# Certificate extraction issue

**URL:** <https://community.zeek.org/t/certificate-extraction-issue/5171>\
**Category:** Zeek\
**Created:** [February 2, 2018, 1:12pm UTC](https://community.zeek.org/t/certificate-extraction-issue/5171 "2018-02-02T13:12:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Timur\_Makarchuk](https://avatars.discourse-cdn.com/v4/letter/t/ed655f/32.png) [@Timur\_Makarchuk](https://community.zeek.org/u/Timur_Makarchuk)\
**Post date:** [February 2, 2018, 1:12pm UTC](https://community.zeek.org/t/certificate-extraction-issue/5171/1 "2018-02-02T13:12:16Z")

</div>

Hello, everybody

I have a trouble I can’t wrap my head around.  
I’m trying to extract SSL certificates from traffic and I have and event handler like this:

```auto
event x509_certificate (f: fa_file, cert_ref: opaque of x509, cert: X509::Certificate) {
local fileName = fmt("%s", current_time());
print fileName;
local fname = fmt("%s%s.%s", path, fileName, "pem");
local args: Files::AnalyzerArgs = record($extract_filename=fname);
Files::add_analyzer(f, Files::ANALYZER_EXTRACT, args);
}

```

For some reason I don’t understand Bro can’t add Analyzer to my files and I’m not getting any files extracted

```auto
1517409279.894576 warning in /opt/bro/share/bro/base/frameworks/files/./main.bro, line 394: Analyzer Files::ANALYZER_EXTRACT not added successfully to file Fp4AgEzEtME36Nfl2.

```

Any help will be much appreciated

Thanks,

Timur

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [February 2, 2018, 5:21pm UTC](https://community.zeek.org/t/certificate-extraction-issue/5171/2 "2018-02-02T17:21:07Z")

</div>

Hi Timur,

> Hello, everybody
> 
> I have a trouble I can't wrap my head around.  
> I'm trying to extract SSL certificates from traffic and I have and event  
> handler like this:
> 
> ```auto
> event x509_certificate (f: fa_file, cert_ref: opaque of x509, cert:
> X509::Certificate) {
> local fileName = fmt("%s", current_time());
> print fileName;
> local fname = fmt("%s%s.%s", path, fileName, "pem");
> local args: Files::AnalyzerArgs = record($extract_filename=fname);
> Files::add_analyzer(f, Files::ANALYZER_EXTRACT, args);
> }
> 
> ```
> 
> For some reason I don't understand Bro can't add Analyzer to my files and  
> I'm not getting any files extracted
> 
> ```auto
> 1517409279.894576 warning in
> /opt/bro/share/bro/base/frameworks/files/./main.bro, line 394: Analyzer
> Files::ANALYZER_EXTRACT not added successfully to file Fp4AgEzEtME36Nfl2.
> 
> ```

Files::add\_analyzer can only be called quite early - when all of the bytes  
of the file are still buffered in the core; I think the last time this is  
possible is the file\_sniff event.

That being said, with certificates you have a few other options for saving  
them to disk later. I would recommend looking at the  
policy/protocols/ssl/extract-certs-pem.bro script that ships with Bro.

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/certificate-extraction-issue/5171/3 "2022-05-06T15:45:33Z")

</div>