acmesmith 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4360b52e2ad9bae70d23e26155063d46e7590fbd
-  data.tar.gz: 88e3f90208ec52d8e3509272d5bab71ee666472e
+  metadata.gz: f4eabbcb2bb88783d1b487344b1022f921968f2f
+  data.tar.gz: 2a664ea8940194eb01f951ebdddc3dd3cf81ec65
 SHA512:
-  metadata.gz: 54a4e48a88bbc94b5972dc531c5a79be4824a9146834cd7b92aa376a74f877b4143aed3221dda9f7c150495eab168044090ad3cc01ee4b9a2e4fe3ace43c1ea9
-  data.tar.gz: a43f52ebfe0b87a44f8fea7440506b8a46e930fd12fb6b8299f1316ad694cf5319b8e6cca8b14a493e8bb532a51c5281f8be5a25aa65f64e0acfa0e7d8a751b3
+  metadata.gz: 95858bf33cf374a349ec1ee5c45c5be68ee914294801a603151fcbe76b943a7c59918795cbfbee99b09597058c4b648240d6e66eec6ab8e0648c232eff66d054
+  data.tar.gz: dba846aad843896b668640663b0c67e15f5de36a706dbada70dfab566ef5883821828803f3bfc6bcc79f9440366ce20dad760ff2ebfa6e15d8f2b57007c489a9

data/README.md

@@ -1,8 +1,8 @@
-# Acmesmith: An effective ACME client to operate on multiple servers environment with the cloud
+# Acmesmith: A simple, effective ACME client to use with many servers and a cloud
 
 Acmesmith is an [ACME (Automatic Certificate Management Environment)](https://github.com/ietf-wg-acme/acme) client that works perfect on environment with multiple servers. This client saves certificate and keys on cloud services (e.g. AWS S3) securely, then allow to deploy issued certificates onto your servers smoothly. This works well on [Let's encrypt](https://letsencrypt.org).
 
-This tool is written in Ruby, but this saves certificates in simple scheme, so you can fetch certificate by your own simple scripts.
+This tool is written in Ruby, but Acmesmith saves certificates in simple scheme, so you can fetch certificate by your own simple scripts.
 
 ## Features
 
@@ -13,6 +13,9 @@ This tool is written in Ruby, but this saves certificates in simple scheme, so y
   - Currently AWS S3 is supported
 - Challenge response
   - Currently `dns-01` with AWS Route 53 is supported
+- Pluggable modules, you can use 3rd party one or write:
+  - Storages for other than AWS S3
+  - Challenge reponses for other than AWS Route53 or dns-01 challenges, like for Openstack DNSaaS.
 
 ### Planned
 
@@ -54,6 +57,7 @@ $ acmesmith show-certificate COMMON_NAME                # show certificate
 $ acmesmith show-private-key COMMON_NAME                # show private key
 $ acmesmith save-certificate COMMON_NAME --output=PATH  # Save certificate to a file
 $ acmesmith save-private-key COMMON_NAME --output=PATH  # Save private key to a file
+$ acmesmith save-pkcs12      COMMON_NAME --output=PATH  # Save certificate and private key to a PKCS12 file
 ```
 
 ```
@@ -137,114 +141,15 @@ challenge_responders:
       #   "example.org.": "/hostedzone/DEADBEEF"
 ```
 
-## Vendor dependent notes
+## 3rd party Plugins
 
-### AWS
-
-#### IAM policy
-
-##### All access (S3 + Route53 setup)
-
-``` json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
-      "Resource": ["arn:aws:s3:::{BUCKET-NAME}", "arn:aws:s3:::{BUCKET-NAME}/*"]
-    },
-    {
-      "Effect": "Allow",
-      "Action": ["route53:ListHostedZones", "route53:GetChange"],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "route53:ChangeResourceRecordSets",
-      "Resource": ["arn:aws:route53:::hostedzone/*"]
-    }
-  ]
-}
-```
+### Challenge responders
 
-Note: You can limit allowed hosted zone by modifying `Resource` of `route53:ChangeResourceRecordSets`
-
-##### Only fetching certificates
-
-``` json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": ["s3:GetObject"],
-      "Resource": ["arn:aws:s3:::{BUCKET-NAME}/certs/*"]
-    },
-    {
-      "Effect": "Allow",
-      "Action": ["s3:ListBucket"],
-      "Resource": ["arn:aws:s3:::{BUCKET-NAME}"],
-      "Condition": {
-        "StringEquals": {
-          "s3:delimiter": "/"
-        },
-        "StringLike": {
-          "s3:prefix": "certs/*",
-        }
-      }
-    }
-  ]
-}
-```
+- [hanazuki/acmesmith-designate](https://github.com/hanazuki/acmesmith-designate) `dns-01` challenge responder with OpenStack-based DNSaaS (Designate v1 API), e.g. for ConoHa.
 
-#### AWS KMS key policy for customer managed keys
-
-If you're going to use `aws_kms_id` option to use customer managed keys instead of AWS managed default KMS key for Amazon S3, use the following policy as base:
-
-Be sure to replace `{S3-REGION}` and `{YOUR-AWS-ACCOUNT-ID}` before applying it.
-
-``` json
-{
-  "Version": "2012-10-17",
-  "Id": "kms-acmesmith-s3-policy",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "*"
-      },
-      "Action": [
-        "kms:Encrypt",
-        "kms:Decrypt",
-        "kms:ReEncrypt*",
-        "kms:GenerateDataKey*",
-        "kms:DescribeKey"
-      ],
-      "Resource": "*",
-      "Condition": {
-        "StringEquals": {
-          "kms:ViaService": "s3.{S3-REGION}.amazonaws.com",
-          "kms:CallerAccount": "{YOUR-AWS-ACCOUNT-ID}"
-        }
-      }
-    },
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "arn:aws:iam::{YOUR-AWS-ACCOUNT-ID}:root"
-      },
-      "Action": [
-        "kms:Describe*",
-        "kms:Get*",
-        "kms:List*",
-        "kms:Put*"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
-```
+## Vendor dependent notes
+
+- [./docs/vendor/aws.md](./docs/vendor/aws.md): IAM and KMS key policies, and some tips
 
 ## Development
 

data/docs/vendor/aws.md

@@ -0,0 +1,106 @@
+#### IAM policy
+
+##### All access (S3 + Route53 setup)
+
+``` json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
+      "Resource": ["arn:aws:s3:::{BUCKET-NAME}", "arn:aws:s3:::{BUCKET-NAME}/*"]
+    },
+    {
+      "Effect": "Allow",
+      "Action": ["route53:ListHostedZones", "route53:GetChange"],
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "route53:ChangeResourceRecordSets",
+      "Resource": ["arn:aws:route53:::hostedzone/*"]
+    }
+  ]
+}
+```
+
+Note: You can limit allowed hosted zone by modifying `Resource` of `route53:ChangeResourceRecordSets`
+
+##### Only fetching certificates
+
+``` json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:GetObject"],
+      "Resource": ["arn:aws:s3:::{BUCKET-NAME}/certs/*"]
+    },
+    {
+      "Effect": "Allow",
+      "Action": ["s3:ListBucket"],
+      "Resource": ["arn:aws:s3:::{BUCKET-NAME}"],
+      "Condition": {
+        "StringEquals": {
+          "s3:delimiter": "/"
+        },
+        "StringLike": {
+          "s3:prefix": "certs/*"
+        }
+      }
+    }
+  ]
+}
+```
+
+#### AWS KMS key policy for customer managed keys
+
+If you're going to use `aws_kms_id` option to use customer managed keys instead of AWS managed default KMS key for Amazon S3, use the following policy as base:
+
+Be sure to replace `{S3-REGION}` and `{YOUR-AWS-ACCOUNT-ID}` before applying it.
+
+``` json
+{
+  "Version": "2012-10-17",
+  "Id": "kms-acmesmith-s3-policy",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "kms:ViaService": "s3.{S3-REGION}.amazonaws.com",
+          "kms:CallerAccount": "{YOUR-AWS-ACCOUNT-ID}"
+        }
+      }
+    },
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::{YOUR-AWS-ACCOUNT-ID}:root"
+      },
+      "Action": [
+        "kms:Describe*",
+        "kms:Get*",
+        "kms:List*",
+        "kms:Put*"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+

data/lib/acmesmith/command.rb

@@ -34,17 +34,23 @@ module Acmesmith
 
       responder.respond(domain, challenge)
 
-      puts "=> Requesting verification..."
-      challenge.request_verification
-      loop do
-        status = challenge.verify_status
-        puts " * verify_status: #{status}"
-        break if status == 'valid'
-        sleep 3
+      begin
+        puts "=> Requesting verification..."
+        challenge.request_verification
+        loop do
+          status = challenge.verify_status
+          puts " * verify_status: #{status}"
+          break if status == 'valid'
+          if status == "invalid"
+            err = challenge.error
+            puts "#{err["type"]}: #{err["detail"]}"
+          end
+          sleep 3
+        end
+        puts "=> Done"
+      ensure
+        responder.cleanup(domain, challenge)
       end
-
-      responder.cleanup(domain, challenge)
-      puts "=> Done"
     end
 
     desc "request COMMON_NAME [SAN]", "request certificate for CN +COMMON_NAME+ with SANs +SAN+"
@@ -126,6 +132,28 @@ module Acmesmith
       end
     end
 
+    desc 'save-pkcs12 COMMON_NAME', 'Save ceriticate and private key to .p12 file'
+    method_option :version, type: :string, default: 'current'
+    method_option :output, type: :string, required: true, banner: 'PATH', desc: 'Path to output file'
+    method_option :mode, type: :string, default: '0600', desc: 'Mode (permission) of the output file on create'
+    def save_pkcs12(common_name)
+      cert = storage.get_certificate(common_name, version: options[:version])
+      cert.key_passphrase = certificate_key_passphrase if certificate_key_passphrase
+
+      print 'Passphrase: '
+      passphrase = $stdin.noecho { $stdin.gets }.chomp
+      print "\nPassphrase (confirm): "
+      passphrase2 = $stdin.noecho { $stdin.gets }.chomp
+      puts
+
+      raise ArgumentError, "Passphrase doesn't match" if passphrase != passphrase2
+
+      p12 = OpenSSL::PKCS12.create(passphrase, cert.common_name, cert.private_key, cert.certificate)
+      File.open(options[:output], 'w', options[:mode].to_i(8)) do |f|
+        f.puts p12.to_der
+      end
+    end
+
     desc "autorenew", "request renewal of certificates which expires soon"
     method_option :days, aliases: %w(-d), default: 7, desc: 'specify threshold in days to select certificates to renew'
     def autorenew

data/lib/acmesmith/version.rb

@@ -1,3 +1,3 @@
 module Acmesmith
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: acmesmith
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - sorah (Shota Fukumori)
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-24 00:00:00.000000000 Z
+date: 2016-06-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acme-client
@@ -117,6 +117,7 @@ files:
 - acmesmith.gemspec
 - bin/acmesmith
 - config.sample.yml
+- docs/vendor/aws.md
 - lib/acmesmith.rb
 - lib/acmesmith/account_key.rb
 - lib/acmesmith/certificate.rb
@@ -153,7 +154,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.6.4
 signing_key: 
 specification_version: 4
 summary: ACME client (Let's encrypt client) to manage certificate in multi server