module DiceBag::TemplateHelpers
Public Instance Methods
default_root_ca(root_key)
click to toggle source
# File lib/dice_bag/template_helpers.rb, line 52 def default_root_ca(root_key) @default_root_ca ||= generate_root_ca(root_key) end
ensure_is_509_certificate(raw_cert)
click to toggle source
raw_cert: DER or PEM encoded certificate
# File lib/dice_bag/template_helpers.rb, line 46 def ensure_is_509_certificate(raw_cert) certificate = OpenSSL::X509::Certificate.new(raw_cert) rescue OpenSSL::X509::CertificateError false end
ensure_is_private_key(key)
click to toggle source
# File lib/dice_bag/template_helpers.rb, line 12 def ensure_is_private_key(key) pkey = PrivateKey.new key.dup pkey.to_rsa_format! if pkey.valid_private_key? pkey.private_key else raise "The private key provided is invalid" end end
generate_509_certificate(private_key, root_ca: nil, root_key: nil)
click to toggle source
Generates en.wikipedia.org/wiki/X.509 certificate, commonly used in authentication services
# File lib/dice_bag/template_helpers.rb, line 24 def generate_509_certificate(private_key, root_ca: nil, root_key: nil) root_key ||= OpenSSL::PKey::RSA.new(2048) # the CA's public/private key root_ca ||= default_root_ca(root_key) cert = OpenSSL::X509::Certificate.new cert.version = 2 cert.serial = 2 cert.subject = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=Ruby certificate") cert.issuer = root_ca.subject # root CA is the issuer cert.public_key = PrivateKey.new(private_key.dup).public_key cert.not_before = Time.now cert.not_after = cert.not_before + 1 * 365 * 24 * 60 * 60 # 1 years validity ef = OpenSSL::X509::ExtensionFactory.new ef.subject_certificate = cert ef.issuer_certificate = root_ca cert.add_extension(ef.create_extension("keyUsage", "digitalSignature", true)) cert.add_extension(ef.create_extension("subjectKeyIdentifier", "hash", false)) cert.sign(root_key, OpenSSL::Digest.new("SHA256")) cert end
generate_private_key()
click to toggle source
# File lib/dice_bag/template_helpers.rb, line 7 def generate_private_key require "openssl" OpenSSL::PKey::RSA.generate(2048) end
generate_root_ca(root_key)
click to toggle source
# File lib/dice_bag/template_helpers.rb, line 56 def generate_root_ca(root_key) root_ca = OpenSSL::X509::Certificate.new root_ca.version = 2 # cf. RFC 5280 - to make it a "v3" certificate root_ca.serial = 1 # considered a security flaw for real certificates root_ca.subject = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=Ruby CA") root_ca.issuer = root_ca.subject # root CA's are "self-signed" root_ca.public_key = root_key.public_key root_ca.not_before = Time.now root_ca.not_after = root_ca.not_before + 2 * 365 * 24 * 60 * 60 # 2 years validity ef = OpenSSL::X509::ExtensionFactory.new ef.subject_certificate = root_ca ef.issuer_certificate = root_ca root_ca.add_extension(ef.create_extension("basicConstraints", "CA:TRUE", true)) root_ca.add_extension(ef.create_extension("keyUsage", "keyCertSign, cRLSign", true)) root_ca.add_extension(ef.create_extension("subjectKeyIdentifier", "hash", false)) root_ca.add_extension(ef.create_extension("authorityKeyIdentifier", "keyid:always", false)) root_ca.sign(root_key, OpenSSL::Digest.new("SHA256")) end