acme-client 0.2.3 → 0.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9f9c42703db71639a5e1f5f01ce79d793343bd13
-  data.tar.gz: a6e9dbb2adcd1246db1c67417b8b4ac3e54fbe2c
+  metadata.gz: e2bfc1b30ebefbb87d572378e91ac4d9e47552de
+  data.tar.gz: 51bedd0f2e79328154c044f98c354b0bb2db4860
 SHA512:
-  metadata.gz: 62053ee6b500dbf4d239919f7b6522f47459fa08f78e62395877cde46dccc35ba3de028bdb032e305dd890c90b86de5d2e4b6b2c34f48e517198eca0ac162081
-  data.tar.gz: fca377ddccf602238402cbe0d49febe228690dd68fc4922a135b515d6178c8e0843c08225bb371853723717ce6794b22ca3399c505f804f0cf74a9e16acf9117
+  metadata.gz: 03c36be67fa43961e1c61ce1ae9abaf0922042e4281240901b520f69bc38961e7690b7301cc95dc9be6962d9e23057f46fba3d154e56c33993f9abb767c29a14
+  data.tar.gz: fb2079a8eb3c28772b01655e211a82391ee76f68ecc41cc41f95b7b800dc04aec3c6d4f9f36f8574a7d53b7bd78edf7b908a81296065bf0f29d289500a6e5bab

data/README.md

@@ -92,7 +92,7 @@ File.write("fullchain.pem", certificate.fullchain_to_pem)
 # Not implemented
 
 - Recovery methods are not implemented.
-- tls-sni-01 and proofOfPossession-01 are not implemented.
+- proofOfPossession-01 is not implemented.
 
 ## Development
 

data/lib/acme-client.rb

@@ -9,6 +9,7 @@ require 'forwardable'
 
 require 'acme/client/certificate'
 require 'acme/client/certificate_request'
+require 'acme/client/self_sign_certificate'
 require 'acme/client/crypto'
 require 'acme/client'
 require 'acme/client/resources'

data/lib/acme/client/certificate.rb

@@ -1,7 +1,7 @@
 class Acme::Client::Certificate
   extend Forwardable
 
-  attr_reader :x509, :x509_chain, :request
+  attr_reader :x509, :x509_chain, :request, :private_key
 
   def_delegators :x509, :to_pem, :to_der
 

data/lib/acme/client/resources/authorization.rb

@@ -1,8 +1,9 @@
 class Acme::Client::Resources::Authorization
   HTTP01 = Acme::Client::Resources::Challenges::HTTP01
   DNS01 = Acme::Client::Resources::Challenges::DNS01
+  TLSSNI01 = Acme::Client::Resources::Challenges::TLSSNI01
 
-  attr_reader :domain, :status, :http01, :dns01
+  attr_reader :domain, :status, :http01, :dns01, :tls_sni01
 
   def initialize(client, response)
     @client = client
@@ -17,6 +18,7 @@ class Acme::Client::Resources::Authorization
       case attributes.fetch('type')
       when 'http-01' then @http01 = HTTP01.new(@client, attributes)
       when 'dns-01' then @dns01 = DNS01.new(@client, attributes)
+      when 'tls-sni-01' then @tls_sni01 = TLSSNI01.new(@client, attributes)
       else
         # no supported
       end

data/lib/acme/client/resources/challenges.rb

@@ -3,3 +3,4 @@ module Acme::Client::Resources::Challenges; end
 require 'acme/client/resources/challenges/base'
 require 'acme/client/resources/challenges/http01'
 require 'acme/client/resources/challenges/dns01'
+require 'acme/client/resources/challenges/tls_sni01'

data/lib/acme/client/resources/challenges/tls_sni01.rb

@@ -0,0 +1,25 @@
+class Acme::Client::Resources::Challenges::TLSSNI01 < Acme::Client::Resources::Challenges::Base
+  def hostname
+    digest = crypto.digest.hexdigest(authorization_key)
+    "#{digest[0..31]}.#{digest[32..64]}.acme.invalid"
+  end
+
+  def certificate
+    self_sign_certificate.certificate
+  end
+
+  def private_key
+    self_sign_certificate.private_key
+  end
+
+  def request_verification
+    response = client.connection.post(@uri, { resource: 'challenge', type: 'tls-sni-01', keyAuthorization: authorization_key })
+    response.success?
+  end
+
+  private
+
+  def self_sign_certificate
+    @self_sign_certificate ||= Acme::Client::SelfSignCertificate.new(subject_alt_names: [hostname])
+  end
+end

data/lib/acme/client/self_sign_certificate.rb

@@ -0,0 +1,50 @@
+class Acme::Client::SelfSignCertificate
+  attr_reader :private_key, :subject_alt_names, :not_before, :not_after
+
+  extend Forwardable
+  def_delegators :certificate, :to_pem, :to_der
+
+  def initialize(subject_alt_names:, not_before: default_not_before, not_after: default_not_after, private_key: generate_private_key)
+    @private_key = private_key
+    @subject_alt_names = subject_alt_names
+    @not_before = not_before
+    @not_after = not_after
+  end
+
+  def certificate
+    @certificate ||= begin
+      certificate = OpenSSL::X509::Certificate.new
+      certificate.not_before = not_before
+      certificate.not_after = not_after
+      certificate.public_key = private_key.public_key
+
+      extension_factory = OpenSSL::X509::ExtensionFactory.new
+      extension_factory.subject_certificate = certificate
+      extension_factory.issuer_certificate = certificate
+
+      subject_alt_name_entry = subject_alt_names.map { |d| "DNS: #{d}" }.join(',')
+      subject_alt_name_extension = extension_factory.create_extension('subjectAltName', subject_alt_name_entry)
+      certificate.add_extension(subject_alt_name_extension)
+
+      certificate.sign(private_key, digest)
+    end
+  end
+
+  private
+
+  def generate_private_key
+    OpenSSL::PKey::RSA.new(2048)
+  end
+
+  def default_not_before
+    Time.now + 3600
+  end
+
+  def default_not_after
+    Time.now + 30 * 24 * 3600
+  end
+
+  def digest
+    OpenSSL::Digest::SHA256.new
+  end
+end

data/lib/acme/client/version.rb

@@ -1,5 +1,5 @@
 module Acme
   class Client
-    VERSION = '0.2.3'
+    VERSION = '0.2.4'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: acme-client
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.4
 platform: ruby
 authors:
 - Charles Barbier
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-12-21 00:00:00.000000000 Z
+date: 2015-12-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -174,7 +174,9 @@ files:
 - lib/acme/client/resources/challenges/base.rb
 - lib/acme/client/resources/challenges/dns01.rb
 - lib/acme/client/resources/challenges/http01.rb
+- lib/acme/client/resources/challenges/tls_sni01.rb
 - lib/acme/client/resources/registration.rb
+- lib/acme/client/self_sign_certificate.rb
 - lib/acme/client/version.rb
 homepage: http://github.com/unixcharles/acme-client
 licenses: