acme-client 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fb284f691ef7182e7aa9ca56ff950373d92380b6
-  data.tar.gz: 542ef5706c8265fecf34c3841742c673df8eb4fc
+  metadata.gz: 66b791acbcafdeb9a0cc7b1fc56977ff235771db
+  data.tar.gz: fcc5bdffc2e7278301de2ad97745a0dd1400915e
 SHA512:
-  metadata.gz: 3453c7ea55e3b646eb313bee04277f14259197c6c7817924848e0635992c8b3a7edb17f176c4da64bdae26c51bf4f341380071b51721a71f144e3903dc759cda
-  data.tar.gz: da85a2dc373d4b7eb361f1fe97b7cb0f3c77b52bae6862c3e7e11328e3a505e75536f3fcf5b5db5c53094cd0fcecc58eebf87a5f0c2e9274f367d04c87f48f5a
+  metadata.gz: 1dda0e5460db94b43231b033513b28c6a88b7af1be4c201bd360b5fda5dab159eb684305177636f6a3327a5ef6b54359045c1f12a87c62312a510dddae3b8345
+  data.tar.gz: c5d7b4f69f4455c56fdeb9611b66757e981ebd870582fca017656a6f9635bfd223cc1c2231c67a159682f66e369dad18e3ed81e259c9d931d4f0f5b11a3972de

data/.gitignore

@@ -7,3 +7,4 @@
 /pkg/
 /spec/reports/
 /tmp/
+/vendor/bundle

data/.rspec

@@ -1,2 +1,3 @@
 --format documentation
 --color
+--order rand

data/README.md

@@ -22,15 +22,15 @@ require 'acme-client'
 client = Acme::Client.new(private_key: private_key, endpoint: endpoint)
 
 # If the private key is not known to the server, we need to register it for the first time.
-registration = client.register(contact: 'mailto:unixcharles@gmail.com')
+registration = client.register(contact: 'mailto:contact@example.com')
 
 # You'll may need to agree to the term (that's up the to the server to require it or not but boulder does by default)
 registration.agree_terms
 
-# Let's try to optain a certificate for yourdomain.com
+# Let's try to optain a certificate for example.org
 
 # We need to prove that we control the domain using one of the challenges method.
-authorization = client.authorize(domain: 'yourdomain.com')
+authorization = client.authorize(domain: 'example.org')
 
 # For now the only challenge method supprted by the client is http-01.
 challenge = authorization.http01
@@ -65,26 +65,18 @@ sleep(1)
 
 challenge.verify_status # => 'valid'
 
-# We're going to need a CSR, lets do this real quick with Ruby+OpenSSL.
-csr = OpenSSL::X509::Request.new
+# We're going to need a certificate signing request. If not explicitly
+# specified, the first name listed becomes the common name.
+csr = Acme::CertificateRequest.new(names: %w[example.org www.example.org])
 
-# We need a private key for the certificate, not the same as the account key.
-certificate_private_key = OpenSSL::PKey::RSA.new(2048)
-
-# We just going to add the domain but normally you might want to provide more information.
-csr.subject = OpenSSL::X509::Name.new([
-  ['CN', 'yourdomain.com', OpenSSL::ASN1::UTF8STRING]
-])
-
-csr.public_key = certificate_private_key.public_key
-csr.sign(certificate_private_key, OpenSSL::Digest::SHA256.new)
-
-# We can now request a certificate
+# We can now request a certificate, you can pass anything that returns
+# a valid DER encoded CSR when calling to_der on it, for example a
+# OpenSSL::X509::Request too.
 certificate = client.new_certificate(csr) # => #<Acme::Certificate ....>
 
 # Save the certificate and key
+File.write("privkey.pem", certificate.request.private_key.to_pem)
 File.write("cert.pem", certificate.to_pem)
-File.write("key.pem", certificate_private_key.to_pem)
 File.write("chain.pem", certificate.chain_to_pem)
 File.write("fullchain.pem", certificate.fullchain_to_pem)
 
@@ -100,7 +92,7 @@ File.write("fullchain.pem", certificate.fullchain_to_pem)
 # Not implemented
 
 - Recovery methods are not implemented.
-- http-01 is the only challenge method implemented
+- tls-sni-01 and proofOfPossession-01 are not implemented.
 
 ## Development
 

data/lib/acme-client.rb

@@ -8,6 +8,7 @@ require 'digest'
 require 'forwardable'
 
 require 'acme/certificate'
+require 'acme/certificate_request'
 require 'acme/crypto'
 require 'acme/client'
 require 'acme/resources'

data/lib/acme/certificate.rb

@@ -1,13 +1,14 @@
 class Acme::Certificate
   extend Forwardable
 
-  attr_reader :x509, :x509_chain
+  attr_reader :x509, :x509_chain, :request
 
   def_delegators :x509, :to_pem, :to_der
 
-  def initialize(certificate, chain)
+  def initialize(certificate, chain, request)
     @x509 = certificate
     @x509_chain = chain
+    @request = request
   end
 
   def chain_to_pem
@@ -21,4 +22,8 @@ class Acme::Certificate
   def fullchain_to_pem
     x509_fullchain.map(&:to_pem).join
   end
+
+  def common_name
+    x509.subject.to_a.find {|name, _, _| name == "CN" }[1]
+  end
 end

data/lib/acme/certificate_request.rb

@@ -0,0 +1,113 @@
+class Acme::CertificateRequest
+  extend Forwardable
+
+  DEFAULT_KEY_LENGTH = 2048
+  DEFAULT_DIGEST = OpenSSL::Digest::SHA256
+  SUBJECT_KEYS = {
+    common_name:         "CN",
+    country_name:        "C",
+    organization_name:   "O",
+    organizational_unit: "OU",
+    state_or_province:   "ST",
+    locality_name:       "L"
+  }.freeze
+
+  SUBJECT_TYPES = {
+    "CN" => OpenSSL::ASN1::UTF8STRING,
+    "C"  => OpenSSL::ASN1::UTF8STRING,
+    "O"  => OpenSSL::ASN1::UTF8STRING,
+    "OU" => OpenSSL::ASN1::UTF8STRING,
+    "ST" => OpenSSL::ASN1::UTF8STRING,
+    "L"  => OpenSSL::ASN1::UTF8STRING
+  }.freeze
+
+  attr_reader :csr, :private_key, :common_name, :names, :subject
+
+  def_delegators :csr, :to_pem, :to_der
+
+  def initialize(common_name: nil,
+                 names: [],
+                 private_key: generate_private_key,
+                 subject: {},
+                 digest: DEFAULT_DIGEST.new)
+    raise ArgumentError.new("Digest must be a OpenSSL::Digest") unless digest.is_a?(OpenSSL::Digest)
+    @digest = digest
+
+    @private_key = private_key
+
+    @subject = normalize_subject(subject)
+    @common_name = common_name || @subject[SUBJECT_KEYS[:common_name]] || @subject[:common_name]
+
+    @names = names.to_a.dup
+    normalize_names
+
+    @subject[SUBJECT_KEYS[:common_name]] ||= @common_name
+    validate_subject
+
+    @csr = generate
+  end
+
+  private
+
+  def generate_private_key
+    OpenSSL::PKey::RSA.new(DEFAULT_KEY_LENGTH)
+  end
+
+  def normalize_subject(subject)
+    @subject = subject.each_with_object({}) {|(key, value), subject|
+      subject[SUBJECT_KEYS.fetch(key, key)] = value.to_s
+    }
+  end
+
+  def normalize_names
+    if @common_name
+      @names.unshift(@common_name) unless @names.include?(@common_name)
+    elsif @names.empty?
+      raise ArgumentError.new("No common name and no list of names given")
+    else
+      @common_name = @names.first
+    end
+  end
+
+  def validate_subject
+    extra_keys = @subject.keys - SUBJECT_KEYS.keys - SUBJECT_KEYS.values
+    unless extra_keys.empty?
+      raise ArgumentError.new("Unexpected subject attributes given: #{extra_keys.inspect}")
+    end
+
+    unless @common_name == @subject[SUBJECT_KEYS[:common_name]]
+      raise ArgumentError.new("Conflicting common name given in arguments and subject")
+    end
+  end
+
+  def generate
+    OpenSSL::X509::Request.new.tap do |csr|
+      csr.public_key = @private_key.public_key
+      csr.subject = generate_subject
+      add_extension(csr)
+      csr.sign @private_key, @digest
+    end
+  end
+
+  def generate_subject
+    OpenSSL::X509::Name.new(
+      @subject.map {|name, value|
+        [name, value, SUBJECT_TYPES[name]]
+      }
+    )
+  end
+
+  def add_extension(csr)
+    return if @names.size <= 1
+
+    extension = OpenSSL::X509::ExtensionFactory.new.create_extension(
+      "subjectAltName", @names.map {|name| "DNS:#{name}" }.join(", "), false
+    )
+    csr.add_attribute(
+      OpenSSL::X509::Attribute.new(
+        "extReq",
+        OpenSSL::ASN1::Set.new([OpenSSL::ASN1::Sequence.new([extension])])
+      )
+    )
+  end
+end

data/lib/acme/client.rb

@@ -44,7 +44,7 @@ class Acme::Client
     }
 
     response = connection.post(@operation_endpoints.fetch('new-cert'), payload)
-    ::Acme::Certificate.new(OpenSSL::X509::Certificate.new(response.body), fetch_chain(response))
+    ::Acme::Certificate.new(OpenSSL::X509::Certificate.new(response.body), fetch_chain(response), csr)
   end
 
   def fetch_chain(response, limit=10)

data/lib/acme/version.rb

@@ -1,5 +1,5 @@
 module Acme
   class Client
-    VERSION = '0.2.1'
+    VERSION = '0.2.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: acme-client
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Charles Barbier
@@ -157,6 +157,7 @@ files:
 - bin/setup
 - lib/acme-client.rb
 - lib/acme/certificate.rb
+- lib/acme/certificate_request.rb
 - lib/acme/client.rb
 - lib/acme/crypto.rb
 - lib/acme/error.rb