csr_peek 0.1.0

data/lib/csr_peek/extensions.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "ipaddr"
+
+module CsrPeek
+  # Decoders for the X.509 extensions we surface, working from the extension's
+  # DER rather than OpenSSL's human-readable #value string. The display string
+  # splits on ", " (which corrupts a directoryName between RDNs) and its labels
+  # are locale- and version-dependent; decoding the ASN.1 is exact and stable.
+  # Every method tolerates a nil extension and never raises.
+  module Extensions
+    module_function
+
+    # GeneralName CHOICE context tags (RFC 5280 4.2.1.6).
+    GN_RFC822 = 1  # rfc822Name              (email)
+    GN_DNS = 2     # dNSName
+    GN_URI = 6     # uniformResourceIdentifier
+    GN_IP = 7      # iPAddress
+    GN_DIRNAME = 4 # directoryName
+
+    # keyUsage BIT STRING positions (RFC 5280 4.2.1.3), bit 0 first.
+    KEY_USAGE_NAMES = %w[
+      digitalSignature nonRepudiation keyEncipherment dataEncipherment
+      keyAgreement keyCertSign cRLSign encipherOnly decipherOnly
+    ].freeze
+
+    def empty_sans
+      {dns: [], ip: [], email: [], uri: [], other: []}
+    end
+
+    # Parse a subjectAltName extension into { dns:, ip:, email:, uri:, other: }.
+    # The result is deep-frozen: the value objects hold it directly, and a
+    # caller must not be able to mutate a memoized view.
+    def subject_alt_names(extension)
+      deep_freeze(parse_san(extension))
+    end
+
+    def parse_san(extension)
+      return empty_sans if extension.nil?
+
+      der = extn_value_der(extension)
+      return empty_sans if der.nil?
+
+      general_names(OpenSSL::ASN1.decode(der))
+    rescue OpenSSL::ASN1::ASN1Error, OpenSSL::X509::ExtensionError
+      empty_sans
+    end
+
+    # Deep-freeze so the value object that holds this is genuinely immutable:
+    # the category arrays AND the (OpenSSL-derived, non-literal) strings inside.
+    def deep_freeze(sans)
+      sans.each_value { |values| values.each(&:freeze).freeze }
+      sans.freeze
+    end
+
+    # keyUsage as canonical names, e.g. ["digitalSignature", "keyEncipherment"].
+    def key_usages(extension)
+      return [] if extension.nil?
+
+      der = extn_value_der(extension)
+      return [] if der.nil?
+
+      bits = OpenSSL::ASN1.decode(der)
+      bytes = bits.value.bytes
+      KEY_USAGE_NAMES.each_index.select { |i| bit_set?(bytes, i) }.map { |i| KEY_USAGE_NAMES[i] }
+    rescue OpenSSL::ASN1::ASN1Error, NoMethodError
+      []
+    end
+
+    # extendedKeyUsage as short OID names, e.g. ["serverAuth", "clientAuth"].
+    # Falls back to the dotted OID for usages OpenSSL cannot name.
+    def extended_key_usages(extension)
+      return [] if extension.nil?
+
+      der = extn_value_der(extension)
+      return [] if der.nil?
+
+      sequence = OpenSSL::ASN1.decode(der)
+      Array(sequence.value).map do |oid|
+        (oid.respond_to?(:sn) ? (oid.sn || oid.oid) : oid.to_s).freeze
+      end
+    rescue OpenSSL::ASN1::ASN1Error, NoMethodError
+      []
+    end
+
+    # basicConstraints as { ca: true/false, path_length: Integer or nil }.
+    def basic_constraints(extension)
+      absent = {ca: false, path_length: nil}
+      return absent if extension.nil?
+
+      der = extn_value_der(extension)
+      return absent if der.nil?
+
+      sequence = OpenSSL::ASN1.decode(der)
+      elements = Array(sequence.value)
+      ca = elements.find { |e| e.is_a?(OpenSSL::ASN1::Boolean) }&.value || false
+      path = elements.find { |e| e.is_a?(OpenSSL::ASN1::Integer) }
+      {ca: ca, path_length: path&.value&.to_i}
+    rescue OpenSSL::ASN1::ASN1Error, NoMethodError
+      absent
+    end
+
+    # The raw DER carried inside an extension's OCTET STRING.
+    def extn_value_der(extension)
+      sequence = OpenSSL::ASN1.decode(extension.to_der)
+      octet = Array(sequence.value).find { |el| el.is_a?(OpenSSL::ASN1::OctetString) }
+      octet&.value
+    end
+
+    def general_names(sequence)
+      result = empty_sans
+      Array(sequence.value).each do |gn|
+        next unless gn.respond_to?(:tag) && gn.tag_class == :CONTEXT_SPECIFIC
+
+        case gn.tag
+        when GN_DNS then result[:dns] << gn.value.to_s
+        when GN_RFC822 then result[:email] << gn.value.to_s
+        when GN_URI then result[:uri] << gn.value.to_s
+        when GN_IP then (ip = format_ip(gn.value)) && result[:ip] << ip
+        else result[:other] << general_name_to_s(gn)
+        end
+      end
+      result
+    end
+
+    # dotted-quad for IPv4, canonical (compressed) form for IPv6, nil otherwise.
+    def format_ip(bytes)
+      raw = bytes.to_s
+      case raw.bytesize
+      when 4 then raw.unpack("C4").join(".")
+      when 16 then IPAddr.new(IPAddr.ntop(raw)).to_s
+      end
+    rescue IPAddr::Error
+      nil
+    end
+
+    # directoryName is decoded to its slash form so no information is lost; any
+    # other kind is labelled by its tag number.
+    def general_name_to_s(gn)
+      if gn.tag == GN_DIRNAME
+        inner = Array(gn.value).first
+        return "dirName:#{OpenSSL::X509::Name.new(inner.to_der)}" if inner
+      end
+      "tag#{gn.tag}"
+    rescue
+      "tag#{gn.tag}"
+    end
+
+    def bit_set?(bytes, index)
+      byte = bytes[index / 8]
+      return false if byte.nil?
+
+      byte.anybits?(0x80 >> (index % 8))
+    end
+  end
+end

data/lib/csr_peek/inspectable.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+require "openssl"
+require_relative "policy"
+
+module CsrPeek
+  # The reading surface shared by the Csr and Certificate value objects.
+  #
+  # Both are immutable Data structs built from the same precomputed members
+  # (subject, subject_alt_names, key_type, key_bits, ec_curve, public_key,
+  # openssl). This module turns those flat members into the friendly questions
+  # callers ask. Because the members are already resolved and frozen, nothing
+  # here re-touches the raise-prone key-loading path.
+  #
+  # It is *prepended* (not included) into each Data class so that its value
+  # semantics - #==, #hash, #inspect keyed on the canonical DER - override the
+  # defaults Data generates, which would otherwise compare the live OpenSSL
+  # handles and dump their bytes.
+  module Inspectable
+    # Cryptographic strength floors (independent of any issuance policy).
+    MIN_RSA_BITS = 2048
+    MIN_EC_BITS = 256
+    MIN_DSA_BITS = 2048
+
+    # Edwards signature schemes: strong regardless of RSA-style bit size.
+    STRONG_UNSIZED_TYPES = %w[ED25519 ED448].freeze
+
+    def common_name
+      subject["CN"]
+    end
+
+    def dns_names
+      subject_alt_names[:dns]
+    end
+
+    def ip_addresses
+      subject_alt_names[:ip]
+    end
+
+    # DNS SANs when present, else the Common Name. De-duplicated, stable order.
+    def all_names
+      return dns_names.uniq unless dns_names.empty?
+
+      common_name ? [common_name] : []
+    end
+
+    # Cryptographic strength only - see #acceptable_key? for policy. A key that
+    # failed to load ("unknown") is treated as weak: "cannot verify" is not safe.
+    def weak_key?
+      case key_type
+      when "RSA" then key_bits.nil? || key_bits < MIN_RSA_BITS
+      when "EC" then key_bits.nil? || key_bits < MIN_EC_BITS
+      when "DSA" then key_bits.nil? || key_bits < MIN_DSA_BITS
+      when *STRONG_UNSIZED_TYPES then false
+      else true
+      end
+    end
+
+    # True when the key satisfies the issuance policy (Baseline Requirements by
+    # default). See CsrPeek::Policy.
+    def acceptable_key?(policy = Policy::BASELINE)
+      key_policy_violations(policy).empty?
+    end
+
+    # The policy reasons the key is unacceptable, as symbols (empty if fine).
+    def key_policy_violations(policy = Policy::BASELINE)
+      policy.key_violations(
+        type: key_type,
+        bits: key_bits,
+        curve: ec_curve,
+        spki_fingerprint: spki_fingerprint(:sha256)
+      )
+    end
+
+    # Hex fingerprint of the SubjectPublicKeyInfo DER - the stable identity of
+    # the key across every CSR and certificate that carries it. nil when the
+    # key could not be loaded.
+    def spki_fingerprint(algo = :sha256)
+      key = public_key
+      return nil if key.nil?
+
+      OpenSSL::Digest.hexdigest(digest_name(algo), key.public_to_der)
+    rescue OpenSSL::PKey::PKeyError, OpenSSL::Digest::DigestError
+      nil
+    end
+
+    # Hex fingerprint of the whole object (DER). nil if it cannot be encoded.
+    def fingerprint(algo = :sha256)
+      OpenSSL::Digest.hexdigest(digest_name(algo), openssl.to_der)
+    rescue OpenSSL::Digest::DigestError,
+      OpenSSL::X509::RequestError,
+      OpenSSL::X509::CertificateError
+      nil
+    end
+
+    # Value semantics keyed on the canonical DER, not the live OpenSSL handle,
+    # so two parses of the same bytes are equal and usable as hash keys.
+    def ==(other)
+      other.is_a?(self.class) && der_identity == other.send(:der_identity)
+    end
+    alias_method :eql?, :==
+
+    def hash
+      der_identity.hash
+    end
+
+    def inspect
+      "#<#{self.class.name} cn=#{common_name.inspect} #{key_type} #{key_bits || "?"}-bit>"
+    end
+
+    private
+
+    def der_identity
+      openssl.to_der
+    rescue
+      object_id
+    end
+
+    def digest_name(algo)
+      case algo.to_s.downcase
+      when "sha256" then "SHA256"
+      when "sha1" then "SHA1"
+      when "md5" then "MD5"
+      when "sha512" then "SHA512"
+      else algo.to_s
+      end
+    end
+  end
+end

data/lib/csr_peek/key_facts.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module CsrPeek
+  # Pure, nil-safe extraction of the plain facts about a public key: its type,
+  # size, and curve. This runs once, at build time, against a key that may have
+  # failed to load (nil). Turning the key into flat data here is what lets the
+  # value objects answer every downstream question without ever touching the
+  # raise-prone key-loading path again.
+  module KeyFacts
+    module_function
+
+    # => { type: String, bits: Integer or nil, curve: String or nil }
+    def of(pkey)
+      {type: type_of(pkey), bits: bits_of(pkey), curve: curve_of(pkey)}
+    end
+
+    # "RSA", "EC", "DSA", an upper-cased OID for Edwards keys ("ED25519"), or
+    # "unknown" when the key could not be loaded.
+    def type_of(pkey)
+      case pkey
+      when nil then "unknown"
+      when OpenSSL::PKey::RSA then "RSA"
+      when OpenSSL::PKey::EC then "EC"
+      when OpenSSL::PKey::DSA then "DSA"
+      else
+        (pkey.respond_to?(:oid) ? pkey.oid : pkey.class.name.split("::").last).to_s
+      end
+    rescue OpenSSL::PKey::PKeyError, NoMethodError
+      "unknown"
+    end
+
+    # Size in bits: RSA modulus, DSA prime, or EC curve degree. nil otherwise.
+    def bits_of(pkey)
+      case pkey
+      when OpenSSL::PKey::RSA then pkey.n&.num_bits
+      when OpenSSL::PKey::DSA then pkey.p&.num_bits
+      when OpenSSL::PKey::EC then pkey.group&.degree
+      end
+    rescue OpenSSL::PKey::PKeyError
+      nil
+    end
+
+    # The EC curve name (e.g. "prime256v1"), or nil for non-EC keys.
+    def curve_of(pkey)
+      return nil unless pkey.is_a?(OpenSSL::PKey::EC)
+
+      pkey.group&.curve_name
+    rescue OpenSSL::PKey::PKeyError
+      nil
+    end
+  end
+end

data/lib/csr_peek/names.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module CsrPeek
+  # Helpers for turning an OpenSSL::X509::Name (subject, issuer) into plain Ruby.
+  # Subject Alternative Names live in CsrPeek::Extensions, not here.
+  module Names
+    module_function
+
+    # Convert an OpenSSL::X509::Name to a hash of { "CN" => ..., "O" => ... }.
+    #
+    # Keys are OpenSSL's short names for known OIDs ("CN", "O", "OU", ...) and
+    # the dotted OID string for anything it does not recognize. When an
+    # attribute repeats (multiple OU, say), the FIRST value wins; the full
+    # ordered list, repeats included, is available via #components. Never raises.
+    # Values are frozen (they come from OpenSSL, not from frozen literals) so the
+    # immutable value object that holds this hash is immutable all the way down.
+    def subject_to_h(name)
+      return {} if name.nil?
+
+      name.to_a.each_with_object({}) do |(oid, value, _type), acc|
+        acc[oid.freeze] ||= value.freeze
+      end.freeze
+    rescue
+      {}
+    end
+
+    # The ordered list of [oid, value] pairs from a name, preserving repeats.
+    # Deep-frozen for the same reason as #subject_to_h.
+    def components(name)
+      return [] if name.nil?
+
+      name.to_a.map { |oid, value, _type| [oid.freeze, value.freeze].freeze }.freeze
+    rescue
+      []
+    end
+  end
+end

data/lib/csr_peek/policy.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+module CsrPeek
+  # An issuance policy: the rules a key or certificate must satisfy to be
+  # *acceptable*, as opposed to whether a key is *cryptographically weak*.
+  #
+  # These are deliberately separate ideas. An Ed25519 key is not weak, but a
+  # policy scoped to the CA/Browser Forum Baseline Requirements does not permit
+  # it for public TLS. #weak_key? answers the maths; a Policy answers "may I
+  # issue against this?". Pass your own Policy to raise the bar (3072-bit RSA,
+  # a curve allowlist, a compromised-key blocklist) without monkey-patching.
+  #
+  #   strict = CsrPeek::Policy.new(min_rsa_bits: 3072, allowed_curves: %w[secp384r1])
+  #   csr.acceptable_key?(strict)          # => false
+  #   csr.key_policy_violations(strict)     # => [:rsa_too_small]
+  class Policy
+    attr_reader :min_rsa_bits, :min_ec_bits, :min_dsa_bits, :allowed_key_types,
+      :allowed_curves, :weak_signature_hashes, :blocked_spki_fingerprints
+
+    # allowed_key_types / allowed_curves default to nil meaning "no restriction
+    # on this axis". blocked_spki_fingerprints is matched case-insensitively and
+    # ignoring colons, so "AA:BB" and "aabb" are the same entry.
+    def initialize(min_rsa_bits: 2048, min_ec_bits: 256, min_dsa_bits: 2048,
+      allowed_key_types: %w[RSA EC], allowed_curves: nil,
+      weak_signature_hashes: %w[md2 md4 md5 sha1],
+      blocked_spki_fingerprints: [])
+      @min_rsa_bits = min_rsa_bits
+      @min_ec_bits = min_ec_bits
+      @min_dsa_bits = min_dsa_bits
+      @allowed_key_types = allowed_key_types&.map(&:to_s)&.to_set&.freeze
+      @allowed_curves = allowed_curves&.map(&:to_s)&.to_set&.freeze
+      @weak_signature_hashes = weak_signature_hashes.map { |h| h.to_s.downcase }.freeze
+      @blocked_spki_fingerprints = blocked_spki_fingerprints
+        .map { |f| normalize_fingerprint(f) }.to_set.freeze
+      freeze
+    end
+
+    # The reasons this key fails the policy, as an array of symbols. Empty means
+    # acceptable. Inputs are the plain values an inspector already computes.
+    def key_violations(type:, bits:, curve:, spki_fingerprint: nil)
+      return [:key_unreadable] if type.nil? || type == "unknown"
+
+      violations = []
+      violations << :unsupported_key_type unless key_type_allowed?(type)
+      violations.concat(size_violations(type, bits, curve))
+      violations << :key_blocklisted if blocked?(spki_fingerprint)
+      violations
+    end
+
+    def key_type_allowed?(type)
+      allowed_key_types.nil? || allowed_key_types.include?(type.to_s)
+    end
+
+    def curve_allowed?(curve)
+      allowed_curves.nil? || (curve && allowed_curves.include?(curve.to_s))
+    end
+
+    def blocked?(spki_fingerprint)
+      return false if spki_fingerprint.nil? || blocked_spki_fingerprints.empty?
+
+      blocked_spki_fingerprints.include?(normalize_fingerprint(spki_fingerprint))
+    end
+
+    # True when a certificate's signature algorithm uses a hash this policy
+    # rejects (MD5, SHA-1, ...), matched as a substring of the lower-cased name.
+    # An unknown (blank) algorithm fails closed - "cannot verify" is not "safe",
+    # the same stance #weak_key? takes for an unloadable key.
+    def weak_signature?(signature_algorithm)
+      name = signature_algorithm.to_s.downcase
+      return true if name.empty?
+
+      weak_signature_hashes.any? { |h| name.include?(h) }
+    end
+
+    private
+
+    def size_violations(type, bits, curve)
+      case type
+      when "RSA" then (bits.nil? || bits < min_rsa_bits) ? [:rsa_too_small] : []
+      when "DSA" then (bits.nil? || bits < min_dsa_bits) ? [:dsa_too_small] : []
+      when "EC"
+        v = []
+        v << :ec_too_small if bits.nil? || bits < min_ec_bits
+        v << :curve_not_allowed unless curve_allowed?(curve)
+        v
+      else [] # Edwards and other strong-but-maybe-unpermitted types: type gate handles them.
+      end
+    end
+
+    def normalize_fingerprint(value)
+      value.to_s.downcase.delete(":")
+    end
+
+    # The CA/Browser Forum Baseline Requirements as a starting point. Defined
+    # last so that #initialize can rely on every (private) helper it calls.
+    BASELINE = new.freeze
+  end
+end

data/lib/csr_peek/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module CsrPeek
+  VERSION = "0.1.0"
+end

data/lib/csr_peek.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+require_relative "csr_peek/version"
+require_relative "csr_peek/policy"
+require_relative "csr_peek/names"
+require_relative "csr_peek/extensions"
+require_relative "csr_peek/key_facts"
+require_relative "csr_peek/inspectable"
+require_relative "csr_peek/csr"
+require_relative "csr_peek/certificate"
+
+# CsrPeek reads certificate signing requests and X.509 certificates and hands
+# back the useful parts safely: subject, common name, Subject Alternative
+# Names, key type and size, and public-key fingerprints. Malformed input
+# returns nil rather than raising, so a bad upload never becomes a 500.
+#
+#   csr = CsrPeek.parse(pem_string)
+#   csr&.common_name        # => "example.com"
+#   csr&.dns_names          # => ["example.com", "www.example.com"]
+#   csr&.weak_key?          # => false
+#
+# When you want to know *why* something failed to parse, use the bang variants
+# (parse!, parse_certificate!), which raise CsrPeek::ParseError with a reason.
+#
+# Every name and SAN value comes straight from the (attacker-controlled) input
+# and may contain control characters, newlines, or markup. Escape it before
+# rendering it into HTML, logs, or shell - CsrPeek reports faithfully, it does
+# not sanitize.
+module CsrPeek
+  # Base class for every error CsrPeek raises on purpose.
+  class Error < StandardError; end
+
+  # Raised by parse!/parse_certificate! when the input is not a readable CSR or
+  # certificate. The non-bang parse/parse_certificate rescue this and return nil.
+  class ParseError < Error; end
+
+  # Upper bound on the input we will look at, so untrusted data cannot exhaust
+  # memory or CPU. A real CSR or certificate is a few kilobytes; a full chain is
+  # tens. 1 MiB is very generous while still bounding the work.
+  MAX_INPUT_BYTES = 1 << 20
+
+  # Cap on the number of certificates parse_certificates will return from one
+  # bundle, so a pathological input cannot make us parse unboundedly many.
+  MAX_CHAIN_CERTIFICATES = 100
+
+  BEGIN_CERTIFICATE = "-----BEGIN CERTIFICATE-----"
+  END_CERTIFICATE = "-----END CERTIFICATE-----"
+
+  module_function
+
+  # Parse a PEM or DER CSR. Returns a CsrPeek::Csr, or nil on invalid input.
+  def parse(input)
+    parse!(input)
+  rescue ParseError
+    nil
+  end
+
+  # Like #parse, but raises CsrPeek::ParseError instead of returning nil.
+  def parse!(input)
+    validate_size!(input)
+    raise ParseError, "input is empty" if blank?(input)
+
+    request = decode(input, "certificate signing request") do
+      OpenSSL::X509::Request.new(input)
+    end
+    Csr.from_openssl(request)
+  end
+
+  # Parse a PEM or DER X.509 certificate. Returns a CsrPeek::Certificate, or
+  # nil on invalid input.
+  def parse_certificate(input)
+    parse_certificate!(input)
+  rescue ParseError
+    nil
+  end
+
+  # Like #parse_certificate, but raises CsrPeek::ParseError instead of nil.
+  def parse_certificate!(input)
+    validate_size!(input)
+    raise ParseError, "input is empty" if blank?(input)
+
+    certificate = decode(input, "X.509 certificate") do
+      OpenSSL::X509::Certificate.new(input)
+    end
+    Certificate.from_openssl(certificate)
+  end
+
+  # Parse every certificate in a PEM bundle (a chain, a fullchain.pem), in file
+  # order, as an array of CsrPeek::Certificate. Unparseable blocks are skipped.
+  # A single PEM or DER certificate yields a one-element array; junk yields [].
+  # Use this instead of #parse_certificate, which only sees the first block.
+  def parse_certificates(input)
+    return [] unless within_size?(input)
+    return [] if blank?(input)
+
+    certificates = extract_pem_certificates(input.to_s)
+    return certificates unless certificates.empty?
+
+    # No PEM blocks at all: try the whole input as one (DER) certificate.
+    cert = parse_certificate(input)
+    cert ? [cert] : []
+  end
+
+  # Run the OpenSSL constructor, translating its failures into ParseError.
+  # Only the constructor is wrapped, so a bug in the wrapper build step is not
+  # silently reported as invalid input.
+  def decode(input, label)
+    yield
+  rescue OpenSSL::X509::RequestError, OpenSSL::X509::CertificateError,
+    ArgumentError, TypeError => e
+    raise ParseError, "not a valid #{label} (#{e.message})"
+  end
+  private_class_method :decode
+
+  # Split on the END delimiter - linear in the input length - then reconstruct
+  # each block. A regex that spans BEGIN...END is quadratic when END markers are
+  # missing, which is a cheap denial-of-service against untrusted bundles.
+  def extract_pem_certificates(str)
+    certificates = []
+    str.split(END_CERTIFICATE).each do |chunk|
+      start = chunk.index(BEGIN_CERTIFICATE)
+      next if start.nil?
+
+      cert = parse_certificate(chunk[start..] + END_CERTIFICATE)
+      certificates << cert if cert
+      break if certificates.size >= MAX_CHAIN_CERTIFICATES
+    end
+    certificates
+  end
+  private_class_method :extract_pem_certificates
+
+  def validate_size!(input)
+    return if within_size?(input)
+
+    raise ParseError, "input exceeds #{MAX_INPUT_BYTES} bytes"
+  end
+  private_class_method :validate_size!
+
+  def within_size?(input)
+    !input.respond_to?(:bytesize) || input.bytesize <= MAX_INPUT_BYTES
+  end
+  private_class_method :within_size?
+
+  def blank?(input)
+    input.nil? || input.to_s.strip.empty?
+  end
+  private_class_method :blank?
+end

metadata

@@ -0,0 +1,63 @@
+--- !ruby/object:Gem::Specification
+name: csr_peek
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Suleyman Musayev
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: 'Parse a certificate signing request or an X.509 certificate and read
+  the useful parts safely: subject, common name, Subject Alternative Names, key type
+  and size, and public-key fingerprints. Malformed input returns nil instead of leaking
+  raw OpenSSL exceptions. Includes CA/Browser Forum aware weak-key checks. Zero runtime
+  dependencies beyond the standard library.'
+email:
+- slmusayev@gmail.com
+executables:
+- csr_peek
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- exe/csr_peek
+- lib/csr_peek.rb
+- lib/csr_peek/certificate.rb
+- lib/csr_peek/csr.rb
+- lib/csr_peek/extensions.rb
+- lib/csr_peek/inspectable.rb
+- lib/csr_peek/key_facts.rb
+- lib/csr_peek/names.rb
+- lib/csr_peek/policy.rb
+- lib/csr_peek/version.rb
+homepage: https://github.com/msuliq/csr_peek
+licenses:
+- MIT
+metadata:
+  rubygems_mfa_required: 'true'
+  homepage_uri: https://github.com/msuliq/csr_peek
+  source_code_uri: https://github.com/msuliq/csr_peek
+  changelog_uri: https://github.com/msuliq/csr_peek/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/msuliq/csr_peek/issues
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: A friendlier, safe way to read CSRs and certificates in Ruby
+test_files: []