acmesmith 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: aa3aeb5db314174154c583ed9e7a8570ae93af9f
-  data.tar.gz: c206e47404eaa26c34da65c67f2f45305a4f1bf0
+SHA256:
+  metadata.gz: 428d6ec71e91259de56ffd77471e823c9673eb9002e8c1bb419875f57f9086e3
+  data.tar.gz: c85d4efa0fd6a36b04ea1fbfbd346a055426a1fdb818c5c7f25d28d4073f8b56
 SHA512:
-  metadata.gz: 9353ff805b353124a976f53a02476523ab63659e393b2bffd71bd8f8917409613a4a29af92d47084066074a499e97fc78edf8f08c325407276aaaaf10f2e4e09
-  data.tar.gz: 7acec572d2864fae53193f19ad17b555de35df44d1c40843ca4f37ef8d46c514db43751fca42a30704259044ed26421559d5e77292dff3c17d118fadeed43cc6
+  metadata.gz: f748341d751c06fe73c17e25c381979e6c77700a5df8bed4978fbfb5563e767d94a73cbfb5bc403cd60516e94fdf34af79b43c0ec3dcd82340e96c776a3cef70
+  data.tar.gz: f25125c00a446baa23f7025594096081a2ddd10c920d8602b8df8eb8bac0def9bb6ea63ae00d984124dc5a306d79e86faf386135e9f4281ddf28cb77b8094918

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v2.2.0 (2018-08-08)
+
+### Enhancement
+
+- s3: Added `pkcs12_passphrase` and `pkcs12_commonname` options for saving PKCS#12 file into a S3 bucket. This is for scripts which read S3 bucket directly and needs PKCS#12 file.
+
 ## v2.1.0 (2018-06-07)
 
 ### Changes

data/README.md

@@ -71,8 +71,8 @@ See `acmesmith help [subcommand]` for more help.
 See [config.sample.yml](./config.sample.yml) to start. Default configuration file is `./acmesmith.yml`.
 
 ``` yaml
-directory: https://acme-staging-v02.api.letsencrypt.org/
-# directory: https://acme-v02.api.letsencrypt.org/ # productilon
+directory: https://acme-staging-v02.api.letsencrypt.org/directory
+# directory: https://acme-v02.api.letsencrypt.org/directory # production
 
 storage:
   # configure where to store keys and certificates; described later
@@ -101,6 +101,8 @@ storage:
   # kms_key_id: # KMS key id (optional); if omit, default AWS managed key for S3 will be used
   # kms_key_id_account: # KMS key id for account key (optional); This overrides kms_key_id
   # kms_key_id_certificate_key: # KMS key id for private keys for certificates (optional); This oveerides kms_key_id
+  # pkcs12_passphrase: # (optional) Set passphrase to generate PKCS#12 file (for scripts that reads S3 bucket directly)
+  # pkcs12_common_names: ['example.org'] # (optional) List of common names to limit certificates for generating PKCS#12 file.
 ```
 
 This saves certificates and keys in the following S3 keys:

data/lib/acmesmith/certificate.rb

@@ -110,6 +110,10 @@ module Acmesmith
       "#{certificate.not_before.utc.strftime('%Y%m%d-%H%M%S')}_#{certificate.serial.to_i.to_s(16)}"
     end
 
+    def pkcs12(passphrase)
+      OpenSSL::PKCS12.create(passphrase, common_name, private_key, certificate)
+    end
+
     def export(passphrase, cipher: OpenSSL::Cipher.new('aes-256-cbc'))
       {}.tap do |h|
         h[:certificate] = certificate.to_pem

data/lib/acmesmith/client.rb

@@ -12,7 +12,7 @@ module Acmesmith
     def new_account(contact, tos_agreed: true)
       key = AccountKey.generate
       acme = Acme::Client.new(private_key: key.private_key, directory: config.fetch('directory'))
-      client = acme.new_account(contact: contact, terms_of_service_agreed: tos_agreed)
+      acme.new_account(contact: contact, terms_of_service_agreed: tos_agreed)
 
       storage.put_account_key(key, account_key_passphrase)
 
@@ -139,7 +139,7 @@ module Acmesmith
       cert = storage.get_certificate(common_name, version: version)
       cert.key_passphrase = certificate_key_passphrase if certificate_key_passphrase
       
-      p12 = OpenSSL::PKCS12.create(passphrase, cert.common_name, cert.private_key, cert.certificate)
+      p12 = cert.pkcs12(passphrase)
       File.open(output, 'w', mode.to_i(8)) do |f|
         f.puts p12.to_der
       end

data/lib/acmesmith/storages/s3.rb

@@ -7,7 +7,7 @@ require 'acmesmith/certificate'
 module Acmesmith
   module Storages
     class S3 < Base
-      def initialize(aws_access_key: nil, bucket:, prefix: nil, region:, use_kms: true, kms_key_id: nil, kms_key_id_account: nil, kms_key_id_certificate_key: nil)
+      def initialize(aws_access_key: nil, bucket:, prefix: nil, region:, use_kms: true, kms_key_id: nil, kms_key_id_account: nil, kms_key_id_certificate_key: nil, pkcs12_passphrase: nil, pkcs12_common_names: nil)
         @region = region
         @bucket = bucket
         @prefix = prefix
@@ -15,6 +15,9 @@ module Acmesmith
           @prefix += '/'
         end
 
+        @pkcs12_passphrase = pkcs12_passphrase
+        @pkcs12_common_names = pkcs12_common_names
+
         @use_kms = use_kms
         @kms_key_id = kms_key_id
         @kms_key_id_account = kms_key_id_account
@@ -64,12 +67,12 @@ module Acmesmith
       def put_certificate(cert, passphrase = nil, update_current: true)
         h = cert.export(passphrase)
 
-        put = -> (key, body, kms) do
+        put = -> (key, body, kms, content_type = 'application/x-pem-file') do
           params = {
             bucket: bucket,
             key: key,
             body: body,
-            content_type: 'application/x-pem-file',
+            content_type: content_type,
           }
           if kms
             params[:server_side_encryption] = 'aws:kms'
@@ -84,6 +87,10 @@ module Acmesmith
         put.call fullchain_key(cert.common_name, cert.version), "#{h[:fullchain].rstrip}\n", false
         put.call private_key_key(cert.common_name, cert.version), "#{h[:private_key].rstrip}\n", true
 
+        if generate_pkcs12?(cert)
+          put.call pkcs12_key(cert.common_name, cert.version), "#{cert.pkcs12(@pkcs12_passphrase).to_der}\n", true, 'application/x-pkcs12'
+        end
+
         if update_current
           @s3.put_object(
             bucket: bucket,
@@ -171,6 +178,16 @@ module Acmesmith
       def fullchain_key(cn, ver)
         "#{certificate_base_key(cn, ver)}/fullchain.pem"
       end
+
+      def pkcs12_key(cn, ver)
+        "#{certificate_base_key(cn, ver)}/cert.p12"
+      end
+
+      def generate_pkcs12?(cert)
+        if @pkcs12_passphrase
+          @pkcs12_common_names.nil? || @pkcs12_common_names.include?(cert.common_name)
+        end
+      end
     end
   end
 end

data/lib/acmesmith/version.rb

@@ -1,3 +1,3 @@
 module Acmesmith
-  VERSION = "2.1.0"
+  VERSION = "2.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: acmesmith
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - sorah (Shota Fukumori)
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-07 00:00:00.000000000 Z
+date: 2018-08-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acme-client
@@ -192,7 +192,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.8
+rubygems_version: 2.7.7
 signing_key: 
 specification_version: 4
 summary: ACME client (Let's encrypt client) to manage certificate in multi server