certificate_authority 0.1.1

data/lib/certificate_authority/distinguished_name.rb

@@ -0,0 +1,39 @@
+module CertificateAuthority
+  class DistinguishedName
+    include ActiveModel::Validations
+    
+    validates_presence_of :common_name
+    
+    attr_accessor :common_name
+    alias :cn :common_name
+    
+    attr_accessor :locality
+    alias :l :locality
+    
+    attr_accessor :state
+    alias :s :state
+    
+    attr_accessor :country
+    alias :c :country
+    
+    attr_accessor :organization
+    alias :o :organization
+    
+    attr_accessor :organizational_unit
+    alias :ou :organizational_unit
+    
+    def to_x509_name
+      raise "Invalid Distinguished Name" unless valid?
+      
+      # NB: the capitalization in the strings counts
+      name = OpenSSL::X509::Name.new
+      name.add_entry("CN", common_name)
+      name.add_entry("O", organization) unless organization.blank?
+      name.add_entry("OU", common_name) unless organizational_unit.blank?
+      name.add_entry("S", common_name) unless state.blank?
+      name.add_entry("L", common_name) unless locality.blank?
+      
+      name
+    end
+  end
+end

data/lib/certificate_authority/extensions.rb

@@ -0,0 +1,251 @@
+module CertificateAuthority
+  module Extensions
+    module ExtensionAPI
+      def to_s
+        raise "Implementation required"
+      end
+      
+      def config_extensions
+        {}
+      end
+      
+      def openssl_identifier
+        raise "Implementation required"
+      end
+    end
+    
+    class BasicContraints
+      include ExtensionAPI
+      include ActiveModel::Validations
+      attr_accessor :ca
+      attr_accessor :path_len
+      validates :ca, :inclusion => [true,false]
+      
+      def initialize
+        self.ca = false
+      end
+      
+      def is_ca?
+        self.ca
+      end
+      
+      def path_len=(value)
+        raise "path_len must be a non-negative integer" if value < 0 or !value.is_a?(Fixnum)
+        @path_len = value
+      end
+      
+      def openssl_identifier
+        "basicConstraints"
+      end
+      
+      def to_s
+        result = ""
+        result += "CA:#{self.ca}"
+        result += ",pathlen:#{self.path_len}" unless self.path_len.nil?
+        result
+      end
+    end
+    
+    class CrlDistributionPoints
+      include ExtensionAPI
+      
+      attr_accessor :uri
+      
+      def initialize
+        self.uri = "http://moo.crlendPoint.example.com/something.crl"
+      end
+      
+      def openssl_identifier
+        "crlDistributionPoints"
+      end
+      
+      ## NB: At this time it seems OpenSSL's extension handlers don't support
+      ## any of the config options the docs claim to support... everything comes back
+      ## "missing value" on GENERAL NAME. Even if copied verbatim
+      def config_extensions
+        {
+          # "custom_crl_fields" => {"fullname" => "URI:#{fullname}"},
+          # "issuer_sect" => {"CN" => "crlissuer.com", "C" => "US", "O" => "shudder"}
+        }
+      end
+      
+      def to_s
+        "URI:#{self.uri}"
+      end
+    end
+    
+    class SubjectKeyIdentifier
+      include ExtensionAPI
+      def openssl_identifier
+        "subjectKeyIdentifier"
+      end
+      
+      def to_s
+        "hash"
+      end
+    end
+    
+    class AuthorityKeyIdentifier
+      include ExtensionAPI
+      
+      def openssl_identifier
+        "authorityKeyIdentifier"
+      end
+      
+      def to_s
+        "keyid,issuer"
+      end
+    end
+    
+    class AuthorityInfoAccess
+      include ExtensionAPI
+      
+      attr_accessor :ocsp
+      
+      def initialize
+        self.ocsp = []
+      end
+      
+      def openssl_identifier
+        "authorityInfoAccess"
+      end
+      
+      def to_s
+        "OCSP;URI:#{self.ocsp}"
+      end
+    end
+    
+    class KeyUsage
+      include ExtensionAPI
+      
+      attr_accessor :usage
+      
+      def initialize
+        self.usage = ["digitalSignature", "nonRepudiation"]
+      end
+      
+      def openssl_identifier
+        "keyUsage"
+      end
+      
+      def to_s
+        "#{self.usage.join(',')}"
+      end
+    end
+    
+    class ExtendedKeyUsage
+      include ExtensionAPI
+      
+      attr_accessor :usage
+      
+      def initialize
+        self.usage = ["serverAuth","clientAuth"]
+      end
+      
+      def openssl_identifier
+        "extendedKeyUsage"
+      end
+      
+      def to_s
+        "#{self.usage.join(',')}"
+      end
+    end
+    
+    class SubjectAlternativeName
+      include ExtensionAPI
+      
+      attr_accessor :uris
+      
+      def initialize
+        self.uris = []
+      end
+      
+      def uris=(value)
+        raise "URIs must be an array" unless value.is_a?(Array)
+        @uris = value
+      end
+      
+      def openssl_identifier
+        "subjectAltName"
+      end
+      
+      def to_s
+        if self.uris.empty?
+          return ""
+        end
+        "URI:#{self.uris.join(',URI:')}"
+      end
+    end
+    
+    class CertificatePolicies
+      include ExtensionAPI
+      
+      attr_accessor :policy_identifier
+      attr_accessor :cps_uris
+      ##User notice
+      attr_accessor :explicit_text
+      attr_accessor :organization
+      attr_accessor :notice_numbers
+      
+      def initialize
+        @contains_data = false
+      end
+      
+      
+      def openssl_identifier
+        "certificatePolicies"
+      end
+      
+      def user_notice=(value={})
+        value.keys.each do |key|
+          self.send("#{key}=".to_sym, value[key])
+        end
+      end
+      
+      def config_extensions
+        config_extension = {}
+        custom_policies = {}
+        notice = {}
+        unless self.policy_identifier.nil?
+          custom_policies["policyIdentifier"] = self.policy_identifier
+        end
+        
+        if !self.cps_uris.nil? and self.cps_uris.is_a?(Array)
+          self.cps_uris.each_with_index do |cps_uri,i|
+            custom_policies["CPS.#{i}"] = cps_uri
+          end
+        end
+        
+        unless self.explicit_text.nil?
+          notice["explicitText"] = self.explicit_text
+        end
+        
+        unless self.organization.nil?
+          notice["organization"] = self.organization
+        end
+        
+        unless self.notice_numbers.nil?
+          notice["noticeNumbers"] = self.notice_numbers
+        end
+        
+        if notice.keys.size > 0
+          custom_policies["userNotice.1"] = "@notice"
+          config_extension["notice"] = notice
+        end
+        
+        if custom_policies.keys.size > 0
+          config_extension["custom_policies"] = custom_policies
+          @contains_data = true
+        end
+        
+        config_extension
+      end
+      
+      def to_s
+        return "" unless @contains_data
+        "ia5org,@custom_policies"
+      end
+    end
+    
+  end
+end

data/lib/certificate_authority/key_material.rb

@@ -0,0 +1,62 @@
+module CertificateAuthority
+  module KeyMaterial
+    def public_key
+      raise "Required implementation"
+    end
+    
+    def private_key
+      raise "Required implementation"
+    end
+    
+    def is_in_hardware?
+      raise "Required implementation"
+    end
+    
+    def is_in_memory?
+      raise "Required implementation"
+    end
+  end
+  
+  class MemoryKeyMaterial
+    include KeyMaterial
+    include ActiveModel::Validations
+    
+    attr_accessor :keypair
+    attr_accessor :private_key
+    attr_accessor :public_key
+    
+    def initialize
+    end
+    
+    validates_each :private_key do |record, attr, value|
+        record.errors.add :private_key, "cannot be blank" if record.private_key.nil?
+    end
+    validates_each :public_key do |record, attr, value|
+      record.errors.add :public_key, "cannot be blank" if record.public_key.nil?
+    end
+        
+    def is_in_hardware?
+      false
+    end
+    
+    def is_in_memory?
+      true
+    end
+    
+    def generate_key(modulus_bits=1024)
+      self.keypair = OpenSSL::PKey::RSA.new(modulus_bits)
+      self.private_key = keypair
+      self.public_key = keypair.public_key
+      self.keypair
+    end
+    
+    def private_key
+      @private_key
+    end
+    
+    def public_key
+      @public_key
+    end
+    
+  end
+end

data/lib/certificate_authority/ocsp_handler.rb

@@ -0,0 +1,77 @@
+module CertificateAuthority
+  class OCSPHandler
+    include ActiveModel::Validations
+    
+    attr_accessor :ocsp_request
+    attr_accessor :certificate_ids
+    
+    attr_accessor :certificates
+    attr_accessor :parent
+    
+    attr_accessor :ocsp_response_body
+    
+    validate do |crl|
+      errors.add :parent, "A parent entity must be set" if parent.nil?
+    end
+    validate :all_certificates_available
+    
+    def initialize
+      self.certificates = {}
+    end
+    
+    def <<(cert)
+      self.certificates[cert.serial_number.number.to_s] = cert
+    end
+    
+    def extract_certificate_serials
+      raise "No valid OCSP request was supplied" if self.ocsp_request.nil?
+      openssl_request = OpenSSL::OCSP::Request.new(self.ocsp_request)
+      
+      self.certificate_ids = openssl_request.certid.collect do |cert_id|
+        cert_id.serial
+      end
+      
+      self.certificate_ids
+    end
+    
+    
+    def response
+      raise "Invalid response" unless valid?
+      
+      openssl_ocsp_response = OpenSSL::OCSP::BasicResponse.new
+      openssl_ocsp_request = OpenSSL::OCSP::Request.new(self.ocsp_request)
+      openssl_ocsp_response.copy_nonce(openssl_ocsp_request)
+      
+      openssl_ocsp_request.certid.each do |cert_id|
+        certificate = self.certificates[cert_id.serial.to_s]
+        
+        openssl_ocsp_response.add_status(cert_id, 
+        OpenSSL::OCSP::V_CERTSTATUS_GOOD, 0, 
+          0, 0, 30, nil)
+      end
+      
+      
+      openssl_ocsp_response.sign(OpenSSL::X509::Certificate.new(self.parent.to_pem), self.parent.key_material.private_key, nil, nil)
+      final_response = OpenSSL::OCSP::Response.create(OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, openssl_ocsp_response)
+      self.ocsp_response_body = final_response
+      self.ocsp_response_body
+    end
+    
+    def to_der
+      raise "No signed OCSP response body available" if self.ocsp_response_body.nil?
+      self.ocsp_response_body.to_der
+    end
+    
+    private
+    
+    def all_certificates_available
+      openssl_ocsp_request = OpenSSL::OCSP::Request.new(self.ocsp_request)
+      
+      openssl_ocsp_request.certid.each do |cert_id|
+        certificate = self.certificates[cert_id.serial.to_s]
+        errors.add(:base, "Certificate #{cert_id.serial} has not been added yet") if certificate.nil?
+      end
+    end
+    
+  end
+end

data/lib/certificate_authority/pkcs11_key_material.rb

@@ -0,0 +1,65 @@
+module CertificateAuthority
+  class Pkcs11KeyMaterial
+    include KeyMaterial
+    include ActiveModel::Validations
+    include ActiveModel::Serialization
+    
+    attr_accessor :engine
+    attr_accessor :token_id
+    attr_accessor :pkcs11_lib
+    attr_accessor :openssl_pkcs11_engine_lib
+    attr_accessor :pin
+    
+    def initialize(attributes = {})
+      @attributes = attributes
+      initialize_engine
+    end
+        
+    def is_in_hardware?
+      true
+    end
+    
+    def is_in_memory?
+      false
+    end
+    
+    def generate_key(modulus_bits=1024)
+      puts "Key generation is not currently supported in hardware"
+      nil
+    end
+    
+    def private_key
+      initialize_engine
+      self.engine.load_private_key(self.token_id)
+    end
+    
+    def public_key
+      initialize_engine
+      self.engine.load_public_key(self.token_id)
+    end
+    
+    private
+    
+    def initialize_engine
+      ## We're going to return early and try again later if params weren't passed in
+      ## at initialization.  Any attempt at getting a public/private key will try
+      ## again.
+      return false if self.openssl_pkcs11_engine_lib.nil? or self.pkcs11_lib.nil?
+      return self.engine unless self.engine.nil?
+      OpenSSL::Engine.load
+      
+      pkcs11 = OpenSSL::Engine.by_id("dynamic") do |e|
+        e.ctrl_cmd("SO_PATH",self.openssl_pkcs11_engine_lib)
+        e.ctrl_cmd("ID","pkcs11")
+        e.ctrl_cmd("LIST_ADD","1")
+        e.ctrl_cmd("LOAD")
+        e.ctrl_cmd("PIN",self.pin) unless self.pin.nil? or self.pin == ""
+        e.ctrl_cmd("MODULE_PATH",self.pkcs11_lib)
+      end
+      
+      self.engine = pkcs11
+      pkcs11
+    end
+    
+  end
+end