certmeister 2.2.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 799bbad30dae1a1c0f05c7e3ba59dc4b3cc47467
-  data.tar.gz: 447321524cd2661a7f439d5c19fa056efbc699b5
+  metadata.gz: 91d17da8b132ec96406859d320cf1054d92e5023
+  data.tar.gz: b7e3ca7db11270296498eb364c9ed4c5a9d201ad
 SHA512:
-  metadata.gz: c98b95cad7ff3960438ac4e8f1a4c73d5458f6774a3743a77694f85fbae21ba39be424176961276b243f7c51d703d4bf5c5cb646f3a515881eb5d7c631db1036
-  data.tar.gz: bd53076b8e6b89f3ea3bcc493a5565698aa399e36cac58aa534e7d777f0f3a7071d99b5ff7e4c5dd2a490348ea973390a524928df420abc9a245da0af1044bf6
+  metadata.gz: d5f5509b6e7792ebebf8eec73ea1b5b8da307c4aa8b1c384287dceff34e5b0794a148e93007d378efa1d2369c4caffebe009bdc1aaac4c0b0e756ff5c2cc598d
+  data.tar.gz: f14101564b1038b63f3509ea14487d4bc157f8c1df35c03cf941f125fdf93f4fcd9e7edaebbaa4d678ee4c268ab5d44455578e6fc8c66fbd8633640c04a09d76

data/.gitignore

@@ -13,7 +13,7 @@ spec/reports
 test/tmp
 test/version_tmp
 tmp
-contrib/Gemfile.lock
+Gemfile.lock
 
 # YARD artifacts
 .yardoc

data/SignatureAlgorithm.txt

@@ -0,0 +1,28 @@
+Feature: Signature algorithm policy
+
+	As the operator of a conditionally autosigning certification authority
+	When deciding whether to sign a certificate
+	I want to reject certificate signing requests with weak signature algorithms
+	In order to enforce the use of strong cryptography across our network.
+
+Desired rspec output:
+
+	Certmeister::Policy::SignatureAlgorithm
+	  may be configured with a set of strong signature algorithms
+	  defaults to ["sha256"] as the set of strong signature algorithms
+	  demands a request
+	  refuses to authenticate a request with a missing pem
+	  refuses to authenticate an invalid pem
+	  refuses to authenticate a request with a weak signature algorithm
+	  authenticates a request with a strong signature algorithm
+
+Use spec/certmeister/policy/key_bits_spec.rb as a guide to specifying the behaviour.
+
+Use lib/certmeister/policy/key_bits.rb as a guide to implementing the behaviour.
+
+You may find these fixtures useful:
+
+	fixtures/sha1_4096bit.csr
+	fixtures/sha256_4096bit.csr
+
+The signature algorithm of a CSR is provided by the OpenSSL::X509::Request#signature_algorithm method.

data/certmeister.gemspec

@@ -23,6 +23,6 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_development_dependency "bundler", "~> 1.5"
-  spec.add_development_dependency "rake", "~> 10.4.2"
+  spec.add_development_dependency "rake", "~> 10.4"
   spec.add_development_dependency "rspec", "~> 3.1"
 end

data/fixtures/ecdsa.csr

@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBZzCB7gIBADBvMQswCQYDVQQGEwJaQTEVMBMGA1UECAwMV2VzdGVybiBDYXBl
+MRIwEAYDVQQHDAlDYXBlIFRvd24xGDAWBgNVBAoMD0hldHpuZXIgUFRZIEx0ZDEb
+MBkGA1UEAwwSYXhsLmhldHpuZXIuYWZyaWNhMHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEKxZhR5/G3bds3LOkA1dL88O0zyyk6zMlQ2KTf6Cl/rE6cCLAq3vI53cM4FDc
+DHCq8ZQwt+e6GUC/CXizCEx9sNg2Sdx1YvpPhMhNyAYd0WjTenAkUmpG+Mdx1q+m
+5OMfoAAwCgYIKoZIzj0EAwMDaAAwZQIxAPxLD6+F1Eu2onDYfyguJ1DOz600NBJ5
+IoY0PgsMYDtu+sJn+7XmjBsw4WYhJHwb+QIwWxt2M0uJP/+BexmH4eOufc9Iw/bk
+PArUpgT3hwfJS8lUB/D9PN0K95BU6AvzG/iG
+-----END CERTIFICATE REQUEST-----

data/fixtures/sha1_1024bit.csr

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBrzCCARgCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
+ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
+GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEA0SMKeQYOacF+wQ4GfsyEf8r5PdBW51MHf9kJS0TU0jfHxP4y6epA
+HPxsZUSNLsGuHCKar4oXiEjKePsMpRBcuIF8MQyernrFwFFuT5PigHlwiqvcAGZj
+pOsR2zg0sOHRDyaYwnOtA1PtMHpcy0V4g7p06t1bRrP3KfeAUD/+VPMCAwEAAaAA
+MA0GCSqGSIb3DQEBBQUAA4GBAMyBS386mKoS9DkyK2x37sxmFTqrzZrW1HOAbUz3
+mAWIF6w29ddtjiPijjPO/uM9C3L3/AuxttYRwNqQ8K7js1O6y1ZO8eWOPgGLUo77
+AIznjobOrZGRn4rvLgY1pE+xuQx6S5YeC3SMcIXogL+58Pzwg7SQtFQwB45ErDWW
+eNnz
+-----END CERTIFICATE REQUEST-----

data/fixtures/sha1_4096bit.csr

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIEtDCCApwCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
+ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
+GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAPAQvQSgOxZuxZV++QDINS2i0L7KDW84WZOPHGzdtGbUaQl4
+3LpltYOFR3eSySq0iCaE9dIp7c+H4MtLSiKH82Nfbk9qdiwSKfAk6J9I/iTudRO8
+M2HQUNO2M9cyg3E8Ivu/GC1AXbTV9wBgdBwZwLyS1JMYofuizeEaB/yz1pDdko2e
+shgXDbDz0rjA32m0LvY9mNERn7s5Ad/p46WC1UvWWYBAHClCk1dC2R+mA8fO7z++
+oRiTlgMkW+bwVI8NsNXqSULJAd6rL65pn5FHGAnodr4BWPNl8fh/kKl3O02M08Th
+ATRwnU3n1nKaEAgHxYRKq8IbwtosUBkJlzSu8NLII/T6G8KQWad2xmqf5SZCGoOt
+/sCUiPSlaPoN2jCfgsZyidZy/LGlrwMFIVUjvEjCtCsxVIpFcfNbFB1oOSH2uhcj
+bbitrUwbcuv4e0495j30d7ajgfcwMyzRZoCMCzxpEsnPI5Ld7rUyAh6uBprnDP30
+ZjIxp7vumTWhaYSxCdOBRCPDKvUR3xNugD/HBC202bbvkNIHq0RVCRud9Hi6qxJs
+JLseE696ee3gKzYAU3z96rN16/DAxYjq9dy1upEa3sGM3UwYVHR9kjSHF2yrY17A
+gqh13rOLmB3QKdBjAjf6PGA+AnMIlSbFHIra7QjKfbRwCv5ZfoFU/kMjhQg7AgMB
+AAGgADANBgkqhkiG9w0BAQUFAAOCAgEA4GeMExrX4kNhzqgXR1+q9Wp/izDHHC6a
+xTkVEHPfT8+jsd9bfwF3HPZB3VhGzsic6dUiQAcRxUC6Yv6CI/Z67lyJNyxiaeKf
+9RH3NNm6paNPtRK0TW33nTpTuYDtHqgCInvZt1JfXXoP6t0uqqj6WgM/o57D16JN
+BWFf2E6MZGt0WJs+aUff+R7y5ZJA9XHs2ZWvU/TYR+YjJ8kTzbw2+QKdbTJzQjcw
+4YBWtj9nBwvWwIOQkzIWokRS8h5PgR4EIevkkFjbq6zU+ue1IzTEAD8G6a2YTzrW
+qqwDlB4YtaQsGhEn600lrl33IGqpEABB32l8oKQtlJVxlZ8TcIVRkXLVXps1skIU
+f7HeVN8OlgD85rhCoikTXGvBQXiFww1y/2CT8sfX7w3Z8F/0kPHavdo/goe5316f
+l0jwJbpO5dNpL/kPxLxjJjXx6s0Ky8ZCKrk7vYpBhlLgCTCl9cLCfac4xD6kcANn
+68PNJ03jn0nVzds7gs3ad8v8T85l7lypQf77fd2Zci7MXtJ3NA59/51a+1jXEf/0
+vJAB1ktx31CKWip8c7iBErI+oV8T8Y8kGBsmGl2Ey/iqFz0xo7CqV7Lt/glzNg+w
+Rir40w7f5XAZIIEtONHnrqJEfNGa+KesQe776YlwzUQ30/kar1peD5vsMgwS14V1
+kr0+IF2eEro=
+-----END CERTIFICATE REQUEST-----

data/fixtures/sha256_1024bit.csr

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBrzCCARgCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
+ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
+GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEA0SMKeQYOacF+wQ4GfsyEf8r5PdBW51MHf9kJS0TU0jfHxP4y6epA
+HPxsZUSNLsGuHCKar4oXiEjKePsMpRBcuIF8MQyernrFwFFuT5PigHlwiqvcAGZj
+pOsR2zg0sOHRDyaYwnOtA1PtMHpcy0V4g7p06t1bRrP3KfeAUD/+VPMCAwEAAaAA
+MA0GCSqGSIb3DQEBCwUAA4GBAIHXr0IMku2vkQtgqYCdkfpba0SG2lDLrXX47Oec
+bVy2s97y7ujJdAQgH7jExvYMsIa1sVOTG1kCczmLuMb8A8PowmJ4QQi35aE9O36f
+1WaaG89HOepP4WkkiPYX8W62f43vYY2psmOtsJ3XrkZUMPE69QgzILqNC+hU6rnG
+uToc
+-----END CERTIFICATE REQUEST-----

data/fixtures/sha256_4096bit.csr

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIEtDCCApwCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
+ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
+GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAPAQvQSgOxZuxZV++QDINS2i0L7KDW84WZOPHGzdtGbUaQl4
+3LpltYOFR3eSySq0iCaE9dIp7c+H4MtLSiKH82Nfbk9qdiwSKfAk6J9I/iTudRO8
+M2HQUNO2M9cyg3E8Ivu/GC1AXbTV9wBgdBwZwLyS1JMYofuizeEaB/yz1pDdko2e
+shgXDbDz0rjA32m0LvY9mNERn7s5Ad/p46WC1UvWWYBAHClCk1dC2R+mA8fO7z++
+oRiTlgMkW+bwVI8NsNXqSULJAd6rL65pn5FHGAnodr4BWPNl8fh/kKl3O02M08Th
+ATRwnU3n1nKaEAgHxYRKq8IbwtosUBkJlzSu8NLII/T6G8KQWad2xmqf5SZCGoOt
+/sCUiPSlaPoN2jCfgsZyidZy/LGlrwMFIVUjvEjCtCsxVIpFcfNbFB1oOSH2uhcj
+bbitrUwbcuv4e0495j30d7ajgfcwMyzRZoCMCzxpEsnPI5Ld7rUyAh6uBprnDP30
+ZjIxp7vumTWhaYSxCdOBRCPDKvUR3xNugD/HBC202bbvkNIHq0RVCRud9Hi6qxJs
+JLseE696ee3gKzYAU3z96rN16/DAxYjq9dy1upEa3sGM3UwYVHR9kjSHF2yrY17A
+gqh13rOLmB3QKdBjAjf6PGA+AnMIlSbFHIra7QjKfbRwCv5ZfoFU/kMjhQg7AgMB
+AAGgADANBgkqhkiG9w0BAQsFAAOCAgEAXJO7tsgW4CJ+cwRFJ3slEEaLYl0jsHiZ
+91dCtAmqs6BWAfrpNeLJIvmRqhugnL97nWnxhSLQP0/ssRdqOv1U91Mw9KsLQAMe
+MkXQ14TraKwRV2UlL56deDBzl4HBTLtCf1Arlj4FucUysqndzFfWMhsDF2/QONyl
+YGz4pKX1OQ4eb+UeZ7k7gmiJT0Xq1PQr7YP/hgr+euIZtwzgdMujqgQo/y8XoHXk
+ISvfXgotowP3WrOqbrjo4k/+PSOxMGG497SG8q2crSXIQrThd/EpsIOpcyeqh5rb
+wCpGqb0i33Bbk63grHE3J+BH5lNr2txBtxFaYYywHhz/RsI9m+o9DNPfR7ABvFtt
+wzDYKNLGj8hsK/GbVNfY+25FnLZetnuKZHWGVQaltzLrn+qRWt1zEkUcQz1ir89g
+Dn75kK2mpxJTK/tI/65eQRfpWGviepTItmof8SmnXE22qguU2hzAf+GMGBmvUU8b
+1jctN8wOwt+EK47YCC9PtbgVAPlzGV+RTlO5K0nUPcRUjL5FXCJB5FLhAJ3hYR4H
+dqMEYhoHdgTT65wrF3Mfw7z26qhDmN8eIp0T3qKE/A0hGUWBdyHtnF96Z2ymzTHQ
+MA8TdHUoLmEW6DN9BgOATi0BzUAL2e6VTIqNFx6deRrm0kSGPQ0haR2shWfDHjMS
++DgHYI3c0do=
+-----END CERTIFICATE REQUEST-----

data/lib/certmeister/policy/key_bits.rb

@@ -29,6 +29,8 @@ module Certmeister
             Certmeister::Policy::Response.new(true, nil)
           end
         end
+      rescue OpenSSL::X509::RequestError => e
+        Certmeister::Policy::Response.new(false, "invalid pem (#{e.message})")
       end
 
       private

data/lib/certmeister/policy/signature_algorithm.rb

@@ -0,0 +1,67 @@
+require 'certmeister/policy/response'
+require 'openssl'
+
+module Certmeister
+
+  module Policy
+
+    class SignatureAlgorithm
+
+      DEFAULT_SIGNATURE_ALGORITHMS = ["sha256", "sha384", "sha512"]
+
+      attr_reader :signature_algorithms
+      
+      def initialize(signature_algorithms = DEFAULT_SIGNATURE_ALGORITHMS)
+        validate_signature_algorithms(signature_algorithms)
+        @signature_algorithms = signature_algorithms
+      end
+
+      def authenticate(request)
+        if not request[:pem]
+          return Certmeister::Policy::Response.new(false, "missing pem")
+        else
+          cert = OpenSSL::X509::Request.new(request[:pem])
+          signature_algorithm = cert.signature_algorithm
+          if signature_algorithm = check_for_supported_signature_algorithm(signature_algorithm)
+            check_signature_algorithm_strength(signature_algorithm)
+          else
+            return Certmeister::Policy::Response.new(false, "unknown/unsupported signature algorithm (#{cert.signature_algorithm})")
+          end
+        end
+      rescue OpenSSL::X509::RequestError => e
+        return Certmeister::Policy::Response.new(false, "invalid pem (#{e.message})")
+      end
+
+      private
+
+      def validate_signature_algorithms(signature_algorithms)
+        unless signature_algorithms.kind_of?(Array)
+          raise ArgumentError.new("invalid set of signature algorithms")
+        end
+        signature_algorithms.each do |element|
+          unless element.kind_of?(String)
+            raise ArgumentError.new("invalid set of signature algorithms")
+          end
+        end
+      end
+      
+      def check_for_supported_signature_algorithm(signature_algorithm)
+        if signature_algorithm.include? "WithRSAEncryption"
+          return signature_algorithm = signature_algorithm.sub("WithRSAEncryption", "")
+        end
+
+      end
+
+      def check_signature_algorithm_strength(signature_algorithm)
+        if @signature_algorithms.include? signature_algorithm
+          return Certmeister::Policy::Response.new(true, nil)
+        else
+          return Certmeister::Policy::Response.new(false, "weak signature algorithm")
+        end
+      end  
+
+    end
+
+  end
+
+end

data/lib/certmeister/version.rb

@@ -1,5 +1,5 @@
 module Certmeister
 
-  VERSION = '2.2.0' unless defined?(VERSION)
+  VERSION = '2.3.0' unless defined?(VERSION)
 
 end

data/spec/certmeister/policy/key_bits_spec.rb

@@ -25,22 +25,22 @@ describe Certmeister::Policy::KeyBits do
     expect(response.error).to eql "missing pem"
   end
 
-  it "refuses to authenticate an invalid request" do
-    pem = File.read('fixtures/kbits_1024.csr')
+  it "refuses to authenticate an invalid pem" do
+    pem = "bad input"
     response = subject.authenticate({pem: pem})
     expect(response).to_not be_authenticated
-    expect(response.error).to eql "weak key"
+    expect(response.error).to eql "invalid pem (not enough data)"
   end
 
   it "refuses to authenticate a request for a key with too few bits" do
-    pem = File.read('fixtures/kbits_1024.csr')
+    pem = File.read('fixtures/sha256_1024bit.csr')
     response = subject.authenticate({pem: pem})
     expect(response).to_not be_authenticated
     expect(response.error).to eql "weak key"
   end
 
   it "authenticates a request for a key with sufficient bits" do
-    pem = File.read('fixtures/kbits_4096.csr')
+    pem = File.read('fixtures/sha256_4096bit.csr')
     response = subject.authenticate({pem: pem})
     expect(response).to be_authenticated
   end

data/spec/certmeister/policy/signature_algorithm_spec.rb

@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+require 'certmeister/policy/signature_algorithm'
+
+describe Certmeister::Policy::SignatureAlgorithm do
+
+  subject { Certmeister::Policy::SignatureAlgorithm.new(["sha256", "sha384", "sha512"]) }
+
+  it "may be configured with a set of strong signature algorithms" do
+    expect { Certmeister::Policy::SignatureAlgorithm.new([1,2])}.to raise_error(ArgumentError, "invalid set of signature algorithms") 
+    expect { Certmeister::Policy::SignatureAlgorithm.new(["one", "two", "three"]) }.to_not raise_error
+  end
+
+  it "defaults to #{Certmeister::Policy::SignatureAlgorithm::DEFAULT_SIGNATURE_ALGORITHMS} as the set of strong signature algorithms" do
+    expect(described_class.new.signature_algorithms).to eql Certmeister::Policy::SignatureAlgorithm::DEFAULT_SIGNATURE_ALGORITHMS
+  end
+
+  it "demands a request" do
+    expect { subject.authenticate }.to raise_error(ArgumentError)
+  end
+
+  it "refuses to authenticate a request with a missing pem" do
+    response = subject.authenticate({anything: 'something'})
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "missing pem"
+  end
+
+  it "refuses to authenticate an invalid pem" do
+    pem = "bad input"
+    response = subject.authenticate({pem: pem})
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "invalid pem (not enough data)"
+  end
+
+  it "refuses to authenticate a request with a weak signature algorithm" do  
+    pem = File.read('fixtures/sha1_4096bit.csr')
+    response = subject.authenticate({pem: pem})
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "weak signature algorithm"
+  end
+
+  it "authenticates a request with a strong signature algorithm" do
+    pem = File.read('fixtures/sha256_4096bit.csr')
+    response = subject.authenticate({pem: pem})
+    expect(response).to be_authenticated
+  end
+
+  it "refuses to authenticate a request with an unknown/unsupported signature algorithm" do
+    pem = File.read('fixtures/ecdsa.csr')
+    response = subject.authenticate({pem: pem})
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "unknown/unsupported signature algorithm (ecdsa-with-SHA384)"
+  end
+
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: certmeister
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Sheldon Hearn
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-05 00:00:00.000000000 Z
+date: 2016-01-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 10.4.2
+        version: '10.4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 10.4.2
+        version: '10.4'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -67,10 +67,10 @@ files:
 - ".ruby-gemset"
 - ".ruby-version"
 - Gemfile
-- Gemfile.lock
 - LICENSE
 - README.md
 - Rakefile
+- SignatureAlgorithm.txt
 - certmeister.gemspec
 - fixtures/ca.crt
 - fixtures/ca.csr
@@ -78,8 +78,11 @@ files:
 - fixtures/client.crt
 - fixtures/client.csr
 - fixtures/client.key
-- fixtures/kbits_1024.csr
-- fixtures/kbits_4096.csr
+- fixtures/ecdsa.csr
+- fixtures/sha1_1024bit.csr
+- fixtures/sha1_4096bit.csr
+- fixtures/sha256_1024bit.csr
+- fixtures/sha256_4096bit.csr
 - lib/certmeister.rb
 - lib/certmeister/base.rb
 - lib/certmeister/config.rb
@@ -96,6 +99,7 @@ files:
 - lib/certmeister/policy/noop.rb
 - lib/certmeister/policy/psk.rb
 - lib/certmeister/policy/response.rb
+- lib/certmeister/policy/signature_algorithm.rb
 - lib/certmeister/response.rb
 - lib/certmeister/self_test.rb
 - lib/certmeister/store_error.rb
@@ -115,6 +119,7 @@ files:
 - spec/certmeister/policy/noop_spec.rb
 - spec/certmeister/policy/psk_spec.rb
 - spec/certmeister/policy/response_spec.rb
+- spec/certmeister/policy/signature_algorithm_spec.rb
 - spec/certmeister/response_spec.rb
 - spec/certmeister/self_test_spec.rb
 - spec/helpers/certmeister_config_helper.rb
@@ -143,7 +148,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: Conditionally autosigning certificate authority.
@@ -162,6 +167,7 @@ test_files:
 - spec/certmeister/policy/noop_spec.rb
 - spec/certmeister/policy/psk_spec.rb
 - spec/certmeister/policy/response_spec.rb
+- spec/certmeister/policy/signature_algorithm_spec.rb
 - spec/certmeister/response_spec.rb
 - spec/certmeister/self_test_spec.rb
 - spec/helpers/certmeister_config_helper.rb

data/Gemfile.lock

@@ -1,31 +0,0 @@
-PATH
-  remote: .
-  specs:
-    certmeister (2.1.0)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    diff-lcs (1.2.5)
-    rake (10.4.2)
-    rspec (3.1.0)
-      rspec-core (~> 3.1.0)
-      rspec-expectations (~> 3.1.0)
-      rspec-mocks (~> 3.1.0)
-    rspec-core (3.1.7)
-      rspec-support (~> 3.1.0)
-    rspec-expectations (3.1.2)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.1.0)
-    rspec-mocks (3.1.3)
-      rspec-support (~> 3.1.0)
-    rspec-support (3.1.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  bundler (~> 1.5)
-  certmeister!
-  rake (~> 10.4.2)
-  rspec (~> 3.1)

data/fixtures/kbits_1024.csr

@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIIBrzCCARgCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
-ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
-GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCBnzANBgkqhkiG9w0BAQEFAAOB
-jQAwgYkCgYEAq14FktEw9Zilzj5DUKTI2Mix66A0Za5lTAeRmP1Ms9Hmjc+RnnCm
-u5L6zPoHY8s6/8tbxewtu86L7v2SfKkJjLSKxZQLFxBEzMHOgzziHTyZ1zU5SPWv
-Co8AQdlbZI8Wmai7dkxwdaA2xaWR4elHlgT78xDdYZXwRL75wfmkF/kCAwEAAaAA
-MA0GCSqGSIb3DQEBBQUAA4GBAKHHpelQzMYFBXYa0VOWFiqRd1HXJfnUbo8D5xup
-RzveAVlGTj83slgKvGigUupWdfk1S4KiUG1HsAyLcwl8lgOCO77CrdNPZC0qjB4+
-pK3Xp2FMsK4+lp24FNR0tM31FA03DU8uhL8v5cvExHBn4idBEwO2W4OWPKVYKrtm
-w9ne
------END CERTIFICATE REQUEST-----

data/fixtures/kbits_4096.csr

@@ -1,28 +0,0 @@
------BEGIN CERTIFICATE REQUEST-----
-MIIEtDCCApwCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
-ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
-GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCCAiIwDQYJKoZIhvcNAQEBBQAD
-ggIPADCCAgoCggIBALVi/dpNu31zZ+Wvxf4DXEaxLwsUbzsaLCxt770RkzEo8OdU
-DElf1WM7X+rdOJC3BDZ499Bigw5efpEhg2m2BmDl8DG1XmTvVKxIY6fvx9NWqTEt
-KcvOni7g/OFzmUXHoesoc6gz2flwD4lmdSR+S1N2RwwlOG2ZpBKy35mtmDdq/MJG
-Xj4rUafT4n9Pnmwzo9PPn54hjg7c7yQwUFWk0lOrsl7uhK1LMtQORME23oG0gK3N
-zhtY9f0+6YJAbzJ3EI2/i7Oso4XiW9eHpujKhaMYO8ezm3KuYgdEoOTaH4mruSjE
-34kmsTNonktiUdGMn/HqARgQKyVTyHmP+ocVcY8POzlJDcxMRVTYxQ4I9U1bz/eG
-ugHiCw0YnxrXpClXT3RVfydV/B7+srw+Tw8ff+m7WSzYeDjDLVotlnGrXLKLHm6d
-IA7n+fwBhliSSDNTu3ZVA5Vp72AEDqmfbRIcO4twIfkyu3TB3f2lf3g4LLebLDj3
-b3NwNwu0p/uq47eEYOKdILxXsZQRVKr8OZfhjPHIEw7d/6EpCCxG9I9Zj6KFAdga
-s8rquCKvb/8aXnL2Zz+QOhUGX9aAIpZJ7lNM95C1yjmRW/HcNonXcxBHqdi9+swO
-quagOBimj5BkUMRDWtMmr5bXDBGfxMeh6t1BrfcgtQgZy/FLkhjioObqD+WHAgMB
-AAGgADANBgkqhkiG9w0BAQsFAAOCAgEAR1ogHg6V59JwM0+EN4LhN8m7eDiCkYM+
-hmko5gTdzOe3Z+n/eVMoyqJ9qnzQEkO0n4aWTiaO2gLKEtXFo3Qu1wjWEJqxD8/b
-YdH64Gp8sFKlrM8o8mACG6jPo8ueFxI0o9Brl2Q6pUkOlepXUaLzMw0txm1Nm/9c
-O29p1XGAPVEdi9OMqbT+eAnxgSTy/AWR33+1BrZF42zBIaM62yquEPyJ1O1igTio
-MV3ZxhX061z02+5B/6cit41pUClZabII6f/tHAPxxxn3zNHkmYn6eQ3DsZT3Stuf
-lXw8j0e2sFXpvOSk1otYEOVYUiTp4SpmCjdUV1qUPlbQ94qGP75dv5uYn5pN/hJ5
-UO/lGETzK1/ycUcoedDCzr7sQhfXB1Z47/NQ+RL4NVem941ujIfn8MKHyx99zKnT
-OI73Pn6Y7n1hZxoV6krRl7C3gzkI7Eo0bFQEwiZbRC7U30WaiFurfKi0puMlU1K3
-vdOPTy0rq6zGp3r1J6oITHiD/h+CxRxJTrGu9GbCUQlaoQfPqwXAdI7GQcwsSPto
-l1643eqDR3lST821TPE0Ln+Lvs8aQzYNVFaV79nhgncJHyPpP7j9/2k6CtsGAtVv
-qPOTJbxnOfwRDfbyDLWBoqHNxmfhq3KtE6ktVxyP9hUyGnAf8yAn3zaDx4V980N6
-9FNkBniZB+Y=
------END CERTIFICATE REQUEST-----