Module: NetworkFacade::SSL

Defined in:
lib/network-facade/cert.rb

Class Method Summary collapse

Class Method Details

.create(opts) ⇒ Object 



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
 
# File 'lib/network-facade/cert.rb', line 52

def self.create(opts)
  key = OpenSSL::PKey::RSA.new(1024)

  cert = OpenSSL::X509::Certificate.new
  cert.subject = ::OpenSSL::X509::Name.new(opts[:name])
  cert.issuer = opts[:is_ca] ? cert.subject : opts[:ca_cert].subject
  cert.not_before = Time.now
  cert.not_after = Time.now + (opts[:period] * 24 * 60 * 60)
  cert.public_key = key.public_key
  cert.serial = opts[:is_ca] ? 0x0 : 0x2
  cert.version = 2

  ef = OpenSSL::X509::ExtensionFactory.new
  ef.subject_certificate = cert
  ef.issuer_certificate = opts[:is_ca] ? cert : opts[:ca_cert]

  if opts[:is_ca]
    cert.extensions = [
      ef.create_extension('basicConstraints','CA:TRUE', true),
      ef.create_extension('nsComment', opts[:comment]),
      ef.create_extension('subjectKeyIdentifier', 'hash'),
      ef.create_extension('keyUsage', 'cRLSign,keyCertSign', true)
    ]
    cert.add_extension(ef.create_extension('authorityKeyIdentifier', 'keyid:always,issuer:always'))
  else
    cert.extensions = [
      ef.create_extension('basicConstraints','CA:FALSE', true),
      ef.create_extension('nsComment', opts[:comment]),
      ef.create_extension('subjectKeyIdentifier', 'hash'),
    ]
    cert.add_extension(ef.create_extension('authorityKeyIdentifier', 'keyid:always,issuer:always'))
  end

  cert.sign(opts[:is_ca] ? key : opts[:ca_key], OpenSSL::Digest::SHA1.new)

  { :key => key, :cert => cert }
end

.create_ca(opts = {}) ⇒ Object 



5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/network-facade/cert.rb', line 5

def self.create_ca(opts = {})
  [ :country, :hostname, :domainname ].each do |o|
    raise "Missing option #{o}" if opts[o].nil?
  end

  name = [
    [ 'C', opts[:country], OpenSSL::ASN1::PRINTABLESTRING ],
    [ 'O', opts[:domainname], OpenSSL::ASN1::UTF8STRING ],
    [ 'OU', opts[:hostname], OpenSSL::ASN1::UTF8STRING ],
    [ 'CN', 'CA' ]
  ]

  cert_opts = {
    :is_ca => true,
    :name => name,
    :comment => 'NetworkFacade Certification Authority',
    :period => 3650
  }

  create(cert_opts)
end

.create_cert(opts) ⇒ Object 



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/network-facade/cert.rb', line 27

def self.create_cert(opts)
  [ :country, :hostname, :domainname, :ca_cert, :ca_key ].each do |o|
    raise "Missing option #{o}" if opts[o].nil?
  end

  name = [
    [ 'C', opts[:country], OpenSSL::ASN1::PRINTABLESTRING ],
    [ 'O', opts[:domainname], OpenSSL::ASN1::UTF8STRING ],
    [ 'OU', opts[:hostname], OpenSSL::ASN1::UTF8STRING ]
  ]

  opts[:ca_cert] = OpenSSL::X509::Certificate.new(File.read(opts[:ca_cert])) if opts[:ca_cert].is_a?(String)
  opts[:ca_key] = OpenSSL::PKey::RSA.new(File.read(opts[:ca_key])) if opts[:ca_key].is_a?(String)

  cert_opts = {
    :name => name,
    :ca_cert => opts[:ca_cert],
    :ca_key => opts[:ca_key],
    :comment => opts[:comment] || 'NetworkFacade Generated Certificate',
    :period => 365
  }

  create(cert_opts)
end