# Logging an SSL Certificate **URL:** \ **Category:** Zeek\ **Created:** [July 28, 2011, 1:30pm UTC](https://community.zeek.org/t/logging-an-ssl-certificate/1947 "2011-07-28T13:30:49Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Alvin\_Huang](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Alvin\_Huang](https://community.zeek.org/u/Alvin_Huang)\ **Post date:** [July 28, 2011, 1:30pm UTC](https://community.zeek.org/t/logging-an-ssl-certificate/1947/1 "2011-07-28T13:30:49Z")
Hey guys, I was just wondering if there was a way to log the SSL certificates from an SSL handshake. I want to log these so that I can check the signer specifically and check their authenticity. I have been working in Snort IDS but I haven’t been able to get this to work so I am going to try Bro if it is possible here instead. The main problems I run into on Snort is the TCP packets not reassembling and figuring out what content match to look for in the rules (although I can look through Wireshark and pull something out to try easily). Is this possible in Bro? Someone told me it would be available out of box on Bro so I am seriously considering this. Thanks in advance, Alvin ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [July 28, 2011, 1:57pm UTC](https://community.zeek.org/t/logging-an-ssl-certificate/1947/2 "2011-07-28T13:57:19Z")
Yep, this happens out of the box in Bro. By default, it will log all certificates seen, and it also logs any invalid certificates (for many reasons) to the notice.log file (the alert file). Also, you shouldn't be having any TCP reassembly issues in Snort if it's a recent version. Snort will absolutely not do any of this SSL stuff, so you can forget about trying to use Snort and focus on using Bro for this. Seth got me going with it and it works as advertised. ---
**Author:** ![Harry\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/h/6bbea6/32.png) [@Harry\_Hoffman](https://community.zeek.org/u/Harry_Hoffman)\ **Post date:** [July 28, 2011, 2:06pm UTC](https://community.zeek.org/t/logging-an-ssl-certificate/1947/3 "2011-07-28T14:06:42Z")
Snort can absolutly log SSL certs, you just need a rule for it (and I'm guessing emerging-threats prolly has one). Here's the rule I'm using (for our environment): # ssl connections on high ports alert tcp $HOME\_NET ![25,443,465,587,636,993,995] -\> !$HOME\_NET any (msg:"ssl\_v3\_out"; \   content:"|16 03|"; depth:2; \   content:"|02|"; distance:3; depth:1; \   content:"|03|"; distance:3; depth:1; \   content:"|16 03|"; content:"|0e|"; distance:3; depth:1; \   sid:1000019; \   threshold: type limit, track by\_src, count 2, seconds 600;) It logs more then just the cert but it's a good way to see things like TOR traffic from bridges and the like as well as the high port SSL servu ftp servers running on comp'd machiens. Cheers, Harry ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [July 28, 2011, 2:21pm UTC](https://community.zeek.org/t/logging-an-ssl-certificate/1947/4 "2011-07-28T14:21:59Z")
> Snort can absolutly log SSL certs, you just need a rule for it (and I'm > guessing emerging-threats prolly has one). Right, it can log the packet in which the cert exists and do some rudimentary checks for known strings contained within, but Bro will actually decode the cert, walk the certificate chain, match against a database of known-valid public keys from Mozilla, etc. The end result is a true test of whether or not the certificate is valid. The ET sigs (which I contributed to) for this are pretty basic content matches and only work for very specific certs. Alvin, Bro won't work on Windows, but it will read packet traces created from the Windows box, so you could capture with wireshark and then ship to a Linux or FreeBSD box running Bro. Not ideal, to be sure. Usually you run an IDS on the network ahead of the devices you're trying to monitor, not directly on them (though this is not always possible). ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 28, 2011, 6:04pm UTC](https://community.zeek.org/t/logging-an-ssl-certificate/1947/5 "2011-07-28T18:04:23Z")
Keeping in mind that this is at least true for the next release that we don't distribute as a package yet (repository only). 🙂   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/logging-an-ssl-certificate/1947/6 "2022-05-06T15:39:42Z")