class Serverspec::Type::X509Certificate
Public Instance Methods
alias()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 25 def alias run_openssl_command_with("-alias -noout").stdout.chomp end
certificate?()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 5 def certificate? (run_openssl_command_with("-noout").exit_status == 0) end
email()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 17 def email run_openssl_command_with("-email -noout").stdout.chomp end
fingerprint()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 21 def fingerprint run_openssl_command_with("-fingerprint -noout").stdout.chomp end
has_purpose?(p)
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 38 def has_purpose?(p) grep_str = "#{p} : Yes" ( run_openssl_command_with("-purpose -noout | grep -wq \"#{grep_str}\""). exit_status == 0 ) end
issuer()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 13 def issuer normalize_dn(run_openssl_command_with("-issuer -noout").stdout.chomp.gsub(/^issuer= */,'')) end
keylength()
click to toggle source
Modern openssl use following output format for key length: Public-Key: (4096 bit) while ancient (0.9.8 for example) use RSA Public Key: (2048 bit)
# File lib/serverspec/type/x509_certificate.rb, line 33 def keylength len_str = run_openssl_command_with("-text -noout | grep -E 'Public(-| )Key: \\([[:digit:]]+ bit\\)'").stdout.chomp len_str.gsub(/^.*\(/,'').gsub(/ bit\)$/,'').to_i end
subject()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 9 def subject normalize_dn(run_openssl_command_with("-subject -noout").stdout.chomp.gsub(/^subject= */,'')) end
subject_alt_names()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 63 def subject_alt_names text = run_openssl_command_with('-text -noout').stdout # X509v3 Subject Alternative Name: # DNS:*.example.com, DNS:www.example.net, IP:192.0.2.10 if text =~ /^ *X509v3 Subject Alternative Name:.*\n *(.*)$/ $1.split(/, +/) end end
valid?()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 44 def valid? runner_res = run_openssl_command_with("-startdate -enddate -noout") return false if runner_res.exit_status != 0 date_map = parse_dates_str_to_map(runner_res.stdout) now = Time.now ( now >= date_map[:notBefore] && now <= date_map[:notAfter]) end
validity_in_days()
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 54 def validity_in_days runner_res = run_openssl_command_with("-enddate -noout") return 0 if runner_res.exit_status != 0 date_map = parse_dates_str_to_map(runner_res.stdout) diff = date_map[:notAfter] - Time.now ( diff/(60*60*24) ) end
Private Instance Methods
normalize_dn(dn)
click to toggle source
Normalize output between openssl versions.
# File lib/serverspec/type/x509_certificate.rb, line 86 def normalize_dn(dn) return dn unless dn.start_with?('/') # normalize openssl < 1.1 to >= 1.1 output dn[1..-1].split('/').join(', ').gsub('=', ' = ') end
parse_dates_str_to_map(dates_str)
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 77 def parse_dates_str_to_map(dates_str) dates_str.split("\n").inject({}) do |res,line| kv_arr = line.split '=' time = Time.strptime(kv_arr[1],'%b %e %T %Y %Z') rescue Time.parse(kv_arr[1] || '') res.merge({ kv_arr[0].to_sym => time }) end end
run_openssl_command_with(param_str)
click to toggle source
# File lib/serverspec/type/x509_certificate.rb, line 73 def run_openssl_command_with(param_str) @runner.run_command("openssl x509 -in #{name} #{param_str}") end