Add proxy support for SSL certificate fetching in ssl_check utility

ssl_check.py

@@ -20,6 +20,7 @@ import argparse
 import base64
 import re
 import shutil
+import os
 import subprocess
 import sys
 import tempfile
@@ -43,6 +44,59 @@ def run_openssl_s_client(host: str, port: int = 443, tls_flag: str | None = None
     return proc.stdout + "\n" + proc.stderr
 
 
+def fetch_cert_via_proxy(host: str, port: int, proxy: str, timeout: int = 20) -> List[str]:
+    """Connect to proxy, issue CONNECT, perform TLS handshake and return PEM of the leaf cert."""
+    from urllib.parse import urlparse
+    import socket
+    import ssl
+    import base64
+
+    parsed = urlparse(proxy)
+    proxy_host = parsed.hostname
+    proxy_port = parsed.port or (443 if parsed.scheme == 'https' else 80)
+
+    auth_header = None
+    if parsed.username:
+        user = parsed.username
+        pwd = parsed.password or ""
+        cred = f"{user}:{pwd}".encode("utf-8")
+        auth_header = base64.b64encode(cred).decode("ascii")
+
+    s = socket.create_connection((proxy_host, proxy_port), timeout=timeout)
+    try:
+        connect_req = f"CONNECT {host}:{port} HTTP/1.1\r\nHost: {host}:{port}\r\n"
+        if auth_header:
+            connect_req += f"Proxy-Authorization: Basic {auth_header}\r\n"
+        connect_req += "\r\n"
+        s.sendall(connect_req.encode("ascii"))
+
+        # read response headers
+        resp = b""
+        while b"\r\n\r\n" not in resp:
+            chunk = s.recv(4096)
+            if not chunk:
+                break
+            resp += chunk
+            if len(resp) > 65536:
+                break
+
+        header = resp.split(b"\r\n\r\n", 1)[0].decode("ascii", errors="ignore")
+        # Simple status check
+        first_line = header.splitlines()[0] if header.splitlines() else ""
+        if not first_line.startswith("HTTP/") or ("200" not in first_line):
+            raise RuntimeError(f"Proxy CONNECT failed: {first_line}")
+
+        # Wrap the socket with SSL and fetch peer cert (leaf)
+        ctx = ssl.create_default_context()
+        with ctx.wrap_socket(s, server_hostname=host) as ss:
+            der = ss.getpeercert(True)
+            pem = ssl.DER_cert_to_PEM_cert(der)
+            return [pem]
+    except Exception:
+        s.close()
+        raise
+
+
 def extract_pem_blocks(s: str) -> List[str]:
     pattern = re.compile(r"-----BEGIN CERTIFICATE-----(?:.|\n)*?-----END CERTIFICATE-----", re.M)
     return pattern.findall(s)
@@ -127,6 +181,33 @@ def main(argv: List[str]) -> int:
         except Exception as e:
             print(f"OpenSSL check failed: {e}")
 
+    # If openssl couldn't fetch a chain (or wasn't available), attempt a proxy-aware
+    # fetch if HTTPS_PROXY or HTTP_PROXY is set. This helps in corporate networks
+    # where direct TLS is blocked and a proxy must be used.
+    if not extract_pem_blocks(out):
+        proxy = None
+        for key in ("HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"):
+            proxy = os.environ.get(key)
+            if proxy:
+                break
+        if proxy:
+            try:
+                print(f"Attempting proxy CONNECT via {proxy}")
+                pems = fetch_cert_via_proxy(host, port, proxy)
+                if pems:
+                    print(f"Fetched {len(pems)} PEM(s) via proxy")
+                    server_paths = write_pems_to_temp(pems)
+                    server_info = [inspect_cert(p) for p in server_paths]
+                    print("Server chain (proxy fetched):")
+                    for i, (s, iss, fp) in enumerate(server_info):
+                        print(f"[{i}] SUBJECT: {s}")
+                        print(f"    ISSUER: {iss}")
+                        print(f"    FP: {fp}")
+                else:
+                    print("Proxy CONNECT succeeded but no certs found")
+            except Exception as e:
+                print(f"Proxy CONNECT fetch failed: {e}")
+
     # extract certs from openssl output if any
     pems = extract_pem_blocks(out)
     if pems: