Check intermediate certificate protocol version

DataDog · Jan 25, 2022 · a11d3e7 · a11d3e7
1 parent b12871b
commit a11d3e7
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/tls/datadog_checks/tls/tls_remote.py b/tls/datadog_checks/tls/tls_remote.py
@@ -137,6 +137,11 @@ def fetch_intermediate_certs(self):
                     context.wrap_socket(sock, server_hostname=self.agent_check._server_hostname)
                 ) as secure_sock:
                     der_cert = secure_sock.getpeercert(binary_form=True)
+                    protocol_version = secure_sock.version()
+                    if protocol_version and protocol_version not in self.agent_check._allowed_versions:
+                        self.log.warning(
+                            'Protocol version not allowed for intermediate certificates: %s', protocol_version
+                        )
             except Exception as e:
                 self.log.error('Error occurred while getting cert to discover intermediate certificates: %s', e)
                 return