// TLS-only acceptance: no HTTP requests, accounts, API Keys, or business data.
package main

import (
	"crypto/tls"
	"encoding/json"
	"fmt"
	"net"
	"os"
	"runtime"
	"strings"
	"time"
)

func main() {
	targets := []string{"nodejs.org", "dv-g3b-emudhra.we-have-a-problem.com", "dv-g3b-aaa-emudhra.we-have-a-problem.com"}
	results := []map[string]any{}
	passed := true
	for i, host := range targets {
		c, err := tls.DialWithDialer(&net.Dialer{Timeout: 10 * time.Second}, "tcp", host+":443", &tls.Config{ServerName: host, MinVersion: tls.VersionTLS12})
		row := map[string]any{"host": host}
		if err == nil {
			c.Close()
			row["result"] = "accepted"
			if i != 0 { passed = false }
		} else {
			row["error"] = err.Error()
			row["result"] = "inconclusive"
			if strings.Contains(err.Error(), "x509:") { row["result"] = "certificate_rejected" }
			if i == 0 || row["result"] != "certificate_rejected" { passed = false }
		}
		results = append(results, row)
	}
	b, _ := json.Marshal(map[string]any{"go":runtime.Version(), "httpRequests":0, "passed":passed, "results":results})
	fmt.Println(string(b))
	if !passed { os.Exit(1) }
}