class Stdlib::Certificate

Public Class Methods

create_csr(key, cn, dc) click to toggle source
# File lib/openssl-stdlib.rb, line 40
def self.create_csr(key, cn, dc)

  raise Stdlib::Error.new('No suitable key was provided') if key.nil? or ! key.is_a?(OpenSSL::PKey::RSA)
  raise Stdlib::Error.new('No CN was supplied to the certificate') if cn.nil?
  raise Stdlib::Error.new('No DC array was supplied to the certificate') if dc.nil?

  dclist = String.new
  dc.each do |d|
    dclist = dclist + "/DC=#{d}"
  end

  name = OpenSSL::X509::Name.parse "CN=#{cn}#{dclist}"

  csr = OpenSSL::X509::Request.new
  csr.version = 0
  csr.subject = name
  csr.public_key = key.public_key
  csr.sign key, OpenSSL::Digest::SHA1.new
end
generate_ca(key, cn, dc, version = 3, serial = nil, valid_duration = nil) click to toggle source
# File lib/openssl-stdlib.rb, line 65
def self.generate_ca(key, cn, dc, version = 3, serial = nil, valid_duration = nil)

  raise Stdlib::Error.new('No key was supplied to the certificate') if key.nil? or ! key.is_a?(OpenSSL::PKey::RSA)    
  raise Stdlib::Error.new('No CN was supplied to the certificate') if cn.nil?
  raise Stdlib::Error.new('No DC array was supplied to the certificate') if dc.nil?

  dclist = String.new
  dc.each do |d|
    dclist = dclist + "/DC=#{d}"
  end

  name = OpenSSL::X509::Name.parse "CN=#{cn}#{dclist}"

  random = Random.new
  cert = OpenSSL::X509::Certificate.new
  cert.version = version
  cert.serial = serial ||= random.rand(1..100)
  cert.not_before = Time.now
  cert.not_after = Time.now + (valid_duration ||= 60 * 24 * 365 * 5)

  cert.public_key = key.public_key
  cert.subject = name
  cert.issuer = name

  extension_factory = OpenSSL::X509::ExtensionFactory.new
  extension_factory.subject_certificate = cert
  extension_factory.issuer_certificate = cert

  cert.add_extension    extension_factory.create_extension('subjectKeyIdentifier', 'hash')

  cert.add_extension    extension_factory.create_extension(
  'keyUsage', 'cRLSign,keyCertSign', true)

  cert.sign key, OpenSSL::Digest::SHA1.new
  
  cert
end
generate_certificate(key, cn, dc, version = 2, serial = nil, valid_duration = nil) click to toggle source
# File lib/openssl-stdlib.rb, line 103
def self.generate_certificate(key, cn, dc, version = 2, serial = nil, valid_duration = nil)

            raise Stdlib::Error.new('No key was supplied to the certificate') if key.nil? or ! key.is_a?(OpenSSL::PKey::RSA)            
  raise Stdlib::Error.new('No CN was supplied to the certificate') if cn.nil?
  raise Stdlib::Error.new('No DC array was supplied to the certificate') if dc.nil?

            dclist = String.new
            dc.each do |d|
                    dclist = dclist + "/DC=#{d}"
            end

            name = OpenSSL::X509::Name.parse "CN=#{cn}#{dclist}"

  random = Random.new
            cert = OpenSSL::X509::Certificate.new
                    cert.version = version
                    cert.serial = serial ||= random.rand(1..100)
                    cert.not_before = Time.now
                    cert.not_after = Time.now + (valid_duration ||= 60 * 24 * 365 * 5)

                    cert.public_key = key.public_key
                    cert.subject = name
  cert
    end
generate_key(file = nil, pass = nil, key_size = 2048) click to toggle source
# File lib/openssl-stdlib.rb, line 60
def self.generate_key(file = nil, pass = nil, key_size = 2048)
  return OpenSSL::PKey::RSA.new key_size if file == nil
  return OpenSSL::PKey::RSA.new File.read(file), pass if File.readable?(file) and pass != nil
end
load_certificate(path) click to toggle source
# File lib/openssl-stdlib.rb, line 146
def self.load_certificate(path)

  file = File.absolute_path(path)

  cert = OpenSSL::X509::Certificate.new File.read path
  raise Stdlib::Error.new('file path does not lead to a certificate') if ! cert.is_a?(OpenSSL::X509::Certificate)
  cert
end
save_certificate(certificate, path) click to toggle source
# File lib/openssl-stdlib.rb, line 142
def self.save_certificate(certificate, path)
  open path, 'w' do |io| io.write certificate.to_pem end
end
sign_certificate(key, cert, digest, cert_name) click to toggle source
# File lib/openssl-stdlib.rb, line 128
def self.sign_certificate(key, cert, digest, cert_name)

  raise Stdlib::Error.new('No key was supplied to sign the certificate') if key.nil? or ! key.is_a?(OpenSSL::PKey::RSA)
  raise Stdlib::Error.new('No certificate was supplied to sign') if cert.nil? or ! cert.is_a?(OpenSSL::X509::Certificate)
  raise Stdlib::Error.new('No digest was supplied to encrypt the certficate') if digest.nil? or ! digest.is_a?(OpenSSL::Digest)
  raise Stdlib::Error.new('No name was supplied to encrypt the certficate') if cert_name.nil? or ! cert_name.is_a?(OpenSSL::X509::Name)

  cert.issuer = cert_name
  cert.sign key, digest

  cert

end
sign_csr(ca_key, ca_cert, csr, serial = nil, version = 2, valid_duration = nil) click to toggle source
# File lib/openssl-stdlib.rb, line 6
def self.sign_csr(ca_key, ca_cert, csr, serial = nil, version = 2, valid_duration = nil)

  raise Stdlib::Error.new('No CA Key was provided to use for signing') if ca_key.nil? or ! ca_key.is_a?(OpenSSL::PKey::RSA)
  raise Stdlib::Error.new('No CA Cert was provided to use for signing') if ca_cert.nil? or ! ca_cert.is_a?(OpenSSL::X509::Certificate)
  raise Stdlib::Error.new('No Certificate signing request was provided to sign') if csr.nil? or ! csr.is_a?(OpenSSL::X509::Request)
  
  csr_cert = OpenSSL::X509::Certificate.new

  rand = Random.new
  csr_cert.serial = serial ||= rand.rand(1..100)
  csr_cert.version = version
  csr_cert.not_before = Time.now
  csr_cert.not_after = Time.now + (valid_duration ||= 60 * 24 * 365 * 5)

  csr_cert.subject = csr.subject
  csr_cert.public_key = csr.public_key
  csr_cert.issuer = ca_cert.subject

  extension_factory = OpenSSL::X509::ExtensionFactory.new
  extension_factory.subject_certificate = csr_cert
  extension_factory.issuer_certificate = ca_cert

  csr_cert.add_extension    extension_factory.create_extension('basicConstraints', 'CA:FALSE')

  csr_cert.add_extension    extension_factory.create_extension(
      'keyUsage', 'keyEncipherment,dataEncipherment,digitalSignature')

  csr_cert.add_extension    extension_factory.create_extension('subjectKeyIdentifier', 'hash')

  csr_cert.sign ca_key, OpenSSL::Digest::SHA1.new

  csr_cert
end