acme-pki 0.1.3 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 9307776044f052681b8e87045cf8e346ec044fa7
-  data.tar.gz: c396901a57606839834a4d543d4b94f217a280c1
+SHA256:
+  metadata.gz: 7599cb3c3ceecf3e1ce1fb057339106937398c2ce6887a9f16442de981d351af
+  data.tar.gz: c81b97fc9132d5442185cfc4ea011b93175e8568dfeb582c0f1e7834ba3b2942
 SHA512:
-  metadata.gz: f0a079de8d32ae3d11b8e4d5d4a9aef6f949a01680ce9d51c24b8d580b88f96106dfe1639fd73bf8532a16870dc0b23679c7c12606564ec6d8e6aa0b9e6a73d9
-  data.tar.gz: 68f54cca1e87abf914f30f62fb8016bb208f2fb4176f37c83942981a26e47a6289e9995262fc7e879f675e1e83934500a0b17eb3dd9b83e17f6f588bbd7242a5
+  metadata.gz: ade350294c8dc14ee322120e342697d5f98b0d66cc98b611e908fda4502e011b196ca25ba0b0b548579800db9865600898cc77f3cf2a035c1ed17e36f5acfcd5
+  data.tar.gz: beeb43ea7b6d2e2f2551bc114edcc69349f7bcd85d66f54a872dce086bc062bbd56b77ae619b5344404a786c7b7e05a5ed13b9efd585bddff4f6c897321b8aa9

data/.gitignore

@@ -1,4 +1,3 @@
 *.gem
 *.iml
-Gemfile.lock
-/pki/
+pki/

data/Gemfile.lock

@@ -0,0 +1,47 @@
+PATH
+  remote: .
+  specs:
+    acme-pki (0.2.3)
+      acme-client (~> 2.0)
+      colorize (~> 0.8)
+      faraday_middleware (~> 0.13)
+      simpleidn (~> 0.1)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    acme-client (2.0.6)
+      faraday (>= 0.17, < 2.0.0)
+    awesome_print (1.8.0)
+    byebug (11.1.3)
+    coderay (1.1.2)
+    colorize (0.8.1)
+    faraday (0.17.3)
+      multipart-post (>= 1.2, < 3)
+    faraday_middleware (0.14.0)
+      faraday (>= 0.7.4, < 1.0)
+    method_source (1.0.0)
+    multipart-post (2.1.1)
+    pry (0.13.1)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    pry-byebug (3.9.0)
+      byebug (~> 11.0)
+      pry (~> 0.13.0)
+    simpleidn (0.1.1)
+      unf (~> 0.1.4)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  acme-pki!
+  awesome_print (~> 1.8)
+  bundler (~> 2.0)
+  pry-byebug (~> 3.7)
+
+BUNDLED WITH
+   2.1.4

data/acme-pki.gemspec

@@ -1,13 +1,14 @@
-# coding: utf-8
 lib = File.expand_path('../lib', __FILE__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
+require 'acme/pki/version'
+
 Gem::Specification.new do |spec|
 	spec.name = 'acme-pki'
-	spec.version = '0.1.3'
+	spec.version = Acme::PKI::VERSION
 	spec.authors = ['Aeris']
 	spec.email = ['aeris@imirhil.fr']
-	spec.summary = %q{Ruby client for Let’s Encrypt}
+	spec.summary = %q{Ruby client for Let's Encrypt}
 	spec.description = %q{Manage your keys, requests and certificates.}
 	spec.homepage = 'https://github.com/aeris/acme-pki/'
 	spec.license = 'AGPL-3.0+'
@@ -17,10 +18,12 @@ Gem::Specification.new do |spec|
 	spec.test_files = spec.files.grep %r{^(test|spec|features)/}
 	spec.require_paths = %w(lib)
 
-	spec.add_development_dependency 'bundler', '~> 1.11'
+	spec.add_development_dependency 'bundler', '~> 2.0'
+	spec.add_development_dependency 'awesome_print', '~> 1.8'
+	spec.add_development_dependency 'pry-byebug', '~> 3.7'
 
-	spec.add_dependency 'acme-client', '~> 0.3.1'
-	spec.add_dependency 'faraday_middleware', '~> 0.10.0'
-	spec.add_dependency 'colorize', '~> 0.7.7'
-	spec.add_dependency 'simpleidn', '~> 0.0.7'
+	spec.add_dependency 'acme-client', '~> 2.0'
+	spec.add_dependency 'faraday_middleware', '~> 0.13'
+	spec.add_dependency 'colorize', '~> 0.8'
+	spec.add_dependency 'simpleidn', '~> 0.1'
 end

data/bin/letsencrypt

@@ -3,77 +3,101 @@ require 'acme/pki'
 
 pki = Acme::PKI.new
 
+MYNAME = File.basename $PROGRAM_NAME
+
+HELP = <<-"EOTEXT"
+#{MYNAME} v#{Acme::PKI::VERSION}
+
+Available Commands:
+crt
+csr
+help
+info
+key
+register
+renew
+EOTEXT
+
+# if nothing, force help
+ARGV << 'help' if ARGV.length.zero?
+
 case ARGV.shift
-	when 'register'
-		OptionParser.new do |opts|
-			opts.banner = "Usage: #{File.basename __FILE__} register <email>"
-		end.parse!
-		if ARGV.empty?
-			puts "An email address is required !"
-			exit -1
-		end
-		pki.register ARGV.first
-	when 'key'
-		options = OpenStruct.new type: Acme::PKI::DEFAULT_KEY
-		OptionParser.new do |opts|
-			opts.banner = "Usage: #{File.filename __FILE__} key <domain> [options]"
-			opts.on('-r [KEYSIZE]', '--rsa [KEYSIZE]', 'RSA key, key size') { |k| options.type = [:rsa, k.to_i] }
-			opts.on('-e [CURVE]', '--ecc [CURVE]', 'ECC key, curve') { |k| options.type = [:ecc, k] }
-		end.parse!
-		if ARGV.empty?
-			puts "A domain is required !"
-			exit -1
-		end
-		pki.generate_key ARGV.first, type: options.type
-	when 'csr'
-		options = OpenStruct.new domains: []
-		OptionParser.new do |opts|
-			opts.banner = "Usage: #{File.basename __FILE__} csr <domain> [options]"
-			opts.on('-k [KEYFILE]', '--key [KEYFILE]', 'Key file') { |k| options.key = k }
-			opts.on('-d [DOMAIN]', '--domain [DOMAIN]', 'Domain') { |d| options.domains << d }
-		end.parse!
-		if ARGV.empty?
-			puts "A domain is required !"
-			exit -1
-		end
-		pki.generate_csr ARGV.first, key: options.key, domains: options.domains
-	when 'crt'
-		options = OpenStruct.new
-		OptionParser.new do |opts|
-			opts.banner = "Usage: #{File.basename __FILE__} crt <domain> [options]"
-			opts.on('-c [CSR]', '--csr [CSR]', 'CSR file') { |c| options.csr = c }
-		end.parse!
-		if ARGV.empty?
-			puts "A domain is required !"
-			exit -1
-		end
-		pki.generate_crt ARGV.first, csr: options.csr
-	when 'renew'
-		options = OpenStruct.new
-		OptionParser.new do |opts|
-			opts.banner = "Usage: #{File.basename __FILE__} renew <domain> [options]"
-			opts.on('-c [CSR]', '--csr [CSR]', 'CSR file') { |c| options.csr = c }
-		end.parse!
-		if ARGV.empty?
-			puts "A domain is required !"
-			exit -1
-		end
-		exit pki.renew(ARGV.first, csr: options.csr) ? 0 : 1
-	when 'info'
-		type = :key
-		OptionParser.new do |opts|
-			opts.banner = "Usage: #{File.basename __FILE__} info <domain> [options]"
-			opts.on('-k', '--key', 'Key information') { type = :key }
-			opts.on('-c', '--crt', 'Certificate information') { type = :crt }
-		end.parse!
-		if ARGV.empty?
-			puts "A domain is required !"
-			exit -1
-		end
-		case type
-			when :key
-				pki.key_info pki.key ARGV.first
-			when :crt
-				pki.chain_info pki.crt ARGV.first
-		end
+when /help|-[hH]|--help/
+  puts HELP
+  exit 0
+when 'register'
+  OptionParser.new do |opts|
+    opts.banner = "Usage: #{File.basename __FILE__} register <email>"
+  end.parse!
+  if ARGV.empty?
+    puts "An email address is required !"
+    exit -1
+  end
+  pki.register ARGV.first
+when 'key'
+  options = OpenStruct.new type: Acme::PKI::DEFAULT_KEY_TYPE
+  OptionParser.new do |opts|
+    opts.banner = "Usage: #{File.basename __FILE__} key <domain> [options]"
+    opts.on('-r [KEYSIZE]', '--rsa [KEYSIZE]', 'RSA key, key size') { |k| options.type = [:rsa, k.to_i] }
+    opts.on('-e [CURVE]', '--ecc [CURVE]', 'ECC key, curve') { |k| options.type = [:ecc, k] }
+  end.parse!
+  if ARGV.empty?
+    puts 'A domain is required !'
+    exit -1
+  end
+  pki.generate_key ARGV.first, type: options.type
+when 'csr'
+  options = OpenStruct.new domains: [], adds: [], removes: []
+  OptionParser.new do |opts|
+    opts.banner = "Usage: #{File.basename __FILE__} csr <domain> [options]"
+    opts.on('-k [KEYFILE]', '--key [KEYFILE]', 'Key file') { |k| options.key = k }
+    opts.on('-d [DOMAIN]', '--domain [DOMAIN]', 'Domain') { |d| options.domains << d }
+    opts.on('-a [DOMAIN]', '--add [DOMAIN]', 'Add domain') { |d| options.adds << d }
+    opts.on('-r [DOMAIN]', '--remove [DOMAIN]', 'Remove domain') { |d| options.removes << d }
+  end.parse!
+  if ARGV.empty?
+    puts 'A domain is required !'
+    exit -1
+  end
+  pki.generate_csr ARGV.first, key: options.key, domains: options.domains,
+                   add:             options.adds, remove: options.removes
+when 'crt'
+  options = OpenStruct.new
+  OptionParser.new do |opts|
+    opts.banner = "Usage: #{File.basename __FILE__} crt <domain> [options]"
+    opts.on('-c [CSR]', '--csr [CSR]', 'CSR file') { |c| options.csr = c }
+  end.parse!
+  if ARGV.empty?
+    puts 'A domain is required !'
+    exit -1
+  end
+  pki.generate_crt ARGV.first, csr: options.csr
+when 'renew'
+  options = OpenStruct.new
+  OptionParser.new do |opts|
+    opts.banner = "Usage: #{File.basename __FILE__} renew <domain> [options]"
+    opts.on('-c [CSR]', '--csr [CSR]', 'CSR file') { |c| options.csr = c }
+  end.parse!
+  if ARGV.empty?
+    puts 'A domain is required !'
+    exit -1
+  end
+  exit pki.renew(ARGV.first, csr: options.csr) ? 0 : 1
+when 'info'
+  type = :key
+  OptionParser.new do |opts|
+    opts.banner = "Usage: #{File.basename __FILE__} info <domain> [options]"
+    opts.on('-k', '--key', 'Key information') { type = :key }
+    opts.on('-c', '--crt', 'Certificate information') { type = :crt }
+  end.parse!
+  if ARGV.empty?
+    puts 'A domain is required !'
+    exit -1
+  end
+  case type
+  when :key
+    pki.key_info pki.key ARGV.first
+  when :crt
+    pki.chain_info pki.crt ARGV.first
+  end
 end

data/lib/acme/pki.rb

@@ -10,267 +10,294 @@ require 'simpleidn'
 
 require 'acme/pki/monkey_patch'
 require 'acme/pki/information'
+require 'acme/pki/version'
 
 module Acme
-	class PKI
-		include Information
-
-		DEFAULT_ENDPOINT       = ENV['ACME_ENDPOINT'] || 'https://acme-v01.api.letsencrypt.org/'
-		DEFAULT_ACCOUNT_KEY    = ENV['ACME_ACCOUNT_KEY'] || 'account.key'
-		DEFAULT_KEY            = [:ecc, 'secp384r1']
-		#DEFAULT_KEY            = [:rsa, 4096]
-		DEFAULT_RENEW_DURATION = 60*60*24*30 # 1 month
-
-		def initialize(directory: Dir.pwd, account_key: DEFAULT_ACCOUNT_KEY, endpoint: DEFAULT_ENDPOINT)
-			@directory        = directory
-			@challenge_dir    = ENV['ACME_CHALLENGE'] || File.join(@directory, 'acme-challenge')
-			@account_key_file = File.join @directory, account_key
-			@account_key      = if File.exists? @account_key_file
-									open(@account_key_file, 'r') { |f| OpenSSL::PKey.read f }
-								else
-									nil
-								end
-			@endpoint         = endpoint
-		end
-
-		def key(name)
-			file name, 'pem'
-		end
-
-		def csr(name)
-			file name, 'csr'
-		end
-
-		def crt(name)
-			file name, 'crt'
-		end
-
-		def register(mail)
-			process("Generating RSA 4096 bits account key into #{@account_key_file}") do
-				@account_key = OpenSSL::PKey::RSA.new 4096
-				File.write @account_key_file, @account_key.to_pem
-			end
-
-			process("Registering account key #{@account_key_file}") do
-				registration = client.register contact: "mailto:#{mail}"
-				registration.agree_terms
-			end
-		end
-
-		def generate_key(name, type: DEFAULT_KEY)
-			key_file   = self.key name
-			type, size = type
-
-			key = case type
-					  when :rsa
-						  process "Generating RSA #{size} bits private key into #{key_file}" do
-							  key = OpenSSL::PKey::RSA.new size
-							  open(key_file, 'w') { |f| f.write key.to_pem }
-							  key
-						  end
-					  when :ecc
-						  process "Generating ECC #{size} curve private key into #{key_file}" do
-							  key = OpenSSL::PKey::EC.new(size).generate_key
-							  open(key_file, 'w') { |f| f.write key.to_pem }
-							  key
-						  end
-				  end
-
-			key_info key
-		end
-
-		def generate_csr(csr, domains: [], key: nil)
-			key      = csr unless key
-			domains  = [csr, *domains].collect { |d| SimpleIDN.to_ascii d }
-			csr_file = self.csr csr
-			key_file = self.key key
-
-			generate_key key unless File.exist? key_file
-
-			process "Generating CSR for #{domains.join ', '} with key #{key_file} into #{csr_file}" do
-				key_file    = open(key_file, 'r') { |f| OpenSSL::PKey.read f }
-				csr         = OpenSSL::X509::Request.new
-				csr.subject = OpenSSL::X509::Name.parse "/CN=#{domains.first}"
-
-				public_key     = case key_file
-									 when OpenSSL::PKey::EC
-										 curve             = key_file.group.curve_name
-										 public            = OpenSSL::PKey::EC.new curve
-										 public.public_key = key_file.public_key
-										 public
-									 else
-										 key_file.public_key
-								 end
-				csr.public_key = public_key
-
-				factory    = OpenSSL::X509::ExtensionFactory.new
-				extensions = []
-				#extensions << factory.create_extension('basicConstraints', 'CA:FALSE', true)
-				extensions << factory.create_extension('keyUsage', 'digitalSignature,nonRepudiation,keyEncipherment')
-				extensions << factory.create_extension('subjectAltName', domains.collect { |d| "DNS:#{d}" }.join(', '))
-
-				extensions = OpenSSL::ASN1::Sequence extensions
-				extensions = OpenSSL::ASN1::Set [extensions]
-				csr.add_attribute OpenSSL::X509::Attribute.new 'extReq', extensions
-
-				csr.sign key_file, OpenSSL::Digest::SHA512.new
-				open(csr_file, 'w') { |f| f.write csr.to_pem }
-			end
-		end
-
-		def generate_crt(crt, csr: nil)
-			csr       = crt unless csr
-			short_csr = csr
-			crt       = self.crt crt
-			csr       = self.csr csr
-			generate_csr short_csr unless File.exist? csr
-			internal_generate_crt crt, csr: csr
-		end
-
-		def renew(crt, csr: nil, duration: DEFAULT_RENEW_DURATION)
-			csr = crt unless csr
-			crt = self.crt crt
-			csr = self.csr csr
-			puts "Renewing #{crt} CRT from #{csr} CSR"
-
-			if File.exists? crt
-				x509  = OpenSSL::X509::Certificate.new File.read crt
-				delay = x509.not_after - Time.now
-				if delay > duration
-					puts "No need to renew (#{humanize delay})"
-					return false
-				end
-			end
-
-			internal_generate_crt crt, csr: csr
-			true
-		end
-
-		private
-		def client
-			unless @account_key
-				puts 'No account key available'.colorize :yellow
-				puts 'Please register yourself before'.colorize :red
-				exit -1
-			end
-			@client ||= Acme::Client.new private_key: @account_key, endpoint: @endpoint
-		end
-
-		def process(line, io: STDOUT)
-			io.print "#{line}..."
-			io.flush
-
-			result = yield
-
-			io.puts " [#{'OK'.colorize :green}]"
-
-			result
-		rescue Exception
-			io.puts " [#{'KO'.colorize :red}]"
-			raise
-		end
-
-		def file(name, extension=nil)
-			return nil unless name
-			name = name.split('.').reverse.join('.')
-			name = "#{name}.#{extension}" if extension
-			File.join @directory, name
-		end
-
-		def domains(csr)
-			domains = []
-
-			cn = csr.subject.to_a.first { |n, _, _| n == 'CN' }
-			domains << cn[1] if cn
-
-			attribute = csr.attributes.detect { |a| %w(extReq msExtReq).include? a.oid }
-			if attribute
-				set  = OpenSSL::ASN1.decode attribute.value
-				seq  = set.value.first
-				sans = seq.value.collect { |s| OpenSSL::X509::Extension.new(s).to_a }
-							   .detect { |e| e.first == 'subjectAltName' }
-				if sans
-					sans = sans[1]
-					sans = sans.split(/\s*,\s*/)
-								   .collect { |s| s.split /\s*:\s*/ }
-								   .select { |t, _| t == 'DNS' }
-								   .collect { |_, v| v }
-					domains.concat sans
-				end
-			end
-
-			domains.uniq
-		end
-
-		def authorize(domain)
-			authorization = client.authorize domain: domain
-			challenge     = authorization.http01
-
-			unless Dir.exists? @challenge_dir
-				process "Creating directory #{@challenge_dir}" do
-					FileUtils.mkdir_p @challenge_dir
-				end
-			end
-
-			filename = challenge.token
-			file     = File.join @challenge_dir, filename
-			content  = challenge.file_content
-			process "Writing challenge for #{domain} into #{file}" do
-				File.write file, content
-			end
-
-			url = "http://#{domain}/.well-known/acme-challenge/#{filename}"
-			process "Test challenge for #{url}" do
-				response = begin
-					Faraday.new do |conn|
-						conn.use FaradayMiddleware::FollowRedirects
-						conn.adapter Faraday.default_adapter
-					end.get url
-				rescue => e
-				    raise Exception, e.message
-				end
-				raise Exception, "Got response code #{response.status}" unless response.success?
-				real_content = response.body
-				raise Exception, "Got #{real_content}, expected #{content}" unless real_content == content
-			end
-
-			process "Authorizing domain #{domain}" do
-				challenge.request_verification
-				status = nil
-				60.times do
-					sleep 1
-					status = challenge.verify_status
-					break if status != 'pending'
-				end
-
-				raise Exception, "Got status #{status} instead of valid" unless status == 'valid'
-			end
-		end
-
-		def internal_generate_crt(crt, csr: nil)
-			csr      = crt unless csr
-			csr_file = csr
-			csr      = OpenSSL::X509::Request.new File.read csr
-			domains  = domains csr
-
-			domains.each { |d| authorize d }
-
-			crt = process "Generating CRT #{crt} from CSR #{csr_file}" do
-				certificate = client.new_certificate csr
-				File.write crt, certificate.fullchain_to_pem
-				OpenSSL::X509::Certificate.new certificate.to_pem
-			end
-
-			certifificate_info crt
-		end
-
-		def humanize(secs)
-			[[60, :seconds], [60, :minutes], [24, :hours], [30, :days], [12, :months]].map { |count, name|
-				if secs > 0
-					secs, n = secs.divmod count
-					"#{n.to_i} #{name}"
-				end
-			}.compact.reverse.join(' ')
-		end
-	end
+  class PKI
+    include Information
+
+    if ENV['ACME_STAGING']
+      puts 'Using Let\'s Encrypt ACME staging'.colorize :yellow
+      ENV['ACME_ENDPOINT']    = 'https://acme-staging-v02.api.letsencrypt.org/directory'
+      ENV['ACME_ACCOUNT_KEY'] = 'account-staging'
+    end
+    DEFAULT_ENDPOINT         = ENV['ACME_ENDPOINT'] || 'https://acme-v02.api.letsencrypt.org/directory'
+    DEFAULT_DIRECTORY        = ENV['ACME_DIRECTORY'] || Dir.pwd
+    DEFAULT_ACCOUNT_KEY      = ENV['ACME_ACCOUNT_KEY'] || 'account'
+    DEFAULT_ACCOUNT_KEY_TYPE = [:rsa, 4096].freeze
+    DEFAULT_KEY_TYPE         = [:ecc, 'prime256v1'].freeze
+    DEFAULT_RENEW_DURATION   = 60 * 60 * 24 * 30 # 1 month
+
+    def initialize(directory: DEFAULT_DIRECTORY, account_key: DEFAULT_ACCOUNT_KEY, endpoint: DEFAULT_ENDPOINT)
+      @directory        = directory
+      @challenge_dir    = ENV['ACME_CHALLENGE'] || File.join(@directory, 'acme-challenge')
+      @account_key_file = self.key DEFAULT_ACCOUNT_KEY, 'key'
+      @account_key      = if File.exists? @account_key_file
+                            open(@account_key_file, 'r') { |f| OpenSSL::PKey.read f }
+                          else
+                            nil
+                          end
+      @endpoint         = endpoint
+    end
+
+    def key(name, extension = 'pem')
+      self.file name, extension
+    end
+
+    def csr(name)
+      self.file name, 'csr'
+    end
+
+    def crt(name)
+      self.file name, 'crt'
+    end
+
+    def register(mail)
+      @account_key_file, @account_key = self.generate_key DEFAULT_ACCOUNT_KEY, 'key', type: DEFAULT_ACCOUNT_KEY_TYPE
+      tos                             = self.client.meta['termsOfService']
+      $stdout.print "Are you agree with Let's Encrypt terms of service available at #{tos}? [yN] "
+      $stdout.flush
+      accept = $stdin.gets.chomp.downcase == 'y'
+      exit unless accept
+      self.process("Registering account key #{@account_key_file}") do
+        self.client.new_account contact: "mailto:#{mail}", terms_of_service_agreed: accept
+      end
+    end
+
+    def generate_key(name, extension = 'pem', type: DEFAULT_KEY_TYPE)
+      key_file   = self.key name, extension
+      type, size = type
+
+      log = case type
+            when :rsa
+              "RSA #{size} bits"
+            when :ecc
+              "ECC #{size} curve"
+            end
+
+      key = self.process "Generating #{log} private key into #{key_file}" do
+        key = case type
+              when :rsa
+                OpenSSL::PKey::RSA.new size
+              when :ecc
+                OpenSSL::PKey::EC.new(size).generate_key
+              end
+        open(key_file, 'w') { |f| f.write key.to_pem }
+        key
+      end
+      self.key_info key
+      [key_file, key]
+    end
+
+    def generate_csr(csr, domains: [], add: [], remove: [], key: nil)
+      key = csr unless key
+      csr_file = self.csr csr
+      key_file = self.key key
+      self.generate_key key unless File.exist? key_file
+
+      domains = if add.empty? && remove.empty?
+                  [csr, *domains]
+                else
+                  tmp      = OpenSSL::X509::Request.new File.read csr_file
+                  domains = self.domains tmp
+                  domains - remove + add
+                end.collect { |d| SimpleIDN.to_ascii d }
+
+      self.process "Generating CSR for #{domains.join ', '} with key #{key_file} into #{csr_file}" do
+        key_file    = open(key_file, 'r') { |f| OpenSSL::PKey.read f }
+        csr         = OpenSSL::X509::Request.new
+        csr.subject = OpenSSL::X509::Name.parse "/CN=#{domains.first}"
+
+        public_key     = case key_file
+                         when OpenSSL::PKey::EC
+                           curve             = key_file.group.curve_name
+                           public            = OpenSSL::PKey::EC.new curve
+                           public.public_key = key_file.public_key
+
+                           public
+                         else
+                           key_file.public_key
+                         end
+        csr.public_key = public_key
+
+        factory    = OpenSSL::X509::ExtensionFactory.new
+        extensions = []
+        #extensions << factory.create_extension('basicConstraints', 'CA:FALSE', true)
+        extensions << factory.create_extension('keyUsage', 'digitalSignature,nonRepudiation,keyEncipherment')
+        extensions << factory.create_extension('subjectAltName', domains.collect { |d| "DNS:#{d}" }.join(', '))
+
+        extensions = OpenSSL::ASN1::Sequence extensions
+        extensions = OpenSSL::ASN1::Set [extensions]
+        csr.add_attribute OpenSSL::X509::Attribute.new 'extReq', extensions
+
+        csr.sign key_file, OpenSSL::Digest::SHA512.new
+        open(csr_file, 'w') { |f| f.write csr.to_pem }
+      end
+    end
+
+    def generate_crt(crt, csr: nil)
+      csr       = crt unless csr
+      short_csr = csr
+      crt       = self.crt crt
+      csr       = self.csr csr
+      self.generate_csr short_csr unless File.exist? csr
+      self.internal_generate_crt crt, csr: csr
+    end
+
+    def renew(crt, csr: nil, duration: DEFAULT_RENEW_DURATION)
+      csr = crt unless csr
+      crt = self.crt crt
+      csr = self.csr csr
+      puts "Renewing #{crt} CRT from #{csr} CSR"
+
+      if File.exists? crt
+        x509  = OpenSSL::X509::Certificate.new File.read crt
+        delay = x509.not_after - Time.now
+        if delay > duration
+          puts "No need to renew (#{humanize delay})"
+          return false
+        end
+      end
+
+      self.internal_generate_crt crt, csr: csr
+      true
+    end
+
+    def client
+      unless @account_key
+        puts 'No account key available'.colorize :yellow
+        puts 'Please register yourself before'.colorize :red
+        exit -1
+      end
+      @client ||= Acme::Client.new private_key: @account_key, directory: @endpoint
+    end
+
+    def process(line, io: STDOUT)
+      io.print "#{line}..."
+      io.flush
+
+      result = yield
+
+      io.puts " [#{'OK'.colorize :green}]"
+
+      result
+    rescue Exception
+      io.puts " [#{'KO'.colorize :red}]"
+      raise
+    end
+
+    def file(name, extension = nil)
+      return nil unless name
+      name = name.split('.').reverse.join('.')
+      name = "#{name}.#{extension}" if extension
+      File.join @directory, name
+    end
+
+    def domains(csr)
+      domains = []
+
+      cn = csr.subject.to_a.first { |n, _, _| n == 'CN' }
+      domains << cn[1] if cn
+
+      attribute = csr.attributes.detect { |a| %w(extReq msExtReq).include? a.oid }
+      if attribute
+        set  = OpenSSL::ASN1.decode attribute.value
+        seq  = set.value.first
+        sans = seq.value.collect { |s| OpenSSL::X509::Extension.new(s).to_a }
+                 .detect { |e| e.first == 'subjectAltName' }
+        if sans
+          sans = sans[1]
+          sans = sans.split(/\s*,\s*/)
+                   .collect { |s| s.split /\s*:\s*/ }
+                   .select { |t, _| t == 'DNS' }
+                   .collect { |_, v| v }
+          domains.concat sans
+        end
+      end
+
+      domains.uniq
+    end
+
+    def authorize(authorization)
+      domain    = authorization.domain
+      challenge = authorization.http
+      status    = challenge.status
+      if status == 'valid'
+        puts "Domain #{domain.colorize :green} already authorized"
+        return
+      end
+      puts "Authorizing domain #{domain.colorize :yellow} (current status: #{status.colorize :yellow})"
+
+      unless Dir.exists? @challenge_dir
+        self.process "Creating directory #{@challenge_dir}" do
+          FileUtils.mkdir_p @challenge_dir
+        end
+      end
+
+      filename = challenge.token
+      file     = File.join @challenge_dir, filename
+      content  = challenge.file_content
+      self.process "Writing challenge for #{domain.colorize :yellow} into #{file.colorize :yellow}" do
+        File.write file, content
+      end
+
+      url = "http://#{domain}/.well-known/acme-challenge/#{filename}"
+      self.process "Test challenge for #{url.colorize :yellow}" do
+        response = begin
+                     Faraday.new do |conn|
+                       conn.use FaradayMiddleware::FollowRedirects
+                       conn.adapter Faraday.default_adapter
+                     end.get url
+                   rescue => e
+                     raise Exception, e.message
+                   end
+        raise Exception, "Got response code #{response.status.to_s.colorize :red}" unless response.success?
+        real_content = response.body
+        raise Exception, "Got #{real_content.colorize :red}, expected #{content.colorize :green}" unless real_content == content
+      end
+
+      self.process "Authorizing domain #{domain.colorize :yellow}" do
+        challenge.request_validation
+        status = nil
+        60.times do
+          sleep 1
+          challenge.reload
+          status = challenge.status
+          break if status != 'pending'
+        end
+
+        raise Exception, "Got status #{status.colorize :red} instead of valid" unless status == 'valid'
+      end
+
+      File.unlink file
+    end
+
+    def internal_generate_crt(crt, csr: nil)
+      csr      = crt unless csr
+      csr_file = csr
+      csr      = OpenSSL::X509::Request.new File.read csr
+      domains  = self.domains csr
+
+      order = client.new_order identifiers: domains
+      order.authorizations.each { |a| self.authorize a }
+
+      crt = self.process "Generating CRT #{crt} from CSR #{csr_file}" do
+        order.finalize csr: csr
+        certificate = order.certificate
+        File.write crt, certificate
+        OpenSSL::X509::Certificate.new certificate
+      end
+
+      self.certifificate_info crt
+    end
+
+    def humanize(secs)
+      [[60, :seconds], [60, :minutes], [24, :hours], [30, :days], [12, :months]].map { |count, name|
+        if secs > 0
+          secs, n = secs.divmod count
+          "#{n.to_i} #{name}"
+        end
+      }.compact.reverse.join(' ')
+    end
+  end
 end

data/lib/acme/pki/information.rb

@@ -5,7 +5,19 @@ module Acme
 		module Information
 			def key_info(key, tab: 0)
 				key = open(key, 'r') { |f| OpenSSL::PKey.read f } unless key.is_a? OpenSSL::PKey::PKey
-				der = key.to_der
+
+				der = case key
+						  when OpenSSL::PKey::EC
+							  puts "\t" * (tab) + "#{'Key'.colorize :red} : ECC #{key.group.curve_name}"
+
+							  point          = key.public_key
+							  pub            = OpenSSL::PKey::EC.new point.group
+							  pub.public_key = point
+							  pub
+						  when OpenSSL::PKey::RSA
+							  puts "\t" * (tab) + "#{'Key'.colorize :red} : RSA #{key.n.num_bits} bits"
+							  key.public_key
+					  end.to_der
 
 				fingerprint der, tab: tab
 
@@ -61,25 +73,25 @@ module Acme
 					puts "Fetch certificate #{issuer} from #{uri}"
 					file = Digest::MD5.hexdigest uri
 					file = file File.join 'cache', file
-					dir = File.dirname file
+					dir  = File.dirname file
 					FileUtils.mkpath dir unless Dir.exist? dir
-					crt  = if File.exist? file
-							   open(file, 'r') { |f| OpenSSL::X509::Certificate.new f }
-						   else
-							   crt = Faraday.get uri
-							   break unless crt.success?
-							   crt = crt.body
-
-							   crt = begin
-								   OpenSSL::X509::Certificate.new crt
-							   rescue
-								   pkcs7 = OpenSSL::PKCS7.new crt
-								   pkcs7.certificates.first
-							   end
-
-							   File.write file, crt.to_pem
-							   crt
-						   end
+					crt = if File.exist? file
+							  open(file, 'r') { |f| OpenSSL::X509::Certificate.new f }
+						  else
+							  crt = Faraday.get uri
+							  break unless crt.success?
+							  crt = crt.body
+
+							  crt = begin
+								  OpenSSL::X509::Certificate.new crt
+							  rescue
+								  pkcs7 = OpenSSL::PKCS7.new crt
+								  pkcs7.certificates.first
+							  end
+
+							  File.write file, crt.to_pem
+							  crt
+						  end
 
 					subject = crt.subject
 					puts "Warning : expecting #{issuer}, get #{subject}".colorize :magenta unless subject == issuer

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: acme-pki
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.2.3
 platform: ruby
 authors:
 - Aeris
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-04-24 00:00:00.000000000 Z
+date: 2020-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,70 +16,98 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: awesome_print
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.7'
 - !ruby/object:Gem::Dependency
   name: acme-client
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.1
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.1
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: faraday_middleware
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.0
+        version: '0.13'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.0
+        version: '0.13'
 - !ruby/object:Gem::Dependency
   name: colorize
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.7
+        version: '0.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.7
+        version: '0.8'
 - !ruby/object:Gem::Dependency
   name: simpleidn
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.7
+        version: '0.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.0.7
+        version: '0.1'
 description: Manage your keys, requests and certificates.
 email:
 - aeris@imirhil.fr
@@ -90,6 +118,7 @@ extra_rdoc_files: []
 files:
 - ".gitignore"
 - Gemfile
+- Gemfile.lock
 - LICENSE
 - README.md
 - acme-pki.gemspec
@@ -97,11 +126,12 @@ files:
 - lib/acme/pki.rb
 - lib/acme/pki/information.rb
 - lib/acme/pki/monkey_patch.rb
+- lib/acme/pki/version.rb
 homepage: https://github.com/aeris/acme-pki/
 licenses:
 - AGPL-3.0+
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -116,9 +146,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
-signing_key: 
+rubygems_version: 3.0.3
+signing_key:
 specification_version: 4
-summary: Ruby client for Let’s Encrypt
+summary: Ruby client for Let's Encrypt
 test_files: []