Add KeyUsage, ExtendedKeyUsage, CipherSuite & Protocol to SSL diagnos…

libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslDiagnostics.java

@@ -33,6 +33,8 @@
 import java.util.Map;
 import java.util.Optional;
 import java.util.stream.Collectors;
+import java.util.Arrays;
+import java.util.stream.IntStream;
 
 public class SslDiagnostics {
 
@@ -151,6 +153,30 @@ boolean isSameCertificate() {
         }
     }
 
+    public enum ExtendedKeyUsage {
+        serverAuth ("1.3.6.1.5.5.7.3.1"),
+        clientAuth ("1.3.6.1.5.5.7.3.2"),
+        codeSigning ("1.3.6.1.5.5.7.3.3"),
+        emailProtection ("1.3.6.1.5.5.7.3.4"),
+        timeStamping ("1.3.6.1.5.5.7.3.8"),
+        ocspSigning ("1.3.6.1.5.5.7.3.9");
+
+        private String oid;
+
+        private ExtendedKeyUsage(String oid) {
+            this.oid = oid;
+        }
+
+        public static String decodeOid(String oid) {
+            for (ExtendedKeyUsage e : values()) {
+                if (e.oid != null && e.oid.equals(oid)) {
+                    return e.name();
+                }
+            }
+            return oid;
+        }
+    }
+
     /**
      * @param contextName    The descriptive name of this SSL context (e.g. "xpack.security.transport.ssl")
      * @param trustedIssuers A Map of DN to Certificate, for the issuers that were trusted in the context in which this failure occurred
@@ -177,8 +203,14 @@ public static String getTrustDiagnosticFailure(X509Certificate[] chain, PeerType
             .append(peerType.name().toLowerCase(Locale.ROOT))
             .append(" provided a certificate with subject name [")
             .append(peerCert.getSubjectX500Principal().getName())
-            .append("] and ")
-            .append(fingerprintDescription(peerCert));
+            .append("], ")
+            .append(fingerprintDescription(peerCert))
+            .append(", ")
+            .append(keyUsageDescription(peerCert))
+            .append(" and ")
+            .append(extendedKeyUsageDescription(peerCert));
+
+        addSessionDescription(session, message);
 
         if (peerType == PeerType.SERVER) {
             try {
@@ -406,4 +438,58 @@ private static boolean checkIssuer(X509Certificate certificate, X509Certificate
     private static boolean isSelfIssued(X509Certificate certificate) {
         return certificate.getIssuerX500Principal().equals(certificate.getSubjectX500Principal());
     }
+
+    private static String keyUsageDescription(X509Certificate certificate) {
+        boolean[] keyUsage = certificate.getKeyUsage();
+        if (keyUsage == null || keyUsage.length == 0) {
+            return "no keyUsage";
+        }
+
+        final String[] keyUsageGlossary = {"digitalSignature", "nonRepudiation", "keyEncipherment",
+            "dataEncipherment", "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly",
+            "decipherOnly"};
+
+        List<String> keyUsageDescription = new ArrayList<>();
+        IntStream.range(0, keyUsage.length).forEach(i -> {
+            if (keyUsage[i]) {
+                keyUsageDescription.add(keyUsageGlossary[i]);
+            }
+        });
+        return keyUsageDescription.stream()
+            .reduce((a, b) -> a + ", " + b)
+            .map(str ->  "keyUsage [" + str + "]")
+            .orElse("no keyUsage");
+    }
+
+    private static String extendedKeyUsageDescription(X509Certificate certificate) {
+        try {
+            return Optional.ofNullable(certificate.getExtendedKeyUsage())
+                .map(keyUsage -> generateExtendedKeyUsageDescription(keyUsage))
+                .orElse("no extendedKeyUsage");
+        } catch (CertificateParsingException e) {
+            return "invalid extendedKeyUsage [" + e.toString() + "]";
+        }
+    }
+
+    private static String generateExtendedKeyUsageDescription(List<String> oids) {
+        return oids.stream()
+            .map(ExtendedKeyUsage::decodeOid)
+            .reduce((x, y) -> x + ", " + y)
+            .map(str -> "extendedKeyUsage [" + str + "]")
+            .orElse("no extendedKeyUsage");
+    }
+
+    private static void addSessionDescription(SSLSession session, StringBuilder message) {
+        String cipherSuite = Optional.ofNullable(session)
+            .map(SSLSession::getCipherSuite)
+            .orElse("<unknown cipherSuite>");
+        String protocol = Optional.ofNullable(session)
+            .map(SSLSession::getProtocol)
+            .orElse("<unknown protocol>");
+        message.append("; the session supports cipher suite [")
+            .append(cipherSuite)
+            .append("] and protocol [")
+            .append(protocol)
+            .append("]");
+    }
 }