Class: R509::Cert

Inherits:

Object

• Object
• R509::Cert

show all

Includes:

Helpers

Defined in:

lib/r509/cert.rb,
lib/r509/cert/extensions/base.rb,
lib/r509/cert/extensions/key_usage.rb,
lib/r509/cert/extensions/ocsp_no_check.rb,
lib/r509/cert/extensions/name_constraints.rb,
lib/r509/cert/extensions/validation_mixin.rb,
lib/r509/cert/extensions/basic_constraints.rb,
lib/r509/cert/extensions/extended_key_usage.rb,
lib/r509/cert/extensions/policy_constraints.rb,
lib/r509/cert/extensions/inhibit_any_policy.rb,
lib/r509/cert/extensions/certificate_policies.rb,
lib/r509/cert/extensions/authority_info_access.rb,
lib/r509/cert/extensions/subject_key_identifier.rb,
lib/r509/cert/extensions/crl_distribution_points.rb,
lib/r509/cert/extensions/subject_alternative_name.rb,
lib/r509/cert/extensions/authority_key_identifier.rb

Overview

Defined Under Namespace

Modules: Extensions

Instance Attribute Summary (collapse)

• - (Object) cert readonly

  Returns the value of attribute cert.

• - (Object) issuer readonly

  Returns the value of attribute issuer.

• - (Object) key readonly

  Returns the value of attribute key.

• - (Object) subject readonly

  Returns the value of attribute subject.

Class Method Summary (collapse)

• + (R509::Cert) load_from_file(filename)

  Helper method to quickly load a cert from the filesystem.

Instance Method Summary (collapse)

• - (Array) all_names

  Return the CN, as well as all the subject alternative names (SANs).

• - (R509::Cert::Extensions::AuthorityInfoAccess) authority_info_access (also: #aia)

  Returns this object's AuthorityInfoAccess extension as an R509 extension.

• - (R509::Cert::Extensions::AuthorityKeyIdentifier) authority_key_identifier

  Returns this object's AuthorityKeyIdentifier extension as an R509 extension.

• - (R509::Cert::Extensions::BasicConstraints) basic_constraints

  Returns this object's BasicConstraints extension as an R509 extension.

• - (Integer) bit_length (also: #bit_strength) included from Helpers

  Returns the bit length of the key.

• - (R509::Cert::Extensions::CertificatePolicies) certificate_policies

  Returns this object's CertificatePolicies extension as an R509 extension.

• - (R509::Cert::Extensions::CRLDistributionPoints) crl_distribution_points (also: #cdp)

  Returns this object's CRLDistributionPoints extension as an R509 extension.

• - (String) curve_name included from Helpers

  Returns the short name of the elliptic curve used to generate the public key if the key is EC.

• - (Boolean) dsa? included from Helpers

  Returns whether the public key is DSA.

• - (Boolean) ec? included from Helpers

  Returns whether the public key is EC.

• - (R509::Cert::Extensions::ExtendedKeyUsage) extended_key_usage (also: #eku)

  Returns this object's ExtendedKeyUsage extension as an R509 extension.

• - (Hash) extensions

  Returns the certificate extensions as a hash of R509::Cert::Extensions specific objects.

• - (String) fingerprint(algorithm = 'sha1')

  Returns the certificate fingerprint with the specified algorithm (default sha1).

• - (Boolean) has_private_key?

  Boolean of whether the object contains a private key.

• - (String) hexserial

  Returns the serial number of the certificate in hexadecimal form.

• - (R509::Cert::Extensions::InhibitAnyPolicy) inhibit_any_policy

  Returns this object's InhibitAnyPolicy extension as an R509 extension.

• - (Cert) initialize(opts = {}) constructor

  A new instance of Cert.

• - (Boolean) is_revoked_by_crl?(r509_crl)

  Checks the given CRL for this certificate's serial number.

• - (String) key_algorithm included from Helpers

  Returns key algorithm (RSA/DSA/EC).

• - (R509::Cert::Extensions::KeyUsage) key_usage (also: #ku)

  Returns this object's KeyUsage extension as an R509 extension.

• - (R509::Cert::Extensions::NameConstraints) name_constraints

  Returns this object's NameConstraints extension as an R509 extension.

• - (Time) not_after

  Returns ending (notAfter) of certificate validity period.

• - (Time) not_before

  Returns beginning (notBefore) of certificate validity period.

• - (Boolean) ocsp_no_check?

  Returns true if the OCSP No Check extension is present (value is irrelevant to this extension).

• - (R509::Cert::Extensions::PolicyConstraints) policy_constraints

  Returns this object's PolicyConstraints extension as an R509 extension.

• - (OpenSSL::PKey::RSA) public_key

  Returns the certificate public key.

• - (Boolean) rsa? included from Helpers

  Returns whether the public key is RSA.

• - (Integer) serial

  Returns the serial number of the certificate in decimal form.

• - (String) signature_algorithm

  Returns signature algorithm.

• - (R509::Cert::Extensions::SubjectAlternativeName) subject_alternative_name (also: #san, #subject_alt_name)

  Returns this object's SubjectAlternativeName extension as an R509 extension.

• - (R509::Cert::Extensions::SubjectKeyIdentifier) subject_key_identifier

  Returns this object's SubjectKeyIdentifier extension as an R509 extension.

• - (String) to_der included from Helpers

  Converts the object into DER format.

• - (String) to_pem included from Helpers

  Converts the object into PEM format.

• - (Array) unknown_extensions

  Returns an array of OpenSSL::X509::Extension objects representing the extensions that do not have R509 implementations.

• - (Boolean) valid?

  Returns whether the current time is between the notBefore and notAfter times in the certificate.

• - (Boolean) valid_at?(time)

  Returns whether the certificate was between its notBefore and notAfter at the time provided.

• - (Object) write_der(filename_or_io) included from Helpers

  Writes the object into DER format.

• - (Object) write_pem(filename_or_io) included from Helpers

  Writes the object into PEM format.

• - (Object) write_pkcs12(filename_or_io, password, friendly_name = 'r509 pkcs12')

  Writes cert and key into PKCS12 format using OpenSSL defaults for encryption (des3).

19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# File 'lib/r509/cert.rb', line 19

def initialize(opts={})
  if not opts.kind_of?(Hash)
    raise ArgumentError, 'Must provide a hash of options'
  end
  if opts.has_key?(:pkcs12) and ( opts.has_key?(:key) or opts.has_key?(:cert) )
    raise ArgumentError, "When providing pkcs12, do not pass cert or key"
  elsif opts.has_key?(:pkcs12)
    pkcs12 = OpenSSL::PKCS12.new( opts[:pkcs12], opts[:password] )
    parse_certificate(pkcs12.certificate)
    parse_private_key(pkcs12.key)
  elsif not opts.has_key?(:cert)
    raise ArgumentError, 'Must provide :cert or :pkcs12'
  else
    csr_check(opts[:cert])
    parse_certificate(opts[:cert])
  end

  if opts.has_key?(:key)
    parse_private_key(opts[:key], opts[:password])
  end
end

13
14
15

# File 'lib/r509/cert.rb', line 13

def cert
  @cert
end

13
14
15

# File 'lib/r509/cert.rb', line 13

def issuer
  @issuer
end

13
14
15

# File 'lib/r509/cert.rb', line 13

def key
  @key
end

13
14
15

# File 'lib/r509/cert.rb', line 13

def subject
  @subject
end

45
46
47

# File 'lib/r509/cert.rb', line 45

def self.load_from_file( filename )
  return R509::Cert.new(:cert => IOHelpers.read_data(filename) )
end

134
135
136
137
138
139
140

# File 'lib/r509/cert.rb', line 134

def all_names
  ret = []
  ret << @subject.CN unless @subject.CN.nil?
  ret.concat( self.san.names.map { |n| n.value } ) unless self.san.nil?

  return ret.sort.uniq
end

254
255
256

# File 'lib/r509/cert.rb', line 254

def authority_info_access
  return extensions[R509::Cert::Extensions::AuthorityInfoAccess]
end

236
237
238

# File 'lib/r509/cert.rb', line 236

def authority_key_identifier
  return extensions[R509::Cert::Extensions::AuthorityKeyIdentifier]
end

202
203
204

# File 'lib/r509/cert.rb', line 202

def basic_constraints
  return extensions[R509::Cert::Extensions::BasicConstraints]
end

280
281
282

# File 'lib/r509/cert.rb', line 280

def certificate_policies
  return extensions[R509::Cert::Extensions::CertificatePolicies]
end

263
264
265

# File 'lib/r509/cert.rb', line 263

def crl_distribution_points
  return extensions[R509::Cert::Extensions::CRLDistributionPoints]
end

219
220
221

# File 'lib/r509/cert.rb', line 219

def extended_key_usage
  return extensions[R509::Cert::Extensions::ExtendedKeyUsage]
end

178
179
180
181
182
183
184

# File 'lib/r509/cert.rb', line 178

def extensions
  if @r509_extensions.nil?
    @r509_extensions = Extensions.wrap_openssl_extensions( self.cert.extensions )
  end

  return @r509_extensions
end

90
91
92
93
94
95

# File 'lib/r509/cert.rb', line 90

def fingerprint(algorithm='sha1')
  message_digest = R509::MessageDigest.new(algorithm)
  md = message_digest.digest
  md.update(@cert.to_der)
  md.to_s
end

122
123
124
125
126
127
128

# File 'lib/r509/cert.rb', line 122

def has_private_key?
  if not @key.nil?
    true
  else
    false
  end
end

68
69
70

# File 'lib/r509/cert.rb', line 68

def hexserial
  @cert.serial.to_s(16)
end

288
289
290

# File 'lib/r509/cert.rb', line 288

def inhibit_any_policy
  return extensions[R509::Cert::Extensions::InhibitAnyPolicy]
end

167
168
169

# File 'lib/r509/cert.rb', line 167

def is_revoked_by_crl?( r509_crl )
  return r509_crl.revoked?( self.serial )
end

210
211
212

# File 'lib/r509/cert.rb', line 210

def key_usage
  return extensions[R509::Cert::Extensions::KeyUsage]
end

304
305
306

# File 'lib/r509/cert.rb', line 304

def name_constraints
  return extensions[R509::Cert::Extensions::NameConstraints]
end

75
76
77

# File 'lib/r509/cert.rb', line 75

def not_after
  @cert.not_after
end

54
55
56

# File 'lib/r509/cert.rb', line 54

def not_before
  @cert.not_before
end

272
273
274

# File 'lib/r509/cert.rb', line 272

def ocsp_no_check?
  return (extensions.has_key?(R509::Cert::Extensions::OCSPNoCheck))
end

296
297
298

# File 'lib/r509/cert.rb', line 296

def policy_constraints
  return extensions[R509::Cert::Extensions::PolicyConstraints]
end

82
83
84

# File 'lib/r509/cert.rb', line 82

def public_key
  @cert.public_key
end

61
62
63

# File 'lib/r509/cert.rb', line 61

def serial
  @cert.serial.to_i
end

145
146
147

# File 'lib/r509/cert.rb', line 145

def signature_algorithm
  @cert.signature_algorithm
end

244
245
246

# File 'lib/r509/cert.rb', line 244

def subject_alternative_name
  return extensions[R509::Cert::Extensions::SubjectAlternativeName]
end

228
229
230

# File 'lib/r509/cert.rb', line 228

def subject_key_identifier
  return extensions[R509::Cert::Extensions::SubjectKeyIdentifier]
end

190
191
192

# File 'lib/r509/cert.rb', line 190

def unknown_extensions
  return Extensions.get_unknown_extensions( self.cert.extensions )
end

101
102
103

# File 'lib/r509/cert.rb', line 101

def valid?
  valid_at?(Time.now)
end

109
110
111
112
113
114
115
116
117
118
119

# File 'lib/r509/cert.rb', line 109

def valid_at?(time)
  if time.kind_of?(Integer)
    time = Time.at(time)
  end

  if (self.not_after < time) or (self.not_before > time)
    false
  else
    true
  end
end

154
155
156
157
158
159
160

# File 'lib/r509/cert.rb', line 154

def write_pkcs12(filename_or_io,password,friendly_name='r509 pkcs12')
  if @key.nil?
    raise R509::R509Error, "Writing a PKCS12 requires both key and cert"
  end
  pkcs12 = OpenSSL::PKCS12.create(password,friendly_name,@key.key,@cert)
  write_data(filename_or_io, pkcs12.to_der)
end