• Stars
    star
    518
  • Rank 85,392 (Top 2 %)
  • Language
    Go
  • License
    Mozilla Public Li...
  • Created about 10 years ago
  • Updated over 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

An observatory for TLS configurations, X509 certificates, and more.

Mozilla TLS Observatory

What's Deployed CircleCI

The Mozilla TLS Observatory is a suite of tools for analysis and inspection on Transport Layer Security (TLS) services. The components of TLS Observatory include:

  • EV Checker - Tool for Certificate Authorities (CAs) who request a root certificate enabled for Extended Validation (EV).
  • Certificate Explainer - Web UI that parses fields of X.509 certificates
  • tlsobs - CLI tool for issuing scans of a website
  • tlsobs-api - HTTP webserver receiving website scan requests and displaying results
  • tlsobs-runner - Service that schedules website scans
  • tlsobs-scanner - Service that performs scans and analysis of websites

Want the WebUI? Check out Mozilla's Observatory !

Getting started

You can use the TLS Observatory to compare your site against the mozilla guidelines. It requires Golang 1.15+ to be installed:

$ go version
go version go1.15 linux/amd64

$ export GOPATH="$HOME/go"
$ mkdir $GOPATH

$ export PATH=$GOPATH/bin:$PATH

Then get the binary:

$ go get github.com/mozilla/tls-observatory/tlsobs

And scan using our hosted service:

$ tlsobs tls-observatory.services.mozilla.com
Scanning tls-observatory.services.mozilla.com (id 13528951)
Retrieving cached results from 20h33m1.379461888s ago. To run a new scan, use '-r'.

--- Certificate ---
Subject  C=US, O=Mozilla Corporation, CN=tls-observatory.services.mozilla.com
SubjectAlternativeName
- tls-observatory.services.mozilla.com
Validity 2016-01-20T00:00:00Z to 2017-01-24T12:00:00Z
SHA1     FECA3CA0F4B726D062A76F47635DD94A37985105
SHA256   315A8212CBDC76FF87AEB2161EDAA86E322F7C18B27152B5CB9206297F3D3A5D
SigAlg   ECDSAWithSHA256
Key      ECDSA 384bits P-384
ID       1281826

--- Trust ---
Mozilla Microsoft Apple Android
   ✓        ✓       ✓      ✓

--- Chain of trust ---
C=US, O=Mozilla Corporation, CN=tls-observatory.services.mozilla.com (id=1281826)
└──C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA (id=5922)
   └──C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA (id=41)



--- Ciphers Evaluation ---
prio cipher                        protocols pfs                curves
1    ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2   ECDH,P-256,256bits prime256v1
2    ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2   ECDH,P-256,256bits prime256v1
OCSP Stapling        false
Server Side Ordering true
Curves Fallback      false

--- Analyzers ---
* Mozilla evaluation: modern
  - for modern level: consider adding ciphers ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, ECDHE-RSA-CHACHA20-POLY1305, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES256-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-RSA-AES128-SHA256
  - for modern level: consider enabling OCSP stapling
  - for modern level: increase priority of ECDHE-ECDSA-AES256-GCM-SHA384 over ECDHE-ECDSA-AES128-GCM-SHA256
  - for modern level: fix ciphersuite ordering, use recommended modern ciphersuite
  - oldest clients: Firefox 27, Chrome 30, IE 11 on Windows 7, Edge 1, Opera 17, Safari 9, Android 5.0, Java 8
* Grade: A (93/100)

The analysis at the end tell you what need to be changed to reach the old, intermediate or modern level. We recommend to target the intermediate level by default, and modern if you don't care about old clients.

Using the tlsobs client from Docker

A docker container also exists that contains the CLI, API, Scanner and Runner. Fetch is from docker pull mozilla/tls-observatory.

$ docker pull mozilla/tls-observatory
$ docker run -it mozilla/tls-observatory tlsobs accounts.firefox.com

Developing

You can use the Kubernetes configuration provided in https://github.com/mozilla/tls-observatory/tree/master/kubernetes , or alternatively, you can do the following:

You can use the mozilla/tls-observatory docker container for development:

$ docker pull mozilla/tls-observatory
$ docker run -it mozilla/tls-observatory /bin/bash
root@05676e6789dd:~# cd $GOPATH/src/github.com/mozilla/tls-observatory
root@05676e6789dd:/go/src/github.com/mozilla/tls-observatory# make

However, even with the docker container, you will need to setup your own postgresql database. See below.

To build a development environment from scratch, you will need Go 1.15 or above. You can set it up on your own machine or via the golang:1.15 Docker container.

Retrieve a copy of the source code using go get, to place it directly under $GOPATH/src/github.com/mozilla/tls-observatory, then use make to build all components.

$ docker run -it golang:1.15

root@c63f11b8852b:/go# go get github.com/mozilla/tls-observatory
package github.com/mozilla/tls-observatory: no buildable Go source files in /go/src/github.com/mozilla/tls-observatory

root@c63f11b8852b:/go# cd $GOPATH/src/github.com/mozilla/tls-observatory

root@c63f11b8852b:/go/src/github.com/mozilla/tls-observatory# make

make runs the tests and compiles the scanner, api, command line client and runner. The resulting binaries are placed under $GOPATH/bin.

Create the database

TLS Observatory uses PostgreSQL > 9.4. To create a database, use the schema in database/schema.sql.

postgres=# create database observatory;
CREATE DATABASE

postgres=# \c observatory
You are now connected to database "observatory" as user "postgres".

postgres=# \i /go/src/github.com/mozilla/tls-observatory/database/schema.sql

This automatically creates all tables, indexes, users and grants to work with the default configuration.

Starting the API and Scanner

First symlink the configuration to /etc/observatory and the cipherscan executable to /opt/cipherscan, as follows:

root@c63f11b8852b:/# ln -s $GOPATH/src/github.com/mozilla/tls-observatory/conf /etc/tls-observatory
root@c63f11b8852b:/# ln -s $GOPATH/src/github.com/mozilla/tls-observatory/cipherscan /opt/cipherscan

Then start tlsobs-api and tlsobs-scanner. The API will listen on port 8083, on localhost (or 172.17.0.2 if you're running in Docker).

Run a scan locally

To run a scan using the local scanner, set the -observatory flag of the tlsobs client to use the local API, as follows:

$ tlsobs -observatory http://172.17.0.2:8083 ulfr.io

Configuration

tlsobs-api

Customize the configuration file under conf/api.cfg and using the following environment variables:

  • TLSOBS_API_ENABLE set to on or off to enable or disable the API
  • TLSOBS_POSTGRES is the hostname or IP of the database server (eg. mypostgresdb.example.net)
  • TLSOBS_POSTGRESDB is the name of the database (eg. observatory)
  • TLSOBS_POSTGRESUSER is the database user (eg. tlsobsapi)
  • TLSOBS_POSTGRESPASS is the database user password (eg. mysecretpassphrase)

tlsobs-scanner

Customize the configuration file under conf/scanner.cfg and using the following environment variables:

  • TLS_AWSCERTLINT_DIR set where awslabs/certlint directory exists
  • TLSOBS_SCANNER_ENABLE set to on or off to enable or disable the scabber
  • TLSOBS_POSTGRES is the hostname or IP of the database server (eg. mypostgresdb.example.net)
  • TLSOBS_POSTGRESDB is the name of the database (eg. observatory)
  • TLSOBS_POSTGRESUSER is the database user (eg. tlsobsscanner)
  • TLSOBS_POSTGRESPASS is the database user password (eg. mysecretpassphrase)

tlsobs-runner

Runs regular tests against target sites and sends notifications.

See conf/runner.yaml for an example of configuration. Some configuration parameters can also be provided through environment variables:

  • TLSOBS_RUNNER_SMTP_HOST is the hostname of the smtp server (eg. mypostfix.example.net)
  • TLSOBS_RUNNER_SMTP_PORT is the port of the smtp server (eg. 587)
  • TLSOBS_RUNNER_SMTP_FROM is the from address of email notifications sent by the runner (eg. [email protected])
  • TLSOBS_RUNNER_SMTP_AUTH_USER is the smtp authenticated username (eg tlsobsrunner)
  • TLSOBS_RUNNER_SMTP_AUTH_PASS is the smtp user password (eg. mysecretpassphrase)
  • TLSOBS_RUNNER_SLACK_WEBHOOK is the slack webhook (eg. https://hooks.slack.com/services/not/a/realwebhook)
  • TLSOBS_RUNNER_SLACK_USERNAME is the what the message sender's username will be (eg. tlsbot)
  • TLSOBS_RUNNER_SLACK_ICONEMOJI is the what the message sender's icon will be (eg. :telescope:)

API Endpoints

POST /api/v1/scan

Schedule a scan of a given target.

$ curl -X POST 'https://tls-observatory.services.mozilla.com/api/v1/scan?target=ulfr.io&rescan=true'

Parameters:

  • target is the FQDN of the target site. eg. google.com. Do not use protocol handlers or query strings.
  • rescan asks for a rescan of the target when set to true.
  • params JSON object in which each key represents one of TLS Observatory's workers. The value under each key will be passed as the parameters to the corresponding worker. For example, {"ev-checker": {"oid": "foo"}} will pass {"oid": "foo"} to the ev-checker worker. The following workers accept parameters:
    • ev-checker: Expects a JSON object with the following keys:
      • oid: the oid of the EV policy to check
      • rootCertificate: the root certificate to check against, in PEM format

For example, with curl:

curl -X POST "http://localhost:8083/api/v1/scan?target=mozilla.org&rescan=true&params=%7B%0A%20%20%22ev-checker%22%3A%20%7B%0A%20%20%22rootcertificate%22%3A%20%22-----BEGIN%20CERTIFICATE-----%5CnMIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs%5CnMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3%5Cnd3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j%5CnZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL%5CnMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3%5CnLmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug%5CnRVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm%5Cn%2B9S75S0tMqbf5YE%2Fyc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW%5CnPNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG%2B%2BMXs2ziS4wblCJEM%5CnxChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB%5CnIk5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx%2BmM0aBhakaHPQNAQTXKFx01p8VdteZOE3%5CnhzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg%5CnEsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH%2FBAQDAgGGMA8GA1UdEwEB%2FwQF%5CnMAMBAf8wHQYDVR0OBBYEFLE%2Bw2kD%2BL9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA%5CnFLE%2Bw2kD%2BL9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec%5CnnzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe%2FEW1ntlMMUu4kehDLI6z%5CneM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF%5CnhS9OMPagMRYjyOfiZRYzy78aG6A9%2BMpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2%5CnYzi9RKR%2F5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2%2FS6cCZdkGCe%5CnvEsXCS%2B0yx5DaMkHJ8HSXPfqIbloEpw8nL%2Be%2FIBcm2PN7EeqJSdnoDfzAIJ9VNep%5Cn%2BOkuE6N36B9K%5Cn-----END%20CERTIFICATE-----%22%2C%0A%20%20%22oid%22%3A%20%222.16.840.1.114412.22.1%22%0A%7D%0A%7D"

Output: a json document containing the Scan ID.

Caching: When rescan is not true, if a scan of the target was done over the last 24 hours, the scan ID is returned. Use rescan=true to force a rescan within 24 hours of the previous scan.

Rate Limits: Each target can only be scanned every 3 minutes with rescan=true.

GET /api/v1/results

Retrieve scan results by its ID.

curl https://tls-observatory.services.mozilla.com/api/v1/results?id=12302333

Parameters:

  • id is the Scan ID

Output: a json document containing the scan results and the ID of the end-entity certificate.

GET /api/v1/certificate

Retrieve a certificate by its ID.

curl https://tls-observatory.services.mozilla.com/api/v1/certificate?id=1

Parameters:

  • id is the Certificate ID
  • sha256 the hexadecimal checksum of the DER certificate (only if id is not provided)

Output: a json document containing the parsed certificate and its raw X509 version encoded with base64.

POST /api/v1/certificate

Publish a certificate.

curl -X POST -F [email protected] https://tls-observatory.services.mozilla.com/api/v1/certificate

Parameters:

  • certificate is a POST multipart/form-data parameter that contains the PEM encoded certificate.

Output: a json document containing the parsed certificate and its raw X509 version encoded with base64.

Caching: Certificates are only stored once. The database uses the SHA256 hash of the DER (binary) certificate to identify duplicates. Posting a certificate already stored in database returns the stored version.

GET /api/v1/paths

Retrieve the paths from a certificate to one of multiple roots.

curl https://tls-observatory.services.mozilla.com/api/v1/paths?id=1

Parameters:

  • id is the ID of the certificate to start the path at.
  • sha256 the hexadecimal checksum of the DER certificate (only if id is not provided)

Output: a json document containing the paths document. Each entry in the path contains the current certificate and an array of parents, if any exist.

GET /api/v1/truststore

Retrieve all the certificates in a given truststore.

curl https://tls-observatory.services.mozilla.com/api/v1/truststore?store=mozilla&format=pem

Parameters:

  • store is the store to retrieve certificates from. "mozilla", "android", "apple", "microsoft" and "ubuntu" are allowed.
  • format, either "pem" or "json".

Output: if format is pem, a series of PEM-format certificates. If format is json, a json array of certificate objects, each with the same format of /api/v1/certificate.

GET /api/v1/issuereecount

Retrieve the count of end-entity certificates that chain to the specified certificate. This is used to evaluate weight of a given issuer in the web pki.

curl https://tls-observatory.services.mozilla.com/api/v1/issuereecount?id=1

Parameters:

  • id is the ID of the certificate to start the path at.
  • sha256 the hexadecimal checksum of the DER certificate (only if id is not provided)

Output: a json document containing the certificate itself under issuer and the count of end-entity certs under eecount.

GET /api/v1/heartbeat

Returns a 200 OK.

curl https://tls-observatory.services.mozilla.com/api/v1/__heartbeat__
I iz alive.

GET /api/v1/stats

Returns usage statistics in json (default) or text format.

By default, this endpoint returns stale data, refreshed the last time the endpoint was called, so it's possible to not have the latest available statistics. Use the query parameter details=full to get the real-time stats, but be aware that this is expensive and often times out.

curl https://tls-observatory.services.mozilla.com/api/v1/__stats__?format=text&details=full

pending scans: 7

last 24 hours
-------------
- distinct targets: 21873
- certs seen:       16459
- certs added:      7886

hourly scans
------------
2017-02-08T15:00:00Z    5
2017-02-08T14:00:00Z    64
2017-02-08T13:00:00Z    928
2017-02-08T12:00:00Z    1969
2017-02-08T11:00:00Z    1957
2017-02-08T10:00:00Z    1982
2017-02-08T09:00:00Z    2013
2017-02-08T08:00:00Z    2031
2017-02-08T07:00:00Z    2153
2017-02-08T06:00:00Z    1860
2017-02-08T05:00:00Z    1869
2017-02-08T04:00:00Z    1944
2017-02-08T03:00:00Z    1959
2017-02-08T02:00:00Z    907
2017-02-08T01:00:00Z    32
2017-02-08T00:00:00Z    55
2017-02-07T23:00:00Z    41
2017-02-07T22:00:00Z    46
2017-02-07T21:00:00Z    60
2017-02-07T20:00:00Z    76
2017-02-07T19:00:00Z    66
2017-02-07T18:00:00Z    67
2017-02-07T17:00:00Z    56

Database Queries

Find certificates signed by CAs identified by their SHA256 fingerprint

SELECT certificates.id, certificates.subject, certificates.issuer
FROM certificates INNER JOIN trust ON (certificates.id=trust.cert_id)
WHERE trust.issuer_id in (
    SELECT id FROM certificates
    WHERE sha256_fingerprint IN (
        'E7685634EFACF69ACE939A6B255B7B4FABEF42935B50A265ACB5CB6027E44E70',
        'A4B6B3996FC2F306B3FD8681BD63413D8C5009CC4FA329C2CCF0E2FA1B140305'
    ))
AND certificates.is_ca='false';

List signature algorithms of trusted certs

SELECT signature_algo, count(*)
FROM certificates INNER JOIN trust ON (certificates.id=trust.cert_id)
WHERE is_ca='false'
AND trust.trusted_mozilla='true'
GROUP BY signature_algo
ORDER BY count(*) DESC;

Show expiration dates of trusted SHA-1 certificates

SELECT  extract('year' FROM date_trunc('year', not_valid_after)) as expiration_year,
        extract('month' FROM date_trunc('month', not_valid_after)) as expiration_month,
        count(*)
FROM    certificates
    INNER JOIN trust ON (certificates.id=trust.cert_id)
WHERE is_ca='false'
    AND trust.trusted_mozilla='true'
    AND signature_algo='SHA1WithRSA'
GROUP BY date_trunc('year', not_valid_after),
         date_trunc('month', not_valid_after)
ORDER BY date_trunc('year', not_valid_after) ASC,
         date_trunc('month', not_valid_after) ASC;

Count trusted SHA-1 certs seen over the last month on TOP1M sites

SELECT distinct(certificates.id) as "id", cisco_umbrella_rank, domains, not_valid_before, not_valid_after, last_seen, signature_algo
FROM certificates
    INNER JOIN trust ON (certificates.id=trust.cert_id)
WHERE is_ca='false'
    AND trust.trusted_mozilla='true'
    AND signature_algo='SHA1WithRSA'
    AND cisco_umbrella_rank < 1000000
    AND last_seen > NOW() - INTERVAL '1 month'
    AND not_valid_after > NOW()
ORDER BY cisco_umbrella_rank ASC;

List issuer, subject and SAN of Mozilla|Firefox certs not issued by Digicert

SELECT certificates.id,
       issuer->'o'->>0 AS Issuer,
       subject->>'cn' AS Subject,
       san AS SubjectAltName
FROM certificates
      INNER JOIN trust ON (trust.cert_id=certificates.id),
     jsonb_array_elements_text(x509_subjectAltName) AS san
WHERE jsonb_typeof(x509_subjectAltName) != 'null'
      AND ( subject#>>'{cn}' ~ '\.(firefox|mozilla)\.'
            OR
            san ~ '\.(firefox|mozilla)\.'
          )
      AND trust.trusted_mozilla='true'
      AND certificates.not_valid_after>now()
      AND cast(issuer#>>'{o}' AS text) NOT LIKE '%DigiCert Inc%'
GROUP BY certificates.id, san
ORDER BY certificates.id ASC;

Find count of targets that support the SEED-SHA ciphersuite

SELECT COUNT(DISTINCT(target))
FROM scans, jsonb_array_elements(conn_info->'ciphersuite') as ciphersuites
WHERE jsonb_typeof(conn_info) != 'null'
AND ciphersuites->>'cipher'='SEED-SHA';

Find intermediate CA certs whose root is trusted by Mozilla

SELECT id, subject
FROM certificates
WHERE is_ca=True
  AND subject!=issuer
  AND issuer IN (
      SELECT subject
      FROM certificates
      WHERE in_mozilla_root_store=True
  )
GROUP BY subject, sha256_fingerprint;

Find CA certs treated as EV in Firefox

The list is CA Certs that get EV treatment in Firefox can be found here.

SELECT id, subject
FROM certificates,
     jsonb_array_elements_text(x509_certificatePolicies) AS cpol
WHERE jsonb_typeof(x509_certificatePolicies) != 'null'
  AND cpol IN ('1.2.392.200091.100.721.1','1.2.616.1.113527.2.5.1.1','1.3.159.1.17.1',
               '1.3.6.1.4.1.13177.10.1.3.10','1.3.6.1.4.1.13769.666.666.666.1.500.9.1',
               '1.3.6.1.4.1.14370.1.6','1.3.6.1.4.1.14777.6.1.1','1.3.6.1.4.1.14777.6.1.2',
               '1.3.6.1.4.1.17326.10.14.2.1.2','1.3.6.1.4.1.17326.10.8.12.1.2',
               '1.3.6.1.4.1.22234.2.14.3.11','1.3.6.1.4.1.22234.2.5.2.3.1',
               '1.3.6.1.4.1.22234.3.5.3.1','1.3.6.1.4.1.22234.3.5.3.2','1.3.6.1.4.1.23223.1.1.1',
               '1.3.6.1.4.1.29836.1.10','1.3.6.1.4.1.34697.2.1','1.3.6.1.4.1.34697.2.2',
               '1.3.6.1.4.1.34697.2.3','1.3.6.1.4.1.34697.2.4','1.3.6.1.4.1.36305.2',
               '1.3.6.1.4.1.40869.1.1.22.3','1.3.6.1.4.1.4146.1.1','1.3.6.1.4.1.4788.2.202.1',
               '1.3.6.1.4.1.6334.1.100.1','1.3.6.1.4.1.6449.1.2.1.5.1','1.3.6.1.4.1.782.1.2.1.8.1',
               '1.3.6.1.4.1.7879.13.24.1','1.3.6.1.4.1.8024.0.2.100.1.2','2.16.156.112554.3',
               '2.16.528.1.1003.1.2.7','2.16.578.1.26.1.3.3','2.16.756.1.83.21.0',
               '2.16.756.1.89.1.2.1.1','2.16.756.5.14.7.4.8','2.16.792.3.0.3.1.1.5',
               '2.16.792.3.0.4.1.1.4','2.16.840.1.113733.1.7.23.6','2.16.840.1.113733.1.7.48.1',
               '2.16.840.1.114028.10.1.2','2.16.840.1.114404.1.1.2.4.1','2.16.840.1.114412.2.1',
               '2.16.840.1.114413.1.7.23.3','2.16.840.1.114414.1.7.23.3')
  AND is_ca='true';

Evaluate the quality of TLS configurations of top sites

This query uses the top1m ranking analyzer to retrieve the Mozilla evaluation of top sites.

observatory=> SELECT COUNT(DISTINCT(target)), output->>'level' AS "Mozilla Configuration"
FROM scans
  INNER JOIN analysis ON (scans.id=analysis.scan_id)
WHERE has_tls=true
  AND target IN ( SELECT target
                  FROM scans
                  INNER JOIN analysis ON (scans.id=analysis.scan_id)
                  WHERE worker_name='top1m'
                    AND CAST(output->'target'->>'rank' AS INTEGER) < 10000
                    AND timestamp > NOW() - INTERVAL '1 month')
  AND worker_name='mozillaEvaluationWorker'
  AND timestamp > NOW() - INTERVAL '1 month'
GROUP BY has_tls, output->>'level'
ORDER BY COUNT(DISTINCT(target)) DESC;

 count | Mozilla Configuration
-------+-----------------------
  3689 | intermediate
  1906 | non compliant
  1570 | bad
    15 | old
(4 rows)

Count Top 1M sites that support RC4

SELECT COUNT(DISTINCT(target))
FROM scans,
     jsonb_array_elements(conn_info->'ciphersuite') as ciphersuites
WHERE jsonb_typeof(conn_info) = 'object'
  AND jsonb_typeof(conn_info->'ciphersuite') = 'array'
  AND ciphersuites->>'cipher' LIKE 'RC4-%'
  AND target IN ( SELECT target
                  FROM scans
                       INNER JOIN analysis ON (scans.id=analysis.scan_id)
                  WHERE worker_name='top1m'
                    AND CAST(output->'target'->>'rank' AS INTEGER) < 1000000
                    AND timestamp > NOW() - INTERVAL '1 month')
  AND timestamp > NOW() - INTERVAL '1 month';

Count Top 1M sites that support TLSv1.2

SELECT ciphersuites->'protocols' @> '["TLSv1.2"]'::jsonb AS "Support TLS 1.2", COUNT(DISTINCT(target))
FROM scans,
     jsonb_array_elements(conn_info->'ciphersuite') as ciphersuites
WHERE jsonb_typeof(conn_info) = 'object'
  AND jsonb_typeof(conn_info->'ciphersuite') = 'array'
  AND target IN ( SELECT target
                  FROM scans
                       INNER JOIN analysis ON (scans.id=analysis.scan_id)
                  WHERE worker_name='top1m'
                    AND CAST(output->'target'->>'rank' AS INTEGER) < 1000000
                    AND timestamp > NOW() - INTERVAL '1 month')
  AND timestamp > NOW() - INTERVAL '1 month'
GROUP BY ciphersuites->'protocols' @> '["TLSv1.2"]'::jsonb;

Count end-entity certificates by issuer organizations

SELECT COUNT(*), issuer#>'{o}'->>0
FROM certificates
  INNER JOIN trust ON (certificates.id=trust.cert_id)
WHERE certificates.is_ca = false
  AND trust.trusted_mozilla=true
  AND trust.is_current = true
GROUP BY issuer#>'{o}'->>0
ORDER BY count(*) DESC;

Count sites in the top 10k that are impacted by the Symantec distrust in Firefox 60

note: in Firefox 63, the not_valid_before condition will be removed

SELECT COUNT(DISTINCT(target))
FROM scans
  INNER JOIN analysis ON (scans.id=analysis.scan_id)
  INNER JOIN certificates ON (scans.cert_id=certificates.id)
WHERE has_tls=true
  AND target IN ( SELECT target
                  FROM scans
                  INNER JOIN analysis ON (scans.id=analysis.scan_id)
                  WHERE worker_name='top1m'
                    AND CAST(output->'target'->>'rank' AS INTEGER) < 10000
                    AND timestamp > NOW() - INTERVAL '1 week')
  AND worker_name='symantecDistrust'
  AND timestamp > NOW() - INTERVAL '1 week'
  AND not_valid_before < '2016-06-01'
GROUP BY has_tls, output->>'isDistrusted'
ORDER BY COUNT(DISTINCT(target)) DESC;

Contributing

We're always happy to help new contributors. You can find us in #observatory on irc.mozilla.org (Mozilla Wiki).

Dependencies

We currently vendor dependencies in vendor/.

Using a golang version with go mod,run make vendor update vendored dependencies.

Contributors

  • Julien Vehent
  • Dimitris Bachtis (original dev)
  • Adrian Utrilla

License

  • Mozilla Public License Version 2.0

More Repositories

1

pdf.js

PDF Reader in JavaScript
JavaScript
43,965
star
2

DeepSpeech

DeepSpeech is an open source embedded (offline, on-device) speech-to-text engine which can run in real time on devices ranging from a Raspberry Pi 4 to high power GPU servers.
C++
25,096
star
3

send

Simple, private file sharing from the makers of Firefox
FreeMarker
13,234
star
4

sops

Simple and flexible tool for managing secrets
Go
12,778
star
5

BrowserQuest

A HTML5/JavaScript multiplayer game experiment
JavaScript
9,167
star
6

nunjucks

A powerful templating engine with inheritance, asynchronous control, and more (jinja2 inspired)
JavaScript
8,570
star
7

geckodriver

WebDriver for Firefox
7,166
star
8

TTS

🤖 💬 Deep learning for Text to Speech (Discussion forum: https://discourse.mozilla.org/c/tts)
Jupyter Notebook
6,749
star
9

readability

A standalone version of the readability lib
JavaScript
6,470
star
10

sccache

Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage.
Rust
5,763
star
11

mozjpeg

Improved JPEG encoder.
C
5,216
star
12

Fira

Mozilla's new typeface, used in Firefox OS
CSS
4,920
star
13

rhino

Rhino is an open-source implementation of JavaScript written entirely in Java
JavaScript
4,138
star
14

shumway

Shumway is a Flash VM and runtime written in JavaScript
TypeScript
3,692
star
15

source-map

Consume and generate source maps.
JavaScript
3,556
star
16

gecko-dev

Read-only Git mirror of the Mercurial gecko repositories at https://hg.mozilla.org. How to contribute: https://firefox-source-docs.mozilla.org/contributing/contribution_quickref.html
2,897
star
17

multi-account-containers

Firefox Multi-Account Containers lets you keep parts of your online life separated into color-coded tabs that preserve your privacy. Cookies are separated by container, allowing you to use the web with multiple identities or accounts simultaneously.
JavaScript
2,718
star
18

web-ext

A command line tool to help build, run, and test web extensions
JavaScript
2,695
star
19

bleach

Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes
Python
2,651
star
20

node-convict

Featureful configuration management library for Node.js
JavaScript
2,334
star
21

cbindgen

A project for generating C bindings from Rust code
Rust
2,314
star
22

MozDef

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform
Python
2,166
star
23

popcorn-js

The HTML5 Media Framework. (Unmaintained. See https://github.com/menismu/popcorn-js for activity)
JavaScript
2,148
star
24

webextension-polyfill

A lightweight polyfill library for Promise-based WebExtension APIs in Chrome
JavaScript
2,088
star
25

fathom

A framework for extracting meaning from web pages
JavaScript
1,969
star
26

cipherscan

A very simple way to find out which SSL ciphersuites are supported by a target.
Python
1,912
star
27

hawk

HTTP Holder-Of-Key Authentication Scheme
JavaScript
1,903
star
28

neqo

Neqo, the Mozilla Firefox implementation of QUIC in Rust
Rust
1,828
star
29

persona

Persona is a secure, distributed, and easy to use identification system.
JavaScript
1,828
star
30

http-observatory

Mozilla HTTP Observatory
Python
1,784
star
31

uniffi-rs

a multi-language bindings generator for rust
Rust
1,783
star
32

mentat

UNMAINTAINED A persistent, relational store inspired by Datomic and DataScript.
Rust
1,650
star
33

task.js

Beautiful concurrency for JavaScript
JavaScript
1,635
star
34

hubs

Duck-themed multi-user virtual spaces in WebVR. Built with A-Frame.
JavaScript
1,561
star
35

fx-private-relay

Keep your email safe from hackers and trackers. Make an email alias with 1 click, and keep your address to yourself.
Python
1,473
star
36

pontoon

Mozilla's Localization Platform
Python
1,463
star
37

thimble.mozilla.org

UPDATE: This project is no longer maintained. Please check out Glitch.com instead.
JavaScript
1,423
star
38

kitsune

Platform for Mozilla Support
Python
1,289
star
39

mig

Distributed & real time digital forensics at the speed of the cloud
Go
1,195
star
40

grcov

Rust tool to collect and aggregate code coverage data for multiple source files
Rust
1,184
star
41

bedrock

Making mozilla.org awesome, one pebble at a time
HTML
1,176
star
42

OpenWPM

A web privacy measurement framework
Python
1,150
star
43

policy-templates

Policy Templates for Firefox
1,138
star
44

server-side-tls

Server side TLS Tools
HTML
1,114
star
45

rust-android-gradle

Kotlin
989
star
46

contain-facebook

Facebook Container isolates your Facebook activity from the rest of your web activity in order to prevent Facebook from tracking you outside of the Facebook website via third party cookies.
JavaScript
975
star
47

pdfjs-dist

Generic build of PDF.js library.
JavaScript
952
star
48

narcissus

INACTIVE - http://mzl.la/ghe-archive - The Narcissus meta-circular JavaScript interpreter
JavaScript
901
star
49

openbadges-backpack

Mozilla Open Badges Backpack
JavaScript
861
star
50

addons-server

🕶 addons.mozilla.org Django app and API 🎉
Python
833
star
51

awsbox

INACTIVE - http://mzl.la/ghe-archive - A featherweight PaaS on top of Amazon EC2 for deploying node apps
JavaScript
811
star
52

dxr

DEPRECATED - Powerful search for large codebases
Python
804
star
53

ssh_scan

DEPRECATED - A prototype SSH configuration and policy scanner (Blog: https://mozilla.github.io/ssh_scan/)
Ruby
793
star
54

chromeless

DEPRECATED - Build desktop applications with web technologies.
JavaScript
761
star
55

node-client-sessions

secure sessions stored in cookies
JavaScript
745
star
56

blurts-server

Mozilla Monitor arms you with tools to keep your personal information safe. Find out what hackers already know about you and learn how to stay a step ahead of them.
Fluent
726
star
57

playdoh

PROJECT DEPRECATED (WAS: "Mozilla's Web application base template. Half Django, half awesomeness, half not good at math.")
Python
714
star
58

DeepSpeech-examples

Examples of how to use or integrate DeepSpeech
Python
682
star
59

cargo-vet

supply-chain security for Rust
Rust
665
star
60

tofino

Project Tofino is a browser interaction experiment.
HTML
655
star
61

addon-sdk

DEPRECATED - The Add-on SDK repository.
641
star
62

standards-positions

Python
639
star
63

MozStumbler

Android Stumbler for Mozilla
Java
621
star
64

application-services

Firefox Application Services
Rust
608
star
65

fxa

Monorepo for Mozilla Accounts (formerly Firefox Accounts)
TypeScript
593
star
66

lightbeam

Orignal unmaintained version of the Lightbeam extension. See lightbeam-we for the new one which works in modern versions of Firefox.
JavaScript
587
star
67

firefox-translations

Firefox Translations is a webextension that enables client side translations for web browsers.
JavaScript
579
star
68

moz-sql-parser

DEPRECATED - Let's make a SQL parser so we can provide a familiar interface to non-sql datastores!
Python
574
star
69

spidernode

Node.js on top of SpiderMonkey
JavaScript
560
star
70

ichnaea

Mozilla Ichnaea
Python
559
star
71

inclusion

Our repository for Diversity, Equity and Inclusion work at Mozilla
557
star
72

positron

a experimental, Electron-compatible runtime on top of Gecko
551
star
73

addons-frontend

Front-end to complement mozilla/addons-server
JavaScript
525
star
74

nixpkgs-mozilla

Mozilla overlay for Nixpkgs.
Nix
522
star
75

bugbug

Platform for Machine Learning projects on Software Engineering
Python
503
star
76

neo

INACTIVE - http://mzl.la/ghe-archive - DEPRECATED: See https://neutrino.js.org for alternative
JavaScript
503
star
77

notes

DEPRECATED - A notepad for Firefox
HTML
495
star
78

django-csp

Content Security Policy for Django.
Python
486
star
79

skywriter

Mozilla Skywriter
JavaScript
481
star
80

Spoke

Easily create custom 3D environments
JavaScript
480
star
81

zamboni

Backend for the Firefox Marketplace
Python
474
star
82

vtt.js

A JavaScript implementation of the WebVTT specification
JavaScript
461
star
83

FirefoxColor

Theming demo for Firefox Quantum and beyond
JavaScript
460
star
84

mozilla-django-oidc

A django OpenID Connect library
Python
448
star
85

libdweb

Extension containing an experimental libdweb APIs
JavaScript
441
star
86

pointer.js

INACTIVE - http://mzl.la/ghe-archive - INACTIVE - http://mzl.la/ghe-archive - Normalizes mouse/touch events into 'pointer' events.
JavaScript
435
star
87

agithub

Agnostic Github client API -- An EDSL for connecting to REST servers
Python
419
star
88

cubeb

Cross platform audio library
C++
411
star
89

fxa-auth-server

DEPRECATED - Migrated to https://github.com/mozilla/fxa
JavaScript
401
star
90

zilla-slab

Mozilla's Zilla Slab Type Family
Shell
398
star
91

r2d2b2g

Firefox OS Simulator is a test environment for Firefox OS. Use it to test your apps in a Firefox OS-like environment that looks and feels like a mobile phone.
JavaScript
391
star
92

masche

Deprecated - MIG Memory Forensic library
Go
387
star
93

qbrt

CLI to a Gecko desktop app runtime
JavaScript
386
star
94

mp4parse-rust

Parser for ISO Base Media Format aka video/mp4 written in Rust.
Rust
380
star
95

valence

INACTIVE - http://mzl.la/ghe-archive - Firefox Developer Tools protocol adapters (Unmaintained)
JavaScript
377
star
96

OpenDesign

Mozilla Open Design aims to bring open source principles to Creative Design. Find us on Matrix: chat.mozilla.org/#/room/#opendesign:mozilla.org
370
star
97

ssl-config-generator

Mozilla SSL Configuration Generator
Handlebars
366
star
98

reflex

Functional reactive UI library
JavaScript
364
star
99

mortar

INACTIVE - http://mzl.la/ghe-archive - A collection of web app templates
364
star
100

minion

Minion
354
star