I have the following question: assuming I have a TCPDump file containing a number of HTTPS connections using TLS mutual authentication, is there a way to extract all client certificates sent to the server ?
Some background I have a customer where a SOAP service I provided was setup to use HTTPS with client authentication. The requirement where to use self-signed certificate in both end of the connection and the server is running on 2008R2+IIS.
Four years ago, I had to perform the installation and instructed the admins how to manage the client certificates. This month, the customer came back to me (as I expected) saying that they have made a mess and that they have now 6 times more certificates than they have connections that are being allowed to connect. Since they are migrating, they want my help to cleanup that mess.
The certificates have been created by people of various level of competencies: a few are well defined and can be readily identified. But others are clearly the result of someone ready a minimal "How to create an X509v1 cert": 1024 bits RSA keys, nothing useful in the subject, etc.
I had two ideas on how to approach this: the first was to create different local users for the different certs, change the IIS client certificate mapping to use these new users and then simply parse the IIS log to see who is connecting. This is still possible but, given the requirement from the admins, it would require them to create numerous AD accounts and grant all of them rights on the database: that's going to take them very long to setup (not counting the fact that it'll be a pain to configure is IIS).
So, I was wondering if I couldn't just use a network monitor to dump all HTTPS sessions going to that socket of and enumerate all the certificates that are used as client auth in the TLS handshake.