bullion 0.11.1 → 0.11.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8821e563a9452dbd524f1bdfbd2f944ee4a3d0c071e57bab6d5f9b2c61e18555
-  data.tar.gz: d31913ae560676de68a57ea6aa308126a6d3c92c7a3da69d4d882e032ed56196
+  metadata.gz: f1e03e0297625063a198db254192ac85e7389a46bd1ebd0be1161f1221300e4d
+  data.tar.gz: 2c5a0729d0521920a378fa235f928b6c7eb4c16cd3ee9a63bf74fa89eca7168c
 SHA512:
-  metadata.gz: 4bcabcb78421e92a48fbd5485631de98bee3bf0d4452ba5d9c08eb04d34ac171934b073e0a441b5dc95aeeb353765a5445188ca7011b98d3e2f376d130aaf2d4
-  data.tar.gz: 5541be539b018f62d1e466e51ada7985f5e37ee460eb98c4e344f79c443aa60fa3f8b2bf1d26d169a15c0b8efef38c7523c4023a416436e85654b585a5fcae6c
+  metadata.gz: 06e5aa78438a991e3e2cf9db8519a2c81bb35c3b872f1fc511ca7ea6d397088e3fce4642631d3dd7d77e9105e9fb4b808dfdc2b185fc121d3deebf8f3614e0d2
+  data.tar.gz: e3809f863bd43ff203a580b65a36e6d1f8f088cf12b1650ab7057cca3220019db00bfb231f7d85bbce983600d6488cd75f2748d3c164692c41646bbc9166c043

data/.ruby-version

@@ -1 +1 @@
-3.4.4
+3.4.10

data/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.11.5](https://github.com/jgnagy/bullion/compare/bullion/v0.11.4...bullion/v0.11.5) (2026-09-21)
+
+
+### Bug Fixes
+
+* **ci:** disable gem attestations to unblock release ([d850693](https://github.com/jgnagy/bullion/commit/d850693bc3ca6c58b15471cea773f0c58df1b0b1))
+* **ci:** disable gem attestations to unblock release ([5bd3675](https://github.com/jgnagy/bullion/commit/5bd367593fc1bc4af1c71f27d2ed4bedbff2ad5c))
+
+## [0.11.4](https://github.com/jgnagy/bullion/compare/bullion/v0.11.3...bullion/v0.11.4) (2026-09-21)
+
+
+### Bug Fixes
+
+* package gem files without relying on git metadata ([ef70f0a](https://github.com/jgnagy/bullion/commit/ef70f0a42285aab8ae8bde1f8f0063e6a0ad38cb))
+* package gem files without relying on git metadata ([8515841](https://github.com/jgnagy/bullion/commit/851584156440fef014503a9b3320049554a9083e))
+
+## [0.11.3](https://github.com/jgnagy/bullion/compare/bullion/v0.11.2...bullion/v0.11.3) (2026-07-16)
+
+
+### Features
+
+* implement revokeCert endpoint (closes [#1](https://github.com/jgnagy/bullion/issues/1)) ([#107](https://github.com/jgnagy/bullion/issues/107)) ([b08c65a](https://github.com/jgnagy/bullion/commit/b08c65a7cbb62abef34d7a24fe7f89124fae4743))
+
+
+### Bug Fixes
+
+* replace undefined CERT_VALIDITY_DURATION constant with config call ([f858418](https://github.com/jgnagy/bullion/commit/f85841818f6d3511e436c010af86715433c57922))
+* replace undefined CERT_VALIDITY_DURATION constant with config call ([8dc0ed0](https://github.com/jgnagy/bullion/commit/8dc0ed0dabdca4d50f720e22ce7d6825233042bb)), closes [#101](https://github.com/jgnagy/bullion/issues/101)
+
+## [0.11.2](https://github.com/jgnagy/bullion/compare/bullion/v0.11.1...bullion/v0.11.2) (2026-02-16)
+
+
+### Features
+
+* add EdDSA (Ed25519) JWT signature support ([bba2985](https://github.com/jgnagy/bullion/commit/bba29851e1c5644152f4a3e82d82c6c1d5c5ce5e))
+* add EdDSA (Ed25519) JWT signature support ([77a2f5b](https://github.com/jgnagy/bullion/commit/77a2f5bfc30db3527ad3fe75136b210956279957)), closes [#3](https://github.com/jgnagy/bullion/issues/3)
+* Add test coverage for Ed25519 certificate signing ([59f0f74](https://github.com/jgnagy/bullion/commit/59f0f74a039292a5d804c8e49a880f20ab5d0c1b))
+
+
+### Bug Fixes
+
+* return proper badPublicKey error for Ed448 ([a21414f](https://github.com/jgnagy/bullion/commit/a21414f66075d47e2b5613d2034fa806a0a78602))
+
 ## [0.11.1](https://github.com/jgnagy/bullion/compare/bullion/v0.11.0...bullion/v0.11.1) (2025-08-24)
 
 

data/README.md

@@ -4,7 +4,7 @@
 
 Bullion is an [ACMEv2](https://tools.ietf.org/html/rfc8555)-compatible Certificate Authority (just like [Let's Encrypt](https://letsencrypt.org/)). Bullion makes it easy to leverage open standards for provisioning certificates for internal sites and services. Things like [cert-manager](https://cert-manager.io/), [certbot](https://certbot.eff.org/), and many other technologies work great with Let's Encrypt for _external_ hostnames, but for private domains and servers that aren't Internet accessible, there are few easy options.
 
-Bullion installs easily (both as a ruby gem or a Docker image) and will shortly come with Kubernetes examples and even a helm chart to make installing it that much easier. For its data, Bullion works with either [SQLite3](https://sqlite.org/index.html) for very small sites (where HA and high-throughput isn't a concern) or with [MariaDB](https://mariadb.org/)/[MySQL](https://www.mysql.com/).
+Bullion installs easily (both as a ruby gem or a Docker image) and works with either [SQLite3](https://sqlite.org/index.html) for very small sites (where HA and high-throughput isn't a concern) or with [MariaDB](https://mariadb.org/)/[MySQL](https://www.mysql.com/) for production deployments.
 
 The goal of the Bullion project is to make running a scalable, internal ACMEv2 CA easy. Either make a custom root CA certificate or give Bullion a signed intermediary to use in simple, compatible PEM format and you're up and running.
 
@@ -20,9 +20,133 @@ The goal of the Bullion project is to make running a scalable, internal ACMEv2 C
 
 ## Usage
 
-### Running
+### Prerequisites
 
-TODO: Write instructions for starting Bullion
+Before running Bullion, you need a CA key pair. Bullion requires two PEM files:
+
+- **`tls.key`** — An encrypted private key (RSA, ECDSA, or EdDSA) for signing certificates. Bullion supports encrypted PEM keys using AES-128-CBC.
+- **`tls.crt`** — The corresponding public certificate. If Bullion is an intermediate CA, include the root CA's certificate in this file as well (certificate chain order: intermediate first, then root).
+
+You can generate these with OpenSSL. For example, a self-signed root CA:
+
+```bash
+# Generate an encrypted RSA private key
+openssl genrsa -aes128 -out tls.key 4096
+
+# Create a self-signed root certificate (5 years)
+openssl req -x509 -new -key tls.key -sha256 -days 1825 \
+  -out tls.crt -subj "/DC=example/DC=com/CN=Bullion Root CA"
+```
+
+For production, you'll typically want an intermediate CA signed by your organization's root CA. Provide the intermediate certificate and its private key to Bullion, and include the root CA certificate in `tls.crt` so clients receive the full chain.
+
+### Running with Docker
+
+The quickest way to run Bullion is with the official Docker image:
+
+```bash
+docker run -d \
+  --name bullion \
+  -p 9292:9292 \
+  -v /path/to/ssl:/ssl:ro \
+  -v /path/to/data:/data \
+  -e CA_DIR=/ssl \
+  -e CA_SECRET=your-key-password \
+  -e CA_DOMAINS=example.com \
+  -e DATABASE_URL=sqlite3:/data/bullion.db \
+  jgnagy/bullion:latest
+```
+
+This starts Bullion on port 9292 with:
+
+- CA key pair mounted from `/path/to/ssl` (containing `tls.key` and `tls.crt`)
+- SQLite database persisted at `/path/to/data/bullion.db`
+- Certificate signing restricted to `example.com` and its subdomains
+
+Verify it's running:
+
+```bash
+curl http://localhost:9292/ping
+# {"status":"up"}
+```
+
+For MySQL/MariaDB, use a `trilogy://` connection URL instead:
+
+```bash
+-e DATABASE_URL=trilogy://user:password@mariadb:3306/bullion
+```
+
+### Running as a Gem
+
+Install the gem:
+
+```bash
+gem install bullion
+```
+
+Bullion is a Rack application served by [Itsi](https://itsi.fyi/). After installing the gem, you'll need a `config.ru` and an `Itsi.rb` configuration file. The simplest approach is to create a working directory with your CA key pair and a minimal Rack config:
+
+```bash
+mkdir bullion-server && cd bullion-server
+
+# Place your CA key pair here
+cp /path/to/tls.key .
+cp /path/to/tls.crt
+
+# Create a minimal config.ru
+cat > config.ru <<'RUBY'
+# frozen_string_literal: true
+
+require "bullion"
+Bullion.validate_config!
+
+require "prometheus/middleware/collector"
+require "prometheus/middleware/exporter"
+
+use Rack::ShowExceptions
+use Rack::Deflater
+use Prometheus::Middleware::Collector
+use Prometheus::Middleware::Exporter
+
+mappings = {
+  "/ping" => Bullion::Services::Ping.new,
+  "/acme" => Bullion::Services::CA.new
+}
+
+run Rack::URLMap.new(mappings)
+RUBY
+
+# Initialize Itsi and run database migrations
+itsi init
+DATABASE_URL=sqlite3:./bullion.db bullion-exec rake db:migrate
+
+# Start the server
+CA_DIR=. CA_SECRET=your-key-password CA_DOMAINS=example.com \
+  DATABASE_URL=sqlite3:./bullion.db itsi
+```
+
+### Database Setup
+
+Bullion uses ActiveRecord migrations to create its schema. The migrations are included with the gem. Run them before starting the server:
+
+```bash
+DATABASE_URL=sqlite3:./bullion.db bundle exec rake db:migrate
+```
+
+When using Docker, the included entrypoint handles this automatically on first start. If you're running the gem directly, you may need to run migrations manually after installing the gem.
+
+### Quick Local Demo
+
+For testing or evaluation, the Rakefile includes a `local_demo` task that generates a temporary CA key pair, runs migrations, and starts the server in the foreground:
+
+```bash
+git clone https://github.com/jgnagy/bullion.git
+cd bullion
+bundle install
+bundle exec rake local_demo
+```
+
+This creates a self-signed root CA and intermediate certificate in `tmp/`, uses an SQLite database in `tmp/db/`, and starts Bullion on port 9292. Press `Ctrl+C` to stop.
 
 ### Configuration Options
 
@@ -57,20 +181,10 @@ Bullion provides a `/ping` endpoint that should respond with `{ 'status': 'up' }
 
 Prometheus metrics are also scrapable at `/metrics`. This includes typical web request information as well as latencies related to the different Challenge types.
 
-## Development
+## Development & Contributing
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
-
-To install this gem onto your local machine, run `bundle exec rake install`.
-
-## Contributing
-
-Bug reports and pull requests are welcome on GitHub at https://github.com/jgnagy/bullion. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for development setup, testing, style guidelines, and pull request expectations. Guidelines for AI agents and automated tools are in [`AGENTS.md`](AGENTS.md).
 
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
-
-## Code of Conduct
-
-Everyone interacting in the Bullion project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/jgnagy/bullion/blob/master/CODE_OF_CONDUCT.md).

data/db/migrate/20260716000000_add_revocation_to_certificates.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# Adds revocation tracking columns to the certificates table
+class AddRevocationToCertificates < ActiveRecord::Migration[8.0]
+  def change
+    add_column :certificates, :revoked, :boolean, default: false, null: false
+    add_column :certificates, :revoked_at, :datetime
+    add_column :certificates, :revocation_reason, :integer
+  end
+end

data/db/schema.rb

@@ -10,24 +10,24 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
+ActiveRecord::Schema[8.1].define(version: 2025_08_23_073342) do
   create_table "accounts", force: :cascade do |t|
-    t.boolean "tos_agreed", default: true, null: false
-    t.text "public_key", null: false
     t.text "contacts", null: false
     t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.text "public_key", null: false
     t.string "public_key_hash", limit: 44, null: false
+    t.boolean "tos_agreed", default: true, null: false
+    t.datetime "updated_at", null: false
     t.index ["public_key_hash"], name: "index_accounts_on_public_key_hash", unique: true
     t.index ["tos_agreed"], name: "index_accounts_on_tos_agreed"
   end
 
   create_table "authorizations", force: :cascade do |t|
-    t.string "status", default: "pending", null: false
+    t.datetime "created_at", null: false
     t.datetime "expires", null: false
     t.text "identifier", null: false
     t.bigint "order_id"
-    t.datetime "created_at", null: false
+    t.string "status", default: "pending", null: false
     t.datetime "updated_at", null: false
     t.index ["expires"], name: "index_authorizations_on_expires"
     t.index ["order_id"], name: "index_authorizations_on_order_id"
@@ -35,15 +35,15 @@ ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
   end
 
   create_table "certificates", force: :cascade do |t|
-    t.string "subject", null: false
+    t.text "alternate_names"
+    t.datetime "created_at", null: false
     t.string "csr_fingerprint", null: false
     t.text "data", null: false
-    t.text "alternate_names"
     t.string "requester"
-    t.boolean "validated", default: false, null: false
     t.bigint "serial", null: false
-    t.datetime "created_at", null: false
+    t.string "subject", null: false
     t.datetime "updated_at", null: false
+    t.boolean "validated", default: false, null: false
     t.index ["csr_fingerprint"], name: "index_certificates_on_csr_fingerprint"
     t.index ["serial"], name: "index_certificates_on_serial", unique: true
     t.index ["subject"], name: "index_certificates_on_subject"
@@ -52,13 +52,13 @@ ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
 
   create_table "challenges", force: :cascade do |t|
     t.string "acme_type", null: false
-    t.string "status", default: "pending", null: false
-    t.datetime "expires", null: false
-    t.string "token", null: false
-    t.datetime "validated"
     t.bigint "authorization_id"
     t.datetime "created_at", null: false
+    t.datetime "expires", null: false
+    t.string "status", default: "pending", null: false
+    t.string "token", null: false
     t.datetime "updated_at", null: false
+    t.datetime "validated"
     t.index ["acme_type"], name: "index_challenges_on_acme_type"
     t.index ["authorization_id"], name: "index_challenges_on_authorization_id"
     t.index ["expires"], name: "index_challenges_on_expires"
@@ -66,21 +66,21 @@ ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
   end
 
   create_table "nonces", force: :cascade do |t|
-    t.string "token", null: false
     t.datetime "created_at", null: false
+    t.string "token", null: false
     t.datetime "updated_at", null: false
     t.index ["token"], name: "index_nonces_on_token", unique: true
   end
 
   create_table "orders", force: :cascade do |t|
-    t.string "status", default: "pending", null: false
+    t.bigint "account_id"
+    t.bigint "certificate_id"
+    t.datetime "created_at", null: false
     t.datetime "expires", null: false
     t.text "identifiers", null: false
-    t.datetime "not_before", null: false
     t.datetime "not_after", null: false
-    t.bigint "certificate_id"
-    t.bigint "account_id"
-    t.datetime "created_at", null: false
+    t.datetime "not_before", null: false
+    t.string "status", default: "pending", null: false
     t.datetime "updated_at", null: false
     t.index ["account_id"], name: "index_orders_on_account_id"
     t.index ["certificate_id"], name: "index_orders_on_certificate_id"

data/lib/bullion/acme/error.rb

@@ -34,6 +34,21 @@ module Bullion
         def acme_type = "badNonce"
       end
 
+      # ACME exception for bad/unsupported public keys
+      class BadPublicKey < Bullion::Acme::Error
+        def acme_type = "badPublicKey"
+      end
+
+      # ACME exception for bad certificates
+      class BadCertificate < Bullion::Acme::Error
+        def acme_type = "badCertificate"
+      end
+
+      # ACME exception for already-revoked certificates
+      class AlreadyRevoked < Bullion::Acme::Error
+        def acme_type = "alreadyRevoked"
+      end
+
       # ACME exception for invalid contacts in accounts
       class InvalidContact < Bullion::Acme::Error
         def acme_type = "invalidContact"

data/lib/bullion/helpers/acme.rb

@@ -41,10 +41,11 @@ module Bullion
           JWT.decode(jwt_data, compat_public_key, true, { algorithm: @header_data["alg"] })
         else
           digest = digest_from_alg(@header_data["alg"])
+          alg = @header_data["alg"].downcase
 
-          sig = if @header_data["alg"].downcase.start_with?("es")
+          sig = if alg.start_with?("es")
                   ecdsa_sig_to_der(signature)
-                elsif @header_data["alg"].downcase.start_with?("rs")
+                elsif alg.start_with?("rs") || alg == "eddsa"
                   Base64.urlsafe_decode64(signature)
                 end
 
@@ -173,7 +174,7 @@ module Bullion
         # don't allow nonsense certs
         raise Bullion::Acme::Errors::InvalidOrder unless nb < na
         # don't allow far-future certs
-        if nb > Time.now + (7 * 86_400) || na > Time.now + CERT_VALIDITY_DURATION
+        if nb > Time.now + (7 * 86_400) || na > Time.now + Bullion.config.ca.cert_validity_duration
           raise Bullion::Acme::Errors::InvalidOrder
         end
 

data/lib/bullion/helpers/ssl.rb

@@ -3,6 +3,7 @@
 module Bullion
   module Helpers
     # SSL-related helper methods
+    # rubocop:disable Metrics/ModuleLength
     module Ssl
       # Converts the incoming key data to an OpenSSL public key usable to verify JWT signatures
       def openssl_compat(key_data)
@@ -11,6 +12,8 @@ module Bullion
           key_data_to_rsa(key_data)
         when "EC"
           key_data_to_ecdsa(key_data)
+        when "OKP"
+          key_data_to_eddsa(key_data)
         end
       end
 
@@ -58,6 +61,24 @@ module Bullion
         OpenSSL::PKey::EC.new(outer_sequence.to_der)
       end
 
+      def key_data_to_eddsa(key_data)
+        curve = key_data["crv"]
+        x = base64_to_octet(key_data["x"])
+
+        # For JWT verification with jwt-eddsa gem, we need Ed25519::VerifyKey
+        case curve
+        when "Ed25519"
+          # The raw public key bytes are exactly what Ed25519::VerifyKey expects
+          Ed25519::VerifyKey.new(x)
+        when "Ed448"
+          # Ed448 not currently supported by the ed25519 gem
+          raise Bullion::Acme::Errors::BadPublicKey,
+                "EdDSA with Ed448 is not supported; only Ed25519 is supported"
+        else
+          raise Bullion::Acme::Errors::BadPublicKey, "Unsupported EdDSA curve: #{curve}"
+        end
+      end
+
       def base64_to_long(data)
         Base64.urlsafe_decode64(data).to_s.unpack("C*").map do |byte|
           to_hex(byte)
@@ -69,6 +90,9 @@ module Bullion
       end
 
       def digest_from_alg(alg)
+        # EdDSA doesn't use a separate digest step
+        return nil if alg.downcase == "eddsa"
+
         if alg.end_with?("256")
           OpenSSL::Digest.new("SHA256")
         elsif alg.end_with?("384")
@@ -231,5 +255,6 @@ module Bullion
       end
       # rubocop:enable Metrics/AbcSize
     end
+    # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/bullion/models/certificate.rb

@@ -24,6 +24,11 @@ module Bullion
         subject.split("/").grep(/^CN=/).first.split("=").last
       end
 
+      # Returns true if the certificate has been revoked
+      def revoked?
+        revoked == true
+      end
+
       def self.from_csr(csr)
         subjt = csr.subject if csr.subject && !csr.subject.to_s.empty?
 

data/lib/bullion/models/challenge.rb

@@ -50,7 +50,17 @@ module Bullion
 
       def lexicographically_ordered_public_key
         jwk = authorization.order.account.public_key
-        [["e", jwk["e"]], ["kty", jwk["kty"]], ["n", jwk["n"]]].to_h
+        case jwk["kty"]
+        when "RSA"
+          [["e", jwk["e"]], ["kty", jwk["kty"]], ["n", jwk["n"]]].to_h
+        when "EC"
+          [["crv", jwk["crv"]], ["kty", jwk["kty"]], ["x", jwk["x"]], ["y", jwk["y"]]].to_h
+        when "OKP"
+          [["crv", jwk["crv"]], ["kty", jwk["kty"]], ["x", jwk["x"]]].to_h
+        else
+          # Fallback for unknown types
+          jwk.sort.to_h
+        end
       end
     end
   end

data/lib/bullion/service.rb

@@ -8,6 +8,7 @@ module Bullion
 
     configure do
       set :protection, except: :http_origin
+      set :host_authorization, permitted_hosts: []
       set :logging, true
       set :logger, Bullion::LOGGER
       set :database, Bullion.config.db_url

data/lib/bullion/services/ca.rb

@@ -66,6 +66,10 @@ module Bullion
         halt 200
       end
 
+      options "/revokecert" do
+        halt 200
+      end
+
       # Non-standard endpoint that returns the CA bundle for Bullion
       # Trusting this bundle should be sufficient to trust all Bullion-issued certs
       options "/cabundle" do
@@ -384,6 +388,44 @@ module Bullion
           halt(422, { error: "Order not valid" }.to_json)
         end
       end
+
+      # Revokes a certificate
+      # @see https://tools.ietf.org/html/rfc8555#section-7.6
+      post "/revokecert" do
+        parse_acme_jwt
+        add_acme_headers @new_nonce
+
+        # The certificate is base64url-encoded DER
+        cert_der = Base64.urlsafe_decode64(@payload_data["certificate"])
+        cert = OpenSSL::X509::Certificate.new(cert_der)
+
+        # Find the certificate in the database by matching the PEM data
+        record = Models::Certificate.find_by(serial: cert.serial.to_i)
+
+        unless record
+          content_type "application/problem+json"
+          halt 400, {
+            type: Bullion::Acme::Errors::BadCertificate.new.acme_error,
+            detail: "Certificate not found"
+          }.to_json
+        end
+
+        if record.revoked?
+          content_type "application/problem+json"
+          halt 400, {
+            type: Bullion::Acme::Errors::AlreadyRevoked.new.acme_error,
+            detail: "Certificate has already been revoked"
+          }.to_json
+        end
+
+        reason = @payload_data["reason"]
+        record.update!(revoked: true, revoked_at: Time.now, revocation_reason: reason)
+
+        halt 200
+      rescue Bullion::Acme::Error => e
+        content_type "application/problem+json"
+        halt 400, { type: e.acme_error, detail: e.message }.to_json
+      end
     end
   end
 end

data/lib/bullion/services/ping.rb

@@ -5,6 +5,7 @@ module Bullion
     # Healthcheck service
     class Ping < Sinatra::Application
       configure do
+        set :host_authorization, permitted_hosts: []
         set :logging, true
         set :logger, Bullion::LOGGER
       end

data/lib/bullion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullion
-  VERSION = "0.11.1"
+  VERSION = "0.11.5"
 end

data/lib/bullion.rb

@@ -18,6 +18,8 @@ require "sinatra/custom_logger"
 require "trilogy"
 require "sinatra/activerecord"
 require "jwt"
+require "jwt/eddsa"
+require "ed25519"
 require "prometheus/client"
 require "httparty"
 
@@ -105,11 +107,11 @@ module Bullion
       raise ConfigError,
             "Invalid Cert Path: #{config.ca.cert_path}"
     end
-    if 60 * 60 * 24 * 397 < config.ca.cert_validity_duration
+    if config.ca.cert_validity_duration > 60 * 60 * 24 * 397
       raise ConfigError,
             "Cert Validity Too Long"
     end
-    if 60 * 60 * 24 * 2 > config.ca.cert_validity_duration
+    if config.ca.cert_validity_duration < 60 * 60 * 24 * 2
       raise ConfigError,
             "Cert Validity Too Short"
     end