacerts keystore disabled."     exit 0 fi printf '%s\n' "Updating Bro IDS CA Cert store $BRO\_CERTSTORE" set -C {   echo "redef SSL::root\_certs += {" &&     /usr/local/bin/crt-to-bro \< /etc/ssl/certs/ca-certificates.crt &&     echo "};" } \> "$BRO\_CERTSTORE.new" || exit mv -f "$BRO\_CERTSTORE.new" "$BRO\_CERTSTORE" || exit echo "Restarting bro" broctl check &&   broctl install &&   broctl restart \ This way, Bro uses the same rootca as the system's to verify certificates. HTH Stephane ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 8, 2012, 7:57pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/9 "2012-02-08T19:57:39Z")
Cool, thanks. We have a script in bro-aux that generates the CA list Bro script directly from the Mozilla repository too. If you have a copy of our source tree, the script is here:   aux/bro-aux/devel-tools/gen-mozilla-ca-list.rb   .Seth ---
**Author:** ![Will](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@Will](https://community.zeek.org/u/Will)\ **Post date:** [March 14, 2012, 3:12pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/10 "2012-03-14T15:12:16Z")
Quick question. I am getting a timeout when trying to print the variable containing the root\_certs. I am just wondering if this is due to having too many trusted certs loaded or if this is just a limitation of the broctl print function. My primary concern is whether bro was actually able to load all the root\_certs on startup. I have over 500 certs redef'd in site/mytrustedcerts.bro. Is this too many for bro to handle? broctl print SSL::root\_certs manager \ proxy-1 \ worker-1 \ worker-2 \ worker-3 \ worker-4 \ worker-5 \ worker-6 \ worker-7 \ worker-8 \ Thanks! -will ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 15, 2012, 3:26pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/11 "2012-03-15T15:26:18Z")
Pretty certainly the latter, the table itself shouldn't have a problem with many entries. Bro's current git version has a new option to increase the BroControl timeout for print, but here's another thing you can do to see the output: Add this to your local.bro:     event bro\_init()     {         print SSL::root\_certs;     } Get a small trace and run it through broctl's "process" command:     broctl process path/to/trace This will print all the certs to stdout (and then process the trace). (Trace content doesn't matter; one of Bro's test traces will do, like bro/testing/btest/Traces/web.trace). Robin ---
**Author:** ![Will](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@Will](https://community.zeek.org/u/Will)\ **Post date:** [March 15, 2012, 7:24pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/12 "2012-03-15T19:24:08Z")
> > Quick question. I am getting a timeout when trying to print the > > variable containing the root\_certs. I am just wondering if this is due > > to having too many trusted certs loaded or if this is just a > > limitation of the broctl print function. > > Pretty certainly the latter, the table itself shouldn't have a problem > with many entries. Bro's current git version has a new option to > increase the BroControl timeout for print, but here's another thing > you can do to see the output: Excellent! Thanks Robin! > Add this to your local.bro: > > event bro\_init() > { > print SSL::root\_certs; > } > > Get a small trace and run it through broctl's "process" command: > > broctl process path/to/trace > > This will print all the certs to stdout (and then process the trace). > > (Trace content doesn't matter; one of Bro's test traces will do, like > bro/testing/btest/Traces/web.trace). Much appreciated! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/adding-ssl-certs-to-bro-2-0/2098/13 "2022-05-06T15:39:58Z")