Contents

require "openssl"

module Berkshelf
  class SSLPolicy

    # @return [Store]
    #   Holds trusted CA certificates used to verify peer certificates
    attr_reader :store

    def initialize
      @store = OpenSSL::X509::Store.new.tap(&:set_default_paths)

      set_custom_certs if ::File.exist?(trusted_certs_dir)
    end

    def add_trusted_cert(cert)
      @store.add_cert(cert)
    rescue OpenSSL::X509::StoreError => e
      raise e unless e.message == "cert already in hash table"
    end

    def trusted_certs_dir
      config_dir = Berkshelf.config.chef.trusted_certs_dir.to_s.tr('\\', "/")
      if config_dir.empty? || !::File.exist?(config_dir)
        File.join(ENV["HOME"], ".chef", "trusted_certs")
      else
        config_dir
      end
    end

    def set_custom_certs
      Dir.chdir(trusted_certs_dir) do
        ::Dir.glob("{*.crt,*.pem}").each do |cert|
          cert = OpenSSL::X509::Certificate.new(IO.read(cert))
          add_trusted_cert(cert)
        end
      end
    end
  end
end

Version data entries

3 entries across 3 versions & 1 rubygems

Version	Path
berkshelf-7.1.0	lib/berkshelf/ssl_policies.rb
berkshelf-7.0.10	lib/berkshelf/ssl_policies.rb
berkshelf-7.0.9	lib/berkshelf/ssl_policies.rb