Class: R509::CSR

Inherits:

Object

• Object
• R509::CSR

show all

Includes:

IOHelpers

Defined in:

lib/r509/csr.rb

Overview

Instance Attribute Summary (collapse)

• - (Object) attributes readonly

  Returns the value of attribute attributes.

• - (Object) key readonly

  Returns the value of attribute key.

• - (Object) message_digest readonly

  Returns the value of attribute message_digest.

• - (Object) req readonly

  Returns the value of attribute req.

• - (Object) san readonly

  Returns the value of attribute san.

• - (Object) subject readonly

  Returns the value of attribute subject.

Class Method Summary (collapse)

• + (R509::CSR) load_from_file(filename)

  Helper method to quickly load a CSR from the filesystem.

Instance Method Summary (collapse)

• - (Integer) bit_strength

  Returns the bit strength of the key used to create the CSR.

• - (String) curve_name

  Returns the short name of the elliptic curve used to generate the public key if the key is EC.

• - (Boolean) dsa?

  Returns whether the public key is DSA.

• - (Boolean) ec?

  Returns whether the public key is EC.

• - (Boolean) has_private_key?

  Boolean of whether the object contains a private key.

• - (CSR) initialize(opts = {}) constructor

  A new instance of CSR.

• - (Symbol) key_algorithm

  Returns key algorithm (RSA/DSA/EC).

• - (OpenSSL::PKey::RSA, ...) public_key

  Public key.

• - (Boolean) rsa?

  Returns whether the public key is RSA.

• - (String) signature_algorithm

  Returns signature algorithm.

• - (String) subject_component(short_name)

  Returns subject component.

• - (String) to_der

  Converts the CSR into the DER format.

• - (String) to_pem (also: #to_s)

  Converts the CSR into the PEM format.

• - (Boolean) verify_signature

  Verifies the integrity of the signature on the request.

• - (Object) write_der(filename_or_io)

  Writes the CSR into the DER format.

• - (Object) write_pem(filename_or_io)

  Writes the CSR into the PEM format.

Methods included from IOHelpers

#read_data, read_data, #write_data, write_data

:type => :rsa,
:bit_strength => 4096,
:subject => [
  ['CN','somedomain.com'],
  ['O','My Org'],
  ['L','City'],
  ['ST','State'],
  ['C','US']
]

:type => :ec,
:curve_name => 'secp384r1',
:message_digest => 'sha512',
:subject => [
  ['CN','somedomain.com'],
]

39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

# File 'lib/r509/csr.rb', line 39

def initialize(opts={})
  if not opts.kind_of?(Hash)
    raise ArgumentError, 'Must provide a hash of options'
  end
    if opts.has_key?(:subject) and opts.has_key?(:csr)
    raise ArgumentError, "You must provide :subject or :csr, not both"
  end
  @bit_strength = opts[:bit_strength] || 2048
  @curve_name = opts[:curve_name] || "secp384r1"

  if opts.has_key?(:key)
    if opts[:key].kind_of?(R509::PrivateKey)
      @key = opts[:key]
    else
      @key = R509::PrivateKey.new(:key => opts[:key])
    end
  end

  @type = opts[:type] || :rsa
  if not [:rsa,:dsa,:ec].include?(@type) and @key.nil?
    raise ArgumentError, 'Must provide :rsa, :dsa, or :ec as type when key is nil'
  end

  if opts.has_key?(:subject)
    san_names = R509::ASN1.general_name_parser(opts[:san_names] || [])
    create_request(opts[:subject], san_names) #sets @req
  elsif opts.has_key?(:csr)
    if opts.has_key?(:san_names)
      raise ArgumentError, "You can't add domains to an existing CSR"
    end
    parse_csr(opts[:csr])
  else
    raise ArgumentError, "You must provide :subject or :csr"
  end

  if dsa?
    #only DSS1 is acceptable for DSA signing in OpenSSL < 1.0
    #post-1.0 you can sign with anything, but let's be conservative
    #see: http://www.ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/PKey/DSA.html
    @message_digest = R509::MessageDigest.new('dss1')
  elsif opts.has_key?(:message_digest)
    @message_digest = R509::MessageDigest.new(opts[:message_digest])
  else
    @message_digest = R509::MessageDigest.new('sha1')
  end

  if not opts.has_key?(:csr)
    @req.sign(@key.key, @message_digest.digest)
  end
  if not @key.nil? and not @req.verify(@key.public_key) then
    raise R509Error, 'Key does not match request.'
  end

end

13
14
15

# File 'lib/r509/csr.rb', line 13

def attributes
  @attributes
end

13
14
15

# File 'lib/r509/csr.rb', line 13

def key
  @key
end

13
14
15

# File 'lib/r509/csr.rb', line 13

def message_digest
  @message_digest
end

13
14
15

# File 'lib/r509/csr.rb', line 13

def req
  @req
end

13
14
15

# File 'lib/r509/csr.rb', line 13

def san
  @san
end

13
14
15

# File 'lib/r509/csr.rb', line 13

def subject
  @subject
end

98
99
100

# File 'lib/r509/csr.rb', line 98

def self.load_from_file( filename )
  return R509::CSR.new(:csr => IOHelpers.read_data(filename) )
end

179
180
181
182
183
184
185
186
187

# File 'lib/r509/csr.rb', line 179

def bit_strength
  if self.rsa?
    return @req.public_key.n.num_bits
  elsif self.dsa?
    return @req.public_key.p.num_bits
  elsif self.ec?
    raise R509::R509Error, 'Bit strength is not available for EC at this time.'
  end
end

193
194
195
196
197
198
199

# File 'lib/r509/csr.rb', line 193

def curve_name
  if self.ec?
    self.public_key.group.curve_name
  else
    raise R509::R509Error, 'Curve name is only available with EC CSRs'
  end
end

166
167
168

# File 'lib/r509/csr.rb', line 166

def dsa?
  @req.public_key.kind_of?(OpenSSL::PKey::DSA)
end

173
174
175

# File 'lib/r509/csr.rb', line 173

def ec?
  @req.public_key.kind_of?(OpenSSL::PKey::EC)
end

116
117
118
119
120
121
122

# File 'lib/r509/csr.rb', line 116

def has_private_key?
  if not @key.nil?
    true
  else
    false
  end
end

223
224
225
226
227
228
229
230
231

# File 'lib/r509/csr.rb', line 223

def key_algorithm
  if @req.public_key.kind_of? OpenSSL::PKey::RSA then
    :rsa
  elsif @req.public_key.kind_of? OpenSSL::PKey::DSA then
    :dsa
  elsif @req.public_key.kind_of? OpenSSL::PKey::EC then
    :ec
  end
end

103
104
105
106
107

# File 'lib/r509/csr.rb', line 103

def public_key
  if(@req.kind_of?(OpenSSL::X509::Request)) then
    @req.public_key
  end
end

159
160
161

# File 'lib/r509/csr.rb', line 159

def rsa?
  @req.public_key.kind_of?(OpenSSL::PKey::RSA)
end

216
217
218

# File 'lib/r509/csr.rb', line 216

def signature_algorithm
  @req.signature_algorithm
end

204
205
206
207
208
209
210
211

# File 'lib/r509/csr.rb', line 204

def subject_component short_name
  @req.subject.to_a.each do |element|
    if element[0].downcase == short_name.downcase then
      return element[1]
    end
  end
  nil
end

136
137
138

# File 'lib/r509/csr.rb', line 136

def to_der
  @req.to_der
end

127
128
129

# File 'lib/r509/csr.rb', line 127

def to_pem
  @req.to_pem
end

111
112
113

# File 'lib/r509/csr.rb', line 111

def verify_signature
  @req.verify(public_key)
end

152
153
154

# File 'lib/r509/csr.rb', line 152

def write_der(filename_or_io)
  write_data(filename_or_io, @req.to_der)
end

144
145
146

# File 'lib/r509/csr.rb', line 144

def write_pem(filename_or_io)
  write_data(filename_or_io, @req.to_pem)
end