mirror of
https://github.com/eworm-de/routeros-scripts.git
synced 2025-08-04 02:05:01 +02:00
aa294b4c67
... when default capath contains system certs If curl has a default capath (debian 12 capath=/etc/ssl/certs) it will add those certs and return ok to any valid https url, defeating the intended use of the cacert option in the Makefile that validates sites and certs. To avoid that, adding option "--capath /dev/null" overrides the default value, if any. Closes: https://github.com/eworm-de/routeros-scripts/pull/88
32 lines
993 B
Makefile
32 lines
993 B
Makefile
# Makefile to check certificates
|
|
|
|
DOMAINS = \
|
|
1.1.1.1/DigiCert-Global-Root-G2 \
|
|
8.8.8.8/GTS-Root-R1 \
|
|
9.9.9.9/DigiCert-Global-Root-G3 \
|
|
api.macvendors.com/GTS-Root-R4 \
|
|
api.mullvad.net/ISRG-Root-X1 \
|
|
api.telegram.org/Go-Daddy-Root-Certificate-Authority-G2 \
|
|
cloudflare-dns.com/DigiCert-Global-Root-G2 \
|
|
dns.google/GTS-Root-R1 \
|
|
dns.quad9.net/DigiCert-Global-Root-G3 \
|
|
feodotracker.abuse.ch/GlobalSign \
|
|
git.eworm.de/ISRG-Root-X2 \
|
|
ipv4.showipv6.de/ISRG-Root-X1 \
|
|
ipv4.tunnelbroker.net/Starfield-Root-Certificate-Authority-G2 \
|
|
ipv6.showipv6.de/ISRG-Root-X1 \
|
|
lists.blocklist.de/Certum-Trusted-Network-CA \
|
|
matrix.org/GTS-Root-R4 \
|
|
mkcert.org/ISRG-Root-X1 \
|
|
ntfy.sh/ISRG-Root-X1 \
|
|
sslbl.abuse.ch/GlobalSign \
|
|
upgrade.mikrotik.com/ISRG-Root-X1 \
|
|
www.dshield.org/ISRG-Root-X1 \
|
|
www.spamhaus.org/GTS-Root-R4
|
|
|
|
.PHONY: $(DOMAINS)
|
|
|
|
all: $(DOMAINS)
|
|
|
|
$(DOMAINS):
|
|
curl --output /dev/null --silent --connect-timeout 5 --capath /dev/null --cacert $(notdir $@).pem https://$(dir $@)
|