id: fortimanager-certificate

info:
  name: Fortinet FortiManager Certificate - Detect
  author: johnk3r
  severity: info
  metadata:
    verified: true
    max-request: 1
    shodan-query: ssl:"ou=fortimanager"
  tags: ssl,tls,fortinet,fortimanager,discovery

ssl:
  - address: "{{Host}}:{{Port}}"
  - address: "{{Host}}:541"

    matchers-condition: and
    matchers:
      - type: word
        part: subject_dn
        words:
          - "O=Fortinet, L=Sunnyvale, ST=California, C=US, emailAddress=support@fortinet.com"

      - type: word
        part: subject_dn
        words:
          - "OU=FortiManager"

    extractors:
      - type: dsl
        dsl:
          - 'subject_cn'
# digest: 490a0046304402203c8077824ce81aefc18768bf12419391e3f3945e36afcf6e021ecfca640d02bb022078d9fd24f8e96c363ca523c24d8954ce29e02088dfe4dae7344ef1dae63f279b:922c64590222798bb761d5b6d8e72950