Fan out tls scans for dns round-robin records

[strushb]

Hello prbinu,

tls-scan really helps me to keep an eye on my certificates, thank you very much : )

Lately, I added a second webserver to my dummy-domain via dns RR and would like to monitor both using your tool. Sadly, I also tried out SNI on the new host so now I am facing a small problem:

• tls-scan with all my domains / certs in a list does not scan both RR hosts, only the first returned in each run
• tls-scan with all my hosts in a list (using IP) does not scan all my certificates because of SNI

Although C is not my main programming language I am checking the source to see if I can help in any way, but right now I cannot see how to prepare a viable demo or finished pull request. ts_scan_tcp_connect_hostname handles one host only, and while reading the input list I found no way to pass on more than one host.

I am trying to extend ts_parse_connect_target to return an address along with a hostname and maybe put a dns lookup into ts_get_line_input later. If you have any ideas or feedback on this I would be happy to hear it : D

Stephan

[prbinu]

Hi @strushb, can you share the tls-scan command-line you tried in both cases?