Add LDAP and RDP TLS peer cert tracing via CertificateTrace (Phase 2) by Pushpenderrathore · Pull Request #21607 · rapid7/metasploit-framework

Pushpenderrathore · 2026-06-25T16:53:49Z

Summary

Extends CertificateTrace peer cert tracing (introduced in #21599) to LDAP over TLS and RDP. No new operator-facing option -- operators use the existing CertificateTrace enum (off/metadata/full).

LDAP (Exploit::Remote::LDAP):

Includes CertificateTrace
ldap_open wraps both connection paths (keep_open: false via Rex::Proto::LDAP::Client.open; keep_open: true via Client._open) to read the server cert from the socket after the TLS handshake
Private _ldap_trace_peer_cert helper guards against non-TLS (plain LDAP) connections silently

RDP (Exploit::Remote::RDP):

Includes CertificateTrace
swap_sock_plain_to_ssl calls certificate_peer_cert_trace immediately after ssl.connect while the raw OpenSSL::SSL::SSLSocket is still in scope

Dedup, color, and DB recording are delegated to #certificate_peer_cert_trace in CertificateTrace (the same logic as HTTP).

Test plan

Rebased onto latest master; the conflicts with the merged CSR trace work (#21580) were resolved (peer-cert and CSR methods/specs kept as siblings). All checks below re-run after the merge.

Peer cert labeling: peer certs now print under a Peer Cert header (a label: keyword was added to CertificateTracePresenter#to_s_metadata/#to_s_full, default x.509), so a server's TLS certificate is no longer visually indistinguishable from an issued/client certificate. Issued-cert (x.509) and CSR output are unchanged.

Unit specs (this branch, post-merge):

bundle exec rspec spec/lib/msf/core/exploit/remote/certificate_trace_spec.rb - 54 examples, 0 failures
bundle exec rspec spec/lib/msf/core/exploit/remote/ldap_spec.rb - 31 examples, 0 failures
bundle exec rspec spec/lib/msf/core/exploit/remote/rdp_spec.rb - 10 examples, 0 failures

Live test - RDP peer cert trace against a real Windows domain controller (auxiliary/scanner/rdp/rdp_scanner vs 192.168.64.3:3389, CertificateTrace=full):

[CertificateTrace] Peer Cert ----------------------------
  Subject    : /CN=DC1.kerberos.issue
  Issuer     : /CN=DC1.kerberos.issue
  SHA-256    : e2b701ff59a955e75d8cb06395fdc112de068a00a616ac1e0d562c991a6167ec
  Serial     : 94318831981875632055531169548231728305

Live test - LDAP peer cert trace over LDAPS against the same DC (192.168.64.3:636, CertificateTrace=full), showing the AD CS issued cert with extensions:

[CertificateTrace] Peer Cert ----------------------------
  Subject    : /CN=DC1.kerberos.issue
  Issuer     : /DC=issue/DC=kerberos/CN=kerberos-DC1-CA
  SHA-256    : 5ba07d93b9243d781045c37db3fd3d0573e9dbc2f7be11d8fa5511f603dfba61

Dedup confirmed: one trace per host:port on both paths.
Plain (non-TLS) LDAP and RDP connections produce no output.

Notes

Depends on Add HTTP TLS peer cert tracing via CertificateTrace (Phase 1) #21599 (Phase 1, HTTP support)
WinRM over HTTPS is already covered by Phase 1 (WinRM includes HttpClient)
Postgres and SMB over TLS are pending TLS support in those mixins (Phase 3)

github-actions · 2026-06-25T16:53:58Z

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

Pushpenderrathore · 2026-06-25T17:57:18Z

Live lab validation against Windows Server 2022 AD CS DC (192.168.64.3)

LDAPS port 636 -- metadata mode

[*] Running module against 192.168.64.3
[CertificateTrace] --------------------------------------
  Subject    : /CN=DC1.kerberos.issue
  Issuer     : /DC=issue/DC=kerberos/CN=kerberos-DC1-CA
  Not Before : 2026-06-04 08:35:58 UTC
  Not After  : 2027-06-04 08:35:58 UTC
  SHA-256    : 5ba07d93b9243d781045c37db3fd3d0573e9dbc2f7be11d8fa5511f603dfba61

LDAPS port 636 -- full mode (shows AD CS template, SAN, EKU, extensions)

[CertificateTrace] --------------------------------------
  Subject    : /CN=DC1.kerberos.issue
  Issuer     : /DC=issue/DC=kerberos/CN=kerberos-DC1-CA
  Not Before : 2026-06-04 08:35:58 UTC
  Not After  : 2027-06-04 08:35:58 UTC
  SHA-256    : 5ba07d93b9243d781045c37db3fd3d0573e9dbc2f7be11d8fa5511f603dfba61
  Serial     : 624420865570961312750736130701723500422365186
  Version    : v3
  Public Key : RSA-2048
  Identity   : DC1.kerberos.issue (Subject CN)
  SAN        : othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC1.kerberos.issue
  EKU        : TLS Web Client Authentication, TLS Web Server Authentication
  Key Usage  : Digital Signature, Key Encipherment
  Extensions :
    Certificate Template Name : DomainController
    subjectKeyIdentifier : 4C:79:01:21:89:99:80:CE:0F:4A:57:08:36:9D:28:C9:A5:41:98:F8
    authorityKeyIdentifier : 66:B8:C4:19:DF:75:62:23:F4:A4:08:92:C3:8F:61:EB:BF:BC:5E:06
    crlDistributionPoints : Full Name: URI:ldap:///CN=kerberos-DC1-CA,...
    authorityInfoAccess : CA Issuers - URI:ldap:///CN=kerberos-DC1-CA,...

RDP port 3389

[CertificateTrace] --------------------------------------
  Subject    : /CN=DC1.kerberos.issue
  Issuer     : /CN=DC1.kerberos.issue
  Not Before : 2026-06-25 06:20:44 UTC
  Not After  : 2026-12-25 06:20:44 UTC
  SHA-256    : e2b701ff59a955e75d8cb06395fdc112de068a00a616ac1e0d562c991a6167ec

RDP produces a self-signed cert (Windows default) -- Subject equals Issuer, 6-month validity. Correctly identified as self-signed with no chain.

Dedup (cross-run, DB-backed)

Second run of the same module against the same host:port with CertificateTrace full produces no cert output -- the ssl.peer_cert_seen DB note from the first run suppresses it. The notes command confirms the note is present.

Notes

The ldap_query module fails with a schema query error after the cert prints -- this is pre-existing and unrelated to the tracing code (anonymous bind has insufficient privileges for schema discovery).

Pushpenderrathore · 2026-06-25T19:43:28Z

CI fix: LoginScanner::LDAP rspec failures

The rspec-rerun:spec --tag ~content jobs were failing with 10 failures in spec/lib/metasploit/framework/login_scanner/ldap_spec.rb. All failures showed "Unable to Connect" instead of "Successful" / "Incorrect".

Root cause: LoginScanner::LDAP includes Exploit::Remote::LDAP, so our new ldap_open hook calls _ldap_trace_peer_cert in scanner context. The scanner's RSpec doubles are spies that respond to any method (including peer_cert), so the respond_to?(:peer_cert) guard passed. The code then evaluated rhost and rport as arguments to certificate_peer_cert_trace -- but rhost internally calls datastore['RHOST'], and LoginScanner::LDAP has no datastore. That NoMethodError was caught by do_login's rescue StandardError and returned as UNABLE_TO_CONNECT.

Fix: Add return unless certificate_trace_enabled? at the top of _ldap_trace_peer_cert. certificate_trace_enabled? already guards on respond_to?(:datastore) && datastore, so it returns false in scanner context before rhost/rport are ever evaluated. Committed in 91f36cef.

Pushpenderrathore · 2026-07-09T15:08:15Z

Addressed the peer-cert labeling feedback: a server's TLS peer certificate was printing under the same [CertificateTrace] x.509 header as an issued/client cert, making the two indistinguishable.

Added an optional label: keyword to CertificateTracePresenter#to_s_metadata/#to_s_full (default x.509, backward compatible). certificate_peer_cert_trace now renders peer certs under a Peer Cert header; issued-cert and CSR output are unchanged.

Verified live against the AD DC (192.168.64.3), full mode.

RDP (rdp_scanner, port 3389):

[CertificateTrace] Peer Cert ----------------------------
  Subject    : /CN=DC1.kerberos.issue
  Issuer     : /CN=DC1.kerberos.issue
  Not Before : 2026-06-25 06:20:44 UTC
  Not After  : 2026-12-25 06:20:44 UTC
  SHA-256    : e2b701ff59a955e75d8cb06395fdc112de068a00a616ac1e0d562c991a6167ec
  Serial     : 94318831981875632055531169548231728305
  Version    : v3
  Public Key : RSA-2048
  Identity   : DC1.kerberos.issue (Subject CN)

LDAP over LDAPS (ldap_query, port 636):

[CertificateTrace] Peer Cert ----------------------------
  Subject    : /CN=DC1.kerberos.issue
  Issuer     : /DC=issue/DC=kerberos/CN=kerberos-DC1-CA
  Not Before : 2026-06-04 08:35:58 UTC
  Not After  : 2027-06-04 08:35:58 UTC
  SHA-256    : 5ba07d93b9243d781045c37db3fd3d0573e9dbc2f7be11d8fa5511f603dfba61
  Serial     : 624420865570961312750736130701723500422365186
  Version    : v3
  Public Key : RSA-2048
  Identity   : DC1.kerberos.issue (Subject CN)

Specs updated to lock in both the new Peer Cert label and the unchanged x.509 issued-cert label.

Copilot

Pull request overview

This PR extends the existing Msf::Exploit::Remote::CertificateTrace mixin to trace and deduplicate TLS peer certificates for additional protocols (LDAP-over-TLS and RDP), and updates the presenter to label peer cert output distinctly from issued certificates.

Changes:

Add CertificateTrace integration points to LDAP (ldap_open) and RDP (swap_sock_plain_to_ssl) to capture the TLS peer cert right after handshake.
Enhance CertificateTracePresenter to support a configurable separator label (e.g., Peer Cert vs x.509) and add/extend specs for peer-cert behavior.
Add HTTP hook to call certificate_peer_cert_trace when a peer cert is available (ensuring consistent behavior across protocols).

Impact Analysis:

Blast radius: high — lib/msf/core/exploit/remote/certificate_trace.rb and lib/msf/core/trace/certificate_trace_presenter.rb are shared mixins/utilities used by multiple protocol mixins/modules.
Data and contract effects: adds/uses DB notes of type ssl.peer_cert_seen for dedup; changes presenter method signatures to accept a keyword arg (label:) while keeping defaults for existing callers.
Rollback and test focus: rollback is straightforward (revert mixin hooks); validate (1) no output when tracing is off, (2) dedup works with/without DB, (3) LDAP ldap_open behavior with and without blocks, and (4) DB performance on large workspaces.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
spec/lib/msf/core/exploit/remote/rdp_spec.rb	Adds unit coverage to ensure RDP peer cert tracing prints only when enabled and cert is present.
spec/lib/msf/core/exploit/remote/ldap_spec.rb	Adds unit coverage for LDAP peer cert tracing for both `keep_open` paths.
spec/lib/msf/core/exploit/remote/certificate_trace_spec.rb	Adds peer-cert tracing specs (labeling, modes, dedup, DB note behavior, colors).
lib/msf/core/trace/certificate_trace_presenter.rb	Adds `label:` keyword arg support so headers can distinguish `Peer Cert` vs `x.509`.
lib/msf/core/exploit/remote/rdp.rb	Hooks peer cert tracing after `ssl.connect` during RDP TLS upgrade.
lib/msf/core/exploit/remote/ldap.rb	Hooks peer cert tracing in `ldap_open` for both open paths; adds helper.
lib/msf/core/exploit/remote/http_client.rb	Calls `certificate_peer_cert_trace` when an HTTP TLS peer cert is available.
lib/msf/core/exploit/remote/certificate_trace.rb	Implements `certificate_peer_cert_trace` with dedup, DB note recording, and labeled output.

Pushpenderrathore · 2026-07-15T19:53:35Z

Hey Jack, pushed an update to this PR. It was conflicting after #21599 landed, so I brought it up to date and addressed the Copilot review in the same pass. Split into two commits so it is easy to follow:

1. Merge upstream/master (9a5307bac5) - conflict resolution only. Both PRs touched certificate_trace.rb, so I resolved the two conflicts to master's version (the unknown-mode dispatch and its spec that landed with #21599). No behavior change in this commit.

2. Address Copilot review (c8f11f4536) - the actual fixes, isolated to 4 files:

Duplicate include: removed the second include Msf::Exploit::Remote::CertificateTrace in ldap.rb.
ldap_open block-less call: it was calling block.call(ldap) unconditionally, so ldap_open(opts) with no block raised NoMethodError. Net::LDAP.open yields to a block and closes the connection afterwards, so a block-less call should not be forwarded to it. It now opens and returns the client (same contract as keep_open). Added a spec for the no-block path.
N+1 in peer cert dedup: the DB lookup was loading the ssl.peer_cert_seen notes and walking n.host/n.service per note, which issues a query per note since db.notes only eager-loads :host. Changed it to key the note on data['endpoint'] ("host:port") and match on the note's own serialized data column, which is already loaded with the row. No association walk, no N+1. Added specs for the data-keyed dedup including a different-endpoint case.
Unknown-mode handling came in via the merge (master's case dispatch).

CI is running on the new commit. Specs for cert trace, LDAP, and RDP are green locally (84 examples, 0 failures). Let me know if you want anything reworked.

Includes CertificateTrace in Exploit::Remote::LDAP so LDAP over TLS connections surface the server certificate through the same CertificateTrace option and CertificateTraceColors that HTTP uses. No new operator-facing option is introduced. ldap_open is updated for both paths: - keep_open: false (Rex::Proto::LDAP::Client.open) -- wraps the caller block and reads peer_cert from the @open_connection socket before yielding to the caller. - keep_open: true (Rex::Proto::LDAP::Client._open) -- reads peer_cert from ldap.socket after the connection is established and returned. A private _ldap_trace_peer_cert helper centralises the socket guard and the certificate_peer_cert_trace call so both paths share the same nil-safe check. Plain LDAP connections (no TLS, no peer_cert) are silently ignored. Dedup and DB recording are handled by certificate_peer_cert_trace in the CertificateTrace mixin. Spec: 14 examples (7 new for peer cert tracing), 0 failures.

Includes CertificateTrace in Exploit::Remote::RDP so the server TLS certificate is surfaced when an operator sets CertificateTrace to metadata or full. The hook is in swap_sock_plain_to_ssl, immediately after ssl.connect succeeds -- the OpenSSL socket has a valid peer_cert at that point and before it is wrapped into the Rex SslTcp layer. No new operator-facing option is introduced; RDP re-uses the same CertificateTrace enum as HTTP and LDAP. A nil peer_cert (e.g. when the server sends no certificate) is a silent no-op. Spec: 3 new examples covering TLS cert printed, off mode silent, and nil peer_cert silent.

LoginScanner::LDAP includes Exploit::Remote::LDAP so it calls _ldap_trace_peer_cert via ldap_open. LoginScanner does not have datastore, so calling rhost (which calls datastore['RHOST']) raises NoMethodError, caught as UNABLE_TO_CONNECT in the scanner. Guard with certificate_trace_enabled? at the top so we return before evaluating rhost/rport when tracing is unavailable.

- ldap.rb: remove the duplicate CertificateTrace include. - ldap_open: handle a block-less call. Net::LDAP.open yields to a block and closes the connection, so forwarding a nil block raised NoMethodError; open and return the client (as keep_open does) instead. - certificate_peer_cert_trace: key the DB dedup on the note's own serialized data ("host:port") instead of walking the host/service associations, which issued a query per note (N+1). - Specs: cover the block-less ldap_open path and the data-keyed dedup (including a different-endpoint case).

Pushpenderrathore · 2026-07-15T20:31:19Z

@jheysel-r7 rebased Phase 2 onto master as requested. It is a clean linear history now (the shared peer-cert work from #21599 dropped out since it is already on master), and the Copilot review is addressed. All checks have passed (46 successful, 1 skipped) and specs for cert trace, LDAP, and RDP are green locally (84 examples, 0 failures). Ready for review whenever you get a chance.

jheysel-r7

Looks great @Pushpenderrathore thanks for this update!

Testing

LDAP

msf auxiliary(gather/ldap_query) > run
[*] Running module against 172.16.199.200
[CertificateTrace] Peer Cert ----------------------------
  Subject    :
  Issuer     : /DC=issue/DC=kerberos/CN=kerberos-DC2-CA
  Not Before : 2026-05-05 17:17:16 UTC
  Not After  : 2027-05-05 17:17:16 UTC
  SHA-256    : 96576841d03b8b872099e841918486db86709a405b4b3226406ed2e010621bc7
  Serial     : 1828661108666046931287660402855086338078671307
  Version    : v3
  Public Key : RSA-2048
  SAN        : DNS:dc2.kerberos.issue, DNS:kerberos.issue, DNS:KERBEROS
  EKU        : TLS Web Client Authentication, TLS Web Server Authentication, Microsoft Smartcard Login, Signing KDC Response
  Key Usage  : Digital Signature, Key Encipherment
  Extensions :
    Certificate Template Information : Template 1.3.6.1.4.1.311.21.8.12682474.6065318.6963902.6406785.3291287.83.1.33 (v110.1)
    Application Policies : 1.3.6.1.5.5.7.3.2 (Client Authentication), 1.3.6.1.5.5.7.3.1 (Server Authentication), 1.3.6.1.4.1.311.20.2.2 (Smart Card Logon), 1.3.6.1.5.2.3.5
    subjectKeyIdentifier : EC:3B:36:5A:7F:11:DC:1A:2A:F2:28:E6:37:86:20:F8:25:DF:15:A9
    authorityKeyIdentifier : 39:A1:AB:7A:6E:8A:70:91:7D:EF:83:78:9D:9F:32:19:5A:AE:A0:ED
    crlDistributionPoints : Full Name:
  URI:ldap:///CN=kerberos-DC2-CA,CN=dc2,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=kerberos,DC=issue?certificateRevocationList?base?objectClass=cRLDistributionPoint

    authorityInfoAccess : CA Issuers - URI:ldap:///CN=kerberos-DC2-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=kerberos,DC=issue?cACertificate?base?objectClass=certificationAuthority


msf auxiliary(gather/ldap_query) > db_status
[*] Connected to msf. Connection type: postgresql.
msf auxiliary(gather/ldap_query) > run
[*] Running module against 172.16.199.200
[-] Auxiliary aborted due to failure: no-access: Invalid credentials provided!
[*] Auxiliary module execution completed
msf auxiliary(gather/ldap_query) > db_disconnect
Successfully disconnected from the data service: local_db_service.
msf auxiliary(gather/ldap_query) > set certificatetrace metadata
certificatetrace => metadata

msf auxiliary(gather/ldap_query) > run
[*] Running module against 172.16.199.200
[CertificateTrace] Peer Cert ----------------------------
  Subject    :
  Issuer     : /DC=issue/DC=kerberos/CN=kerberos-DC2-CA
  Not Before : 2026-05-05 17:17:16 UTC
  Not After  : 2027-05-05 17:17:16 UTC
  SHA-256    : 96576841d03b8b872099e841918486db86709a405b4b3226406ed2e010621bc7

RDP

msf auxiliary(scanner/rdp/rdp_scanner) > run
[CertificateTrace] Peer Cert ----------------------------
  Subject    : /CN=dc2.kerberos.issue
  Issuer     : /CN=dc2.kerberos.issue
  Not Before : 2026-07-15 17:51:29 UTC
  Not After  : 2027-01-14 17:51:29 UTC
  SHA-256    : 84ca072ea07feb5606c0d5fad7fb89f486894fffc69ee7d4a37099a250c66d9e
  Serial     : 74753792603575789070804919156855713120
  Version    : v3
  Public Key : RSA-2048
  Identity   : dc2.kerberos.issue (Subject CN)
  EKU        : TLS Web Server Authentication
  Key Usage  : Key Encipherment, Data Encipherment
[*] 172.16.199.200:3389   - Detected RDP on 172.16.199.200:3389   (name:DC2) (domain:KERBEROS) (domain_fqdn:kerberos.issue) (server_fqdn:dc2.kerberos.issue) (os_version:10.0.17763) (Requires NLA: Yes)
[*] 172.16.199.200:3389   - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/rdp/rdp_scanner) > set certificatetrace metadata
certificatetrace => metadata
msf auxiliary(scanner/rdp/rdp_scanner) > run
[CertificateTrace] Peer Cert ----------------------------
  Subject    : /CN=dc2.kerberos.issue
  Issuer     : /CN=dc2.kerberos.issue
  Not Before : 2026-07-15 17:51:29 UTC
  Not After  : 2027-01-14 17:51:29 UTC
  SHA-256    : 84ca072ea07feb5606c0d5fad7fb89f486894fffc69ee7d4a37099a250c66d9e
[*] 172.16.199.200:3389   - Detected RDP on 172.16.199.200:3389   (name:DC2) (domain:KERBEROS) (domain_fqdn:kerberos.issue) (server_fqdn:dc2.kerberos.issue) (os_version:10.0.17763) (Requires NLA: Yes)
[*] 172.16.199.200:3389   - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/rdp/rdp_scanner) >

jenkins-eks-metasploit · 2026-07-16T18:42:53Z

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-16T18:45:45Z

Pipeline results available

Slice summary:

No test slices found.

Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-16T20:06:05Z

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-16T20:08:48Z

Pipeline results available

Slice summary:

No test slices found.

Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-16T21:15:22Z

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-16T21:18:23Z

Pipeline results available

Slice summary:

No test slices found.

Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-16T21:22:51Z

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-17T00:33:18Z

Pipeline results available

Slice summary:

Test slice 1 - 🟢
Test slice 2 - 🟢

Note: build results only accessible to maintainers.

jheysel-r7 · 2026-07-17T23:13:01Z

Release notes

This extends CertificateTrace peer cert tracing to support LDAP over TLS and RDP. No new operator-facing option -- operators use the existing CertificateTrace enum (off/metadata/full).

github-actions Bot added the additional-testing-required label Jun 25, 2026

smcintyre-r7 added this to Metasploit Kanban Jun 25, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Jun 25, 2026

Pushpenderrathore mentioned this pull request Jun 25, 2026

Add Postgres TLS support and peer cert tracing via CertificateTrace (Phase 3) #21608

Open

Pushpenderrathore marked this pull request as ready for review June 25, 2026 17:57

smcintyre-r7 added the GSoC Google Summer of Code project PRs label Jul 8, 2026

Pushpenderrathore closed this Jul 15, 2026

github-project-automation Bot moved this from Todo to Done in Metasploit Kanban Jul 15, 2026

Pushpenderrathore reopened this Jul 15, 2026

github-project-automation Bot moved this from Done to In Progress in Metasploit Kanban Jul 15, 2026

jheysel-r7 self-assigned this Jul 15, 2026

jheysel-r7 requested a review from Copilot July 15, 2026 18:06

Copilot started reviewing on behalf of jheysel-r7 July 15, 2026 18:06 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Comment thread lib/msf/core/exploit/remote/ldap.rb Outdated

Comment thread lib/msf/core/exploit/remote/ldap.rb

Comment thread lib/msf/core/exploit/remote/certificate_trace.rb

Comment thread lib/msf/core/exploit/remote/certificate_trace.rb

Pushpenderrathore added 4 commits July 16, 2026 01:35

Pushpenderrathore force-pushed the feature/ssl-peer-cert-trace-phase2 branch from c8f11f4 to bb9c01d Compare July 15, 2026 20:12

jheysel-r7 approved these changes Jul 16, 2026

View reviewed changes

jheysel-r7 added the rn-enhancement release notes enhancement label Jul 16, 2026

jheysel-r7 approved these changes Jul 17, 2026

View reviewed changes

jheysel-r7 merged commit fcd24bc into rapid7:master Jul 17, 2026
48 checks passed

github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Jul 17, 2026

Uh oh!

Conversation

Pushpenderrathore commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Notes

Uh oh!

github-actions Bot commented Jun 25, 2026

Uh oh!

Pushpenderrathore commented Jun 25, 2026

Live lab validation against Windows Server 2022 AD CS DC (192.168.64.3)

LDAPS port 636 -- metadata mode

LDAPS port 636 -- full mode (shows AD CS template, SAN, EKU, extensions)

RDP port 3389

Dedup (cross-run, DB-backed)

Notes

Uh oh!

Pushpenderrathore commented Jun 25, 2026

CI fix: LoginScanner::LDAP rspec failures

Uh oh!

Pushpenderrathore commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Pushpenderrathore commented Jul 15, 2026

Uh oh!

Pushpenderrathore commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jheysel-r7 left a comment

Choose a reason for hiding this comment

Testing

Uh oh!

jenkins-eks-metasploit Bot commented Jul 16, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 16, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 16, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 16, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 16, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 16, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 16, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 17, 2026

Uh oh!

Uh oh!

jheysel-r7 commented Jul 17, 2026

Release notes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Pushpenderrathore commented Jun 25, 2026 •

edited

Loading

Pushpenderrathore commented Jul 9, 2026 •

edited

Loading

Pushpenderrathore commented Jul 15, 2026 •

edited

Loading