Class: R509::Cert

Inherits:

Object

• Object
• R509::Cert

show all

Includes:

IOHelpers

Defined in:

lib/r509/cert.rb,
lib/r509/cert/extensions.rb

Overview

Defined Under Namespace

Modules: Extensions

Instance Attribute Summary (collapse)

• - (Object) cert readonly

  Returns the value of attribute cert.

• - (Object) issuer readonly

  Returns the value of attribute issuer.

• - (Object) key readonly

  Returns the value of attribute key.

• - (Object) subject readonly

  Returns the value of attribute subject.

Class Method Summary (collapse)

• + (R509::Cert) load_from_file(filename)

  Helper method to quickly load a cert from the filesystem.

Instance Method Summary (collapse)

• - (Array) all_names

  Return the CN, as well as all the subject alternative names (SANs).

• - (R509::Cert::Extensions::AuthorityInfoAccess) authority_info_access (also: #aia)

  Returns this object's AuthorityInfoAccess extension as an R509 extension.

• - (R509::Cert::Extensions::AuthorityKeyIdentifier) authority_key_identifier

  Returns this object's AuthorityKeyIdentifier extension as an R509 extension.

• - (R509::Cert::Extensions::BasicConstraints) basic_constraints

  Returns this object's BasicConstraints extension as an R509 extension.

• - (Integer) bit_strength

  Returns the bit strength of the key used to create the certificate.

• - (R509::Cert::Extensions::CertificatePolicies) certificate_policies

  Returns this object's CertificatePolicies extension as an R509 extension.

• - (R509::Cert::Extensions::CRLDistributionPoints) crl_distribution_points (also: #cdp)

  Returns this object's CRLDistributionPoints extension as an R509 extension.

• - (String) curve_name

  Returns the short name of the elliptic curve used to generate the public key if the key is EC.

• - (Boolean) dsa?

  Returns whether the public key is DSA.

• - (Boolean) ec?

  Returns whether the public key is EC.

• - (R509::Cert::Extensions::ExtendedKeyUsage) extended_key_usage (also: #eku)

  Returns this object's ExtendedKeyUsage extension as an R509 extension.

• - (Hash) extensions

  Returns the certificate extensions as a hash of R509::Cert::Extensions specific objects.

• - (String) fingerprint(algorithm = 'sha1')

  Returns the certificate fingerprint with the specified algorithm (default sha1).

• - (Boolean) has_private_key?

  Boolean of whether the object contains a private key.

• - (String) hexserial

  Returns the serial number of the certificate in hexadecimal form.

• - (R509::Cert::Extensions::InhibitAnyPolicy) inhibit_any_policy

  Returns this object's InhibitAnyPolicy extension as an R509 extension.

• - (Cert) initialize(opts = {}) constructor

  A new instance of Cert.

• - (Boolean) is_revoked_by_crl?(r509_crl)

  Checks the given CRL for this certificate's serial number.

• - (Symbol) key_algorithm

  Returns key algorithm (RSA, DSA, EC).

• - (R509::Cert::Extensions::KeyUsage) key_usage (also: #ku)

  Returns this object's KeyUsage extension as an R509 extension.

• - (R509::Cert::Extensions::NameConstraints) name_constraints

  Returns this object's NameConstraints extension as an R509 extension.

• - (Time) not_after

  Returns ending (notAfter) of certificate validity period.

• - (Time) not_before

  Returns beginning (notBefore) of certificate validity period.

• - (Boolean) ocsp_no_check?

  Returns true if the OCSP No Check extension is present (value is irrelevant to this extension).

• - (R509::Cert::Extensions::PolicyConstraints) policy_constraints

  Returns this object's PolicyConstraints extension as an R509 extension.

• - (OpenSSL::PKey::RSA) public_key

  Returns the certificate public key.

• - (Boolean) rsa?

  Returns whether the public key is RSA.

• - (Integer) serial

  Returns the serial number of the certificate in decimal form.

• - (String) signature_algorithm

  Returns signature algorithm.

• - (R509::Cert::Extensions::SubjectAlternativeName) subject_alternative_name (also: #san, #subject_alt_name)

  Returns this object's SubjectAlternativeName extension as an R509 extension.

• - (R509::Cert::Extensions::SubjectKeyIdentifier) subject_key_identifier

  Returns this object's SubjectKeyIdentifier extension as an R509 extension.

• - (String) to_der

  Converts the Cert into the DER format.

• - (String) to_pem (also: #to_s)

  Converts the Cert into the PEM format.

• - (Array) unknown_extensions

  Returns an array of OpenSSL::X509::Extension objects representing the extensions that do not have R509 implementations.

• - (Boolean) valid?

  Returns whether the current time is between the notBefore and notAfter times in the certificate.

• - (Boolean) valid_at?(time)

  Returns whether the certificate was between its notBefore and notAfter at the time provided.

• - (Object) write_der(filename_or_io)

  Writes the Cert into the DER format.

• - (Object) write_pem(filename_or_io)

  Writes the Cert into the PEM format.

• - (Object) write_pkcs12(filename_or_io, password, friendly_name = 'r509 pkcs12')

  Writes cert and key into PKCS12 format using OpenSSL defaults for encryption (des3).

Methods included from IOHelpers

#read_data, read_data, #write_data, write_data

17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

# File 'lib/r509/cert.rb', line 17

def initialize(opts={})
  if not opts.kind_of?(Hash)
    raise ArgumentError, 'Must provide a hash of options'
  end
  if opts.has_key?(:pkcs12) and ( opts.has_key?(:key) or opts.has_key?(:cert) )
    raise ArgumentError, "When providing pkcs12, do not pass cert or key"
  elsif opts.has_key?(:pkcs12)
    pkcs12 = OpenSSL::PKCS12.new( opts[:pkcs12], opts[:password] )
    parse_certificate(pkcs12.certificate)
    key = R509::PrivateKey.new( :key => pkcs12.key )
  elsif not opts.has_key?(:cert)
    raise ArgumentError, 'Must provide :cert or :pkcs12'
  else
    csr_check(opts[:cert])
    parse_certificate(opts[:cert])
  end

  if opts.has_key?(:key)
    if opts[:key].kind_of?(R509::PrivateKey)
      key = opts[:key]
    else
      key = R509::PrivateKey.new( :key => opts[:key], :password => opts[:password] )
    end
  end
  associate_private_key(key)
end

11
12
13

# File 'lib/r509/cert.rb', line 11

def cert
  @cert
end

11
12
13

# File 'lib/r509/cert.rb', line 11

def issuer
  @issuer
end

11
12
13

# File 'lib/r509/cert.rb', line 11

def key
  @key
end

11
12
13

# File 'lib/r509/cert.rb', line 11

def subject
  @subject
end

48
49
50

# File 'lib/r509/cert.rb', line 48

def self.load_from_file( filename )
  return R509::Cert.new(:cert => IOHelpers.read_data(filename) )
end

156
157
158
159
160
161
162

# File 'lib/r509/cert.rb', line 156

def all_names
  ret = []
  ret << @subject.CN unless @subject.CN.nil?
  ret.concat( self.san.names.map { |n| n.value } ) unless self.san.nil?

  return ret.sort.uniq
end

349
350
351

# File 'lib/r509/cert.rb', line 349

def authority_info_access
  return extensions[R509::Cert::Extensions::AuthorityInfoAccess]
end

331
332
333

# File 'lib/r509/cert.rb', line 331

def authority_key_identifier
  return extensions[R509::Cert::Extensions::AuthorityKeyIdentifier]
end

297
298
299

# File 'lib/r509/cert.rb', line 297

def basic_constraints
  return extensions[R509::Cert::Extensions::BasicConstraints]
end

188
189
190
191
192
193
194
195
196

# File 'lib/r509/cert.rb', line 188

def bit_strength
  if self.rsa?
    return @cert.public_key.n.num_bits
  elsif self.dsa?
    return @cert.public_key.p.num_bits
  elsif self.ec?
    raise R509::R509Error, 'Bit strength is not available for EC at this time.'
  end
end

375
376
377

# File 'lib/r509/cert.rb', line 375

def certificate_policies
  return extensions[R509::Cert::Extensions::CertificatePolicies]
end

358
359
360

# File 'lib/r509/cert.rb', line 358

def crl_distribution_points
  return extensions[R509::Cert::Extensions::CRLDistributionPoints]
end

202
203
204
205
206
207
208

# File 'lib/r509/cert.rb', line 202

def curve_name
  if self.ec?
    @cert.public_key.group.curve_name
  else
    raise R509::R509Error, 'Curve name is only available with EC certs'
  end
end

174
175
176

# File 'lib/r509/cert.rb', line 174

def dsa?
  @cert.public_key.kind_of?(OpenSSL::PKey::DSA)
end

181
182
183

# File 'lib/r509/cert.rb', line 181

def ec?
  @cert.public_key.kind_of?(OpenSSL::PKey::EC)
end

314
315
316

# File 'lib/r509/cert.rb', line 314

def extended_key_usage
  return extensions[R509::Cert::Extensions::ExtendedKeyUsage]
end

273
274
275
276
277
278
279

# File 'lib/r509/cert.rb', line 273

def extensions
  if @r509_extensions.nil?
    @r509_extensions = Extensions.wrap_openssl_extensions( self.cert.extensions )
  end

  return @r509_extensions
end

112
113
114
115
116
117

# File 'lib/r509/cert.rb', line 112

def fingerprint(algorithm='sha1')
  message_digest = R509::MessageDigest.new(algorithm)
  md = message_digest.digest
  md.update(@cert.to_der)
  md.to_s
end

144
145
146
147
148
149
150

# File 'lib/r509/cert.rb', line 144

def has_private_key?
  if not @key.nil?
    true
  else
    false
  end
end

90
91
92

# File 'lib/r509/cert.rb', line 90

def hexserial
  @cert.serial.to_s(16)
end

383
384
385

# File 'lib/r509/cert.rb', line 383

def inhibit_any_policy
  return extensions[R509::Cert::Extensions::InhibitAnyPolicy]
end

262
263
264

# File 'lib/r509/cert.rb', line 262

def is_revoked_by_crl?( r509_crl )
  return r509_crl.revoked?( self.serial )
end

220
221
222
223
224
225
226
227
228

# File 'lib/r509/cert.rb', line 220

def key_algorithm
  if self.rsa?
    :rsa
  elsif self.dsa?
    :dsa
  elsif self.ec?
    :ec
  end
end

305
306
307

# File 'lib/r509/cert.rb', line 305

def key_usage
  return extensions[R509::Cert::Extensions::KeyUsage]
end

399
400
401

# File 'lib/r509/cert.rb', line 399

def name_constraints
  return extensions[R509::Cert::Extensions::NameConstraints]
end

97
98
99

# File 'lib/r509/cert.rb', line 97

def not_after
  @cert.not_after
end

76
77
78

# File 'lib/r509/cert.rb', line 76

def not_before
  @cert.not_before
end

367
368
369

# File 'lib/r509/cert.rb', line 367

def ocsp_no_check?
  return (extensions.has_key?(R509::Cert::Extensions::OCSPNoCheck))
end

391
392
393

# File 'lib/r509/cert.rb', line 391

def policy_constraints
  return extensions[R509::Cert::Extensions::PolicyConstraints]
end

104
105
106

# File 'lib/r509/cert.rb', line 104

def public_key
  @cert.public_key
end

167
168
169

# File 'lib/r509/cert.rb', line 167

def rsa?
  @cert.public_key.kind_of?(OpenSSL::PKey::RSA)
end

83
84
85

# File 'lib/r509/cert.rb', line 83

def serial
  @cert.serial.to_i
end

213
214
215

# File 'lib/r509/cert.rb', line 213

def signature_algorithm
  @cert.signature_algorithm
end

339
340
341

# File 'lib/r509/cert.rb', line 339

def subject_alternative_name
  return extensions[R509::Cert::Extensions::SubjectAlternativeName]
end

323
324
325

# File 'lib/r509/cert.rb', line 323

def subject_key_identifier
  return extensions[R509::Cert::Extensions::SubjectKeyIdentifier]
end

67
68
69
70
71

# File 'lib/r509/cert.rb', line 67

def to_der
  if @cert.kind_of?(OpenSSL::X509::Certificate)
    return @cert.to_der
  end
end

56
57
58
59
60

# File 'lib/r509/cert.rb', line 56

def to_pem
  if @cert.kind_of?(OpenSSL::X509::Certificate)
    return @cert.to_pem.chomp
  end
end

285
286
287

# File 'lib/r509/cert.rb', line 285

def unknown_extensions
  return Extensions.get_unknown_extensions( self.cert.extensions )
end

123
124
125

# File 'lib/r509/cert.rb', line 123

def valid?
  valid_at?(Time.now)
end

131
132
133
134
135
136
137
138
139
140
141

# File 'lib/r509/cert.rb', line 131

def valid_at?(time)
  if time.kind_of?(Integer)
    time = Time.at(time)
  end

  if (self.not_after < time) or (self.not_before > time)
    false
  else
    true
  end
end

240
241
242

# File 'lib/r509/cert.rb', line 240

def write_der(filename_or_io)
  write_data(filename_or_io, @cert.to_der)
end

233
234
235

# File 'lib/r509/cert.rb', line 233

def write_pem(filename_or_io)
  write_data(filename_or_io, @cert.to_pem)
end

249
250
251
252
253
254
255

# File 'lib/r509/cert.rb', line 249

def write_pkcs12(filename_or_io,password,friendly_name='r509 pkcs12')
  if @key.nil?
    raise R509::R509Error, "Writing a PKCS12 requires both key and cert"
  end
  pkcs12 = OpenSSL::PKCS12.create(password,friendly_name,@key.key,@cert)
  write_data(filename_or_io, pkcs12.to_der)
end