Lua script to get suricata alert when newly created TLS certificate is observed on wire. Courtesy of regit - https://github.com/regit

new-cert.lua

-- courtesy of regit - https://github.com/regit
function init (args)
    local needs = {}
    needs["tls"] = tostring(true)
    needs["flowint"] = {"cert-age"}
    return needs
end

function match(args)
    notbefore = TlsGetCertNotBefore()

    if not notbefore then
        return 0
    end

    if os.time() - notbefore <  3 * 3600  then
        ScFlowintSet(0, os.time() - notbefore)
        return 1
    end
    return 0
end

tls.rules

#alert tls any any -> any any (msg:"Self signed certificate"; lua:self-signed-cert.lua; tls.store; sid:1; rev:1;)
alert tls any any -> any any (msg:"Recent certificate"; lua:new-cert.lua; tls.store; sid:2; rev:1;)