1
package main
2
 
3
import (
4
	"crypto/tls"
5
	"fmt"
6
	"os"
7
)
8
 
9
func main() {
10
	if len(os.Args) < 3 {
11
		fmt.Printf("missing apex and at least 1 endpoint\n")
12
		os.Exit(1)
13
	}
14
	apex := os.Args[1]
15
	nodes := os.Args[2:]
16
	tlsCfg := &tls.Config{
17
		ServerName:         apex,
18
		InsecureSkipVerify: true,
19
	}
20
	serialMap := map[string]int{}
21
	for _, node := range nodes {
22
		func() {
23
			conn, err := tls.Dial("tcp", node, tlsCfg)
24
			if err != nil {
25
				fmt.Printf("failed to connect %s: %v\n", node, err)
26
				os.Exit(1)
27
			}
28
			defer conn.Close()
29
			serial, err := peerCertificateSerial(conn.ConnectionState(), apex)
30
			if err != nil {
31
				fmt.Printf("invalid certificate from %s: %v\n", node, err)
32
				os.Exit(1)
33
			}
34
			fmt.Printf("%s - %s\n", node, serial)
35
			serialMap[serial]++
36
		}()
37
	}
38
	if len(serialMap) == 1 {
39
		fmt.Printf("validation successful\n")
40
		os.Exit(0)
41
	} else {
42
		fmt.Printf("validation failed: nodes do not have the same certificate")
43
		os.Exit(1)
44
	}
45
}
46
 
47
func peerCertificateSerial(state tls.ConnectionState, hostname string) (string, error) {
48
	if len(state.PeerCertificates) == 0 {
49
		return "", fmt.Errorf("peer did not present a certificate")
50
	}
51
	leaf := state.PeerCertificates[0]
52
	if err := leaf.VerifyHostname(hostname); err != nil {
53
		return "", err
54
	}
55
	return leaf.SerialNumber.String(), nil
56
}