class RubyScep::PkiOperation
Public Class Methods
build_response(raw_csr)
click to toggle source
@param raw_csr [String] The binary encoded CSR @return pki_message [PkiMessage], PkiMessage
with the following attributes set:
@enrollment_response: represented in an OpenSSL::ASN1 structure containing the device's MDM certificate to be installed @device_certificate: the certificate the device will use to identify itself to the MDM server
# File lib/ruby_scep/pki_operation.rb, line 10 def build_response(raw_csr) pki_message = parse_pki_message(raw_csr) csr = decrypt_pki_envelope(pki_message) pki_message.build_enrollment_response!(csr) pki_message end
Private Class Methods
decrypt_pki_envelope(pki_message)
click to toggle source
@param pki_message [RubyScep::PkiMessage] The PkiMessage
containing the CSR info sent by the iOS device @return [OpenSSL::X509::Request], the decrypted CSR
# File lib/ruby_scep/pki_operation.rb, line 32 def decrypt_pki_envelope(pki_message) encrypted_p7 = OpenSSL::PKCS7.new(pki_message.p7.data) raw_csr = encrypted_p7.decrypt(RubyScep.configuration.ca_key, RubyScep.configuration.ca, OpenSSL::PKCS7::BINARY) OpenSSL::X509::Request.new(raw_csr) end
parse_pki_message(raw_csr)
click to toggle source
@param raw_csr [String] The binary encoded CSR @return [RubyScep::PkiMessage], containing the CSR info
# File lib/ruby_scep/pki_operation.rb, line 21 def parse_pki_message(raw_csr) p7 = OpenSSL::PKCS7.new(raw_csr) flags = OpenSSL::PKCS7::BINARY | OpenSSL::PKCS7::NOVERIFY # OpenSSL::PKCS7::NOVERIFY is necessary otherwise the verify step fails p7.verify(nil, RubyScep.configuration.certificates_store, nil, flags) # necessary to populate the p7 data field asn1 = OpenSSL::ASN1.decode(p7.to_der) PkiMessage.new(asn1, p7) end