go-fakessl

go-fakessl is a pentesting tool designed to clone SSL/TLS certificates from a target server and create a new, self-signed look-alike certificate using its public key. This tool can be used for testing SSL/TLS security and inspecting server certificates. It also allows you to run a local HTTPS server with the cloned certificate for testing purposes.

WARNING: This tool is for authorized security testing only. Unauthorized use may violate laws and regulations. The author and contributors are not responsible for misuse. Always obtain explicit permission before testing any system.

Features

Clone SSL Certificates: Clone SSL/TLS certificates from target servers by specifying their URL.
Generate New Certificate and Key: Create a new certificate using the cloned public key and a freshly generated RSA private key.
Run HTTPS Server: Start an HTTPS server locally using the cloned certificate for testing.
Inspect Certificates: Use openssl commands to inspect the original and cloned certificates.

Installation

Prerequisites

Go: Version 1.18 or later.
OpenSSL: For inspecting and comparing certificates.

Steps

Clone the repository:

$ git clone https://cgit.heqnx.com/go-fakessl
$ cd go-fakessl

Install dependencies:

$ go mod tidy

Build for all platforms:

$ make all

Binaries will be generated in the build/ directory for Linux, Windows, and macOS; alternatively, build for a specific platform:

$ make linux-amd64
$ make windows-amd64
$ make darwin-arm64

(Optional) Run directly with Go:

$ go run main.go [-cert <cert> -key <key> -port <port] -url <url>

Usage

Command-Line Flags

Usage of ./go-fakessl-<platform>-<arch>:
  -cert string
        path to certificate file to use for a test https server
  -key string
        path to key file to use for a test https server
  -port string
        port to use for a test https server (default "8000")
  -url string
        target https url to clone certificate from (e.g. https://google.com)

Examples

Clone the SSL certificate of google.com

$ ./go-fakessl-linux-amd64 -url https://google.com
url             cloned cert             private key
google.com:443  google.com_clone.pem    google.com_clone.key

[inf] start an https server to test cloned certificate with:
$ ./go-fakessl-linux-amd64 -cert google.com_clone.pem -key google.com_clone.key -port 8000

[inf] manually inspect and diff the original certificate and cloned certificate with:
$ openssl s_client -connect google.com:443 </dev/null 2>/dev/null | openssl x509 -noout -text > google.com_original.txt
$ openssl x509 -in google.com_clone.pem -noout -text > google.com_clone.pem_clone.txt
$ diff *.txt

License

This project is licensed under the GNU GENERAL PUBLIC LICENSE. See the LICENSE file for details.

Disclaimer

go-fakessl is provided "as is" without warranty. The author and contributors are not liable for any damages or legal consequences arising from its use. Use responsibly and only in authorized environments.