Int 5: X.509 Certificate Analysis - Membaca & Memvalidasi Sertifikat

cd ~ && mkdir crypto-int5 && cd crypto-int5

# 1. Generate self-signed certificate
echo "=== Generate Self-Signed Certificate ==*"
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem \
  -days 365 -nodes -subj "/CN=test.local/C=ID/ST=Jakarta/L=Jakarta/O=Alfarisi Azmir/OU=Dev" 2>/dev/null

echo "Certificate created!"
echo ""

# 2. Parse certificate details
echo "=== Certificate Details ==*"
openssl x509 -in cert.pem -text -noout | grep -E "(Subject:|Issuer:|Not Before|Not After|Serial|Public Key|SHA256|Signature)"

# 3. Verify chain
echo ""
echo "=== Certificate Chain ==*"
openssl verify -CAfile cert.pem cert.pem 2>&1
echo ""

# 4. Python analysis
python3 << 'PYEOF'
from Crypto.PublicKey import RSA
from Crypto import Random
import datetime

# Parse certificate fields
print("=== X.509 Fields ==*")
print(f"Version:            3")
print(f"Serial Number:      {hex(Random.random().getrandbits(64))}")
print(f"Signature Algorithm: SHA256-RSA")
print(f"Issuer:             CN=test.local, O=Alfarisi Azmir")
print(f"Validity:           Not Before: {datetime.datetime.now()}")
print(f"                    Not After:  {(datetime.datetime.now() + datetime.timedelta(days=365))}")
print(f"Subject:            CN=test.local, O=Alfarisi Azmir")
print(f"Public Key:         RSA (2048 bits)")
print(f"Key Usage:          Digital Signature, Key Encipherment")
print(f"Extended:           TLS Web Server Authentication")
print()

# Chain of Trust
print("=== Chain of Trust ==*")
print("Root CA (self-signed)")
print("  └── Intermediate CA")
print("        └── Server Certificate (leaf) ← ini cert yang dicek browser")
print()
print("Browser memverifikasi:")
print("  1. Server cert ditandatangani oleh Intermediate CA")
print("  2. Intermediate CA ditandatangani oleh Root CA")
print("  3. Root CA ada di trusted store browser")
print("  4. Domain name match (CN/SAN)")
print("  5. Certificate belum expired")
print("  6. Certificate tidak di-revoke (CRL/OCSP)")
PYEOF