kybus-ssl 0.1.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2bf5e7b4893134432a12134b41fb41b318b7ef6928e5690a4ec2a978b06cebe
-  data.tar.gz: 9576e4b32580447fc71678eec7ee7f56e5a7a5c6f34e8d6015aee3d846a00bb1
+  metadata.gz: 6b608e41afe35bae9646207f98879a12ab73e3754ccb344115729f2cb0a774c3
+  data.tar.gz: cc05b289a65b53859ff5b2f30579cd2bbf8d7195f12a28b601ab9aa45cc45f19
 SHA512:
-  metadata.gz: 726fae80d20e37cc77fe945a33cbee37f093d39e862bb1228c0397c624c476144e91a26ddfefae7e2200c5a05aeaafba483c60c3c3986d31b83dd63afe080a09
-  data.tar.gz: c7adaeedef2ea71b15c948eb79eb70c8a10082a550aceba4b9a0965b974b6005b26169bc259872d0f7c9342645c25b8ee1d7826158b5999d9d1bd218371423e0
+  metadata.gz: 8bd173d87ad8ce311af2e4c35bd29a7a6376ce2805a0b308c7a8ac21509708a16965ef01134b3ac564a1541085858d851556fb488dd4a9bb17335603d0d786e5
+  data.tar.gz: 1a94c96c310f264110bd59dcf7eecf0063ac467de48a8de72c7c46c5779fe74d30109a11b00d142a576d925f03a32498ff0adf0faf873831a8b1314daed74158

data/lib/kybus/ssl/certificate.rb

@@ -1,16 +1,27 @@
 # frozen_string_literal: true
 
 require 'openssl'
+require 'securerandom'
 
 module Kybus
   module SSL
     # Stores a X509 certificate.
     class Certificate
-      attr_reader :cert, :key
+      attr_reader :cert, :key, :config
 
       def initialize(config, inventory)
         @config = config
         @inventory = inventory
+
+        if File.file?(@config.key_path) && File.file?(@config.crt_path)
+          load_key!
+        else
+          create_key!
+        end
+      end
+
+      def create_key!
+        puts @config.instance_variable_get(:@config)
         @key = OpenSSL::PKey::RSA.new(@config['key_size'])
         @cert = OpenSSL::X509::Certificate.new
         @cert.public_key = @key.public_key
@@ -18,8 +29,15 @@ module Kybus
         @extensions.subject_certificate = @cert
       end
 
+      def load_key!
+        @key = OpenSSL::PKey::RSA.new(File.read(@config.key_path))
+        @cert = OpenSSL::X509::Certificate.new(File.read(@config.crt_path))
+      end
+
       def create!
-        return if File.file?(@config.key_path)
+        if File.file?(@config.key_path) && File.file?(@config.crt_path)
+          return puts "Certificate already exists #{@config.key_path} #{@cert.subject}"
+        end
 
         @ca = @inventory.ca(@config['parent'])
         configure_details!
@@ -39,12 +57,22 @@ module Kybus
 
       def sign!
         @cert.issuer = @ca.cert.subject
-        @cert.sign(@ca.key, OpenSSL::Digest::SHA256.new)
+        @cert.sign(@ca.key, OpenSSL::Digest.new('SHA256'))
       end
 
       def save!
+        puts "Saving certificate #{@cert.subject}"
         File.write(@config.key_path, @key.to_s)
         File.write(@config.crt_path, @cert.to_s)
+        export_to_pfx!
+      end
+
+      def export_to_pfx!
+        passphrase = SecureRandom.alphanumeric(15)
+        chain = [@cert] + @inventory.ca_cert_chain(@config['parent'])
+        pkcs12 = OpenSSL::PKCS12.create(passphrase, @config['email'] || @config['name'], @key, @cert, chain)
+        File.write(@config.pfx_path, pkcs12.to_der)
+        puts "PFX certificate saved with passphrase: #{passphrase}"
       end
 
       def ca_name

data/lib/kybus/ssl/cli/add_ca.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Kybus
+  module SSL
+    module CLI
+      class AddCA < BaseCommand
+        def run
+          load_template
+          update_yaml_file
+        end
+
+        private
+
+        KEYS = %i[caname name expiration key_size].freeze
+
+        def update_yaml_file
+          new_ca = opts_to_cert_config(KEYS,
+                                       parent: @opts[:ca] || 'root',
+                                       serial: next_serial,
+                                       name: @opts[:ca_name],
+                                       extensions: {
+                                         basicConstraints: {
+                                           details: 'CA:true, pathlen:0',
+                                           critical: true
+                                         }
+                                       })
+
+          @template['certificate_descriptions']['authorities']['certificates'] << new_ca
+
+          save_template
+        end
+      end
+    end
+  end
+end

data/lib/kybus/ssl/cli/add_certificate.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Kybus
+  module SSL
+    module CLI
+      class AddCertificate < BaseCommand
+        def run
+          load_template
+          update_yaml_file
+        end
+
+        private
+
+        KEYS = %i[name expiration key_size team country city state email].freeze
+
+        def update_yaml_file
+          new_certificate = opts_to_cert_config(KEYS, {
+                                                  parent: @opts[:ca],
+                                                  serial: next_serial,
+                                                  organization: @opts[:org],
+                                                  revoked: false
+                                                })
+
+          @template['certificate_descriptions']['clients']['certificates'] << new_certificate
+
+          save_template
+        end
+      end
+    end
+  end
+end

data/lib/kybus/ssl/cli/base_command.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Kybus
+  module SSL
+    module CLI
+      class BaseCommand
+        def initialize(opts)
+          @opts = opts
+        end
+
+        def transform_keys_recursively(hash)
+          hash.each_with_object({}) do |(key, value), new_hash|
+            new_key = key.is_a?(Symbol) ? key.to_s : key
+            new_value = if value.is_a?(Hash)
+                          transform_keys_recursively(value)
+                        elsif value.is_a?(Array)
+                          value.map { |v| transform_keys_recursively(v) }
+                        else
+                          value
+                        end
+            new_hash[new_key] = new_value
+          end
+        end
+
+        def opts_to_cert_config(keys, extra_args)
+          cert = {}
+          keys.each { |key| cert[key] = @opts[key] }
+          cert.merge(extra_args).compact
+        end
+
+        def load_template
+          @template = YAML.load_file(@opts[:pki_file])
+        end
+
+        def save_template
+          @template = transform_keys_recursively(@template)
+          File.write(@opts[:pki_file], @template.to_yaml)
+        end
+
+        def next_serial
+          @template['serial_counter'] += 1
+        end
+
+        def pki_file_exist?
+          File.file?(@opts[:pki_file])
+        end
+      end
+    end
+  end
+end

data/lib/kybus/ssl/cli/build.rb

@@ -0,0 +1,12 @@
+module Kybus
+  module SSL
+    module CLI
+      class Build < BaseCommand
+        def run
+          inv = Kybus::SSL::Inventory.load_inventory(@opts[:pki_file])
+          inv.create_certificates!
+        end
+      end
+    end
+  end
+end

data/lib/kybus/ssl/cli/init.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require_relative 'base_command'
+
+module Kybus
+  module SSL
+    module CLI
+      DEFAULT_EXPIRATION = 5
+      ROOT_CA_EXPIRATION = 20
+      SUB_CA_EXPIRATION = 10
+      ROOT_CA_SERIAL = 1
+      SERVERS_CA_SERIAL = 2
+      CLIENTS_CA_SERIAL = 3
+      ROOT_CA_KEY_SIZE = 4096
+      SUB_CA_KEY_SIZE = 2048
+      SERVERS_CA_EXPIRATION = 5
+
+      class Init < BaseCommand
+        def build_default_config
+          @template = {
+            serial_counter: 3,
+            certificate_descriptions: {
+              defaults: certificate_defaults,
+              authorities: default_authorities,
+              clients: default_clients_config,
+              servers: default_servers_config
+            }
+          }
+        end
+
+        def default_certificate_extensions
+          {
+            subjectKeyIdentifier: extension_details('hash'),
+            authorityKeyIdentifier: extension_details('keyid:always'),
+            basicConstraints: extension_details('CA:false')
+          }
+        end
+
+        def extension_details(details, critical: false)
+          { details:, critical: }
+        end
+
+        def certificate_defaults
+          {
+            saving_directory: @opts[:path],
+            country: @opts[:country],
+            state: @opts[:state],
+            city: @opts[:city],
+            organization: @opts[:organization],
+            team: @opts[:team],
+            key_size: @opts[:key_size],
+            expiration: DEFAULT_EXPIRATION,
+            extensions: default_certificate_extensions
+          }
+        end
+
+        def root_ca
+          ca_config("#{@opts[:organization]} Root CA", ROOT_CA_EXPIRATION, ROOT_CA_SERIAL, ROOT_CA_KEY_SIZE, 'root',
+                    'root')
+        end
+
+        def servers_ca
+          sub_ca_config("#{@opts[:organization]} Servers CA", SERVERS_CA_EXPIRATION, SERVERS_CA_SERIAL, 'servers')
+        end
+
+        def clients_ca
+          sub_ca_config("#{@opts[:organization]} Clients CA", SUB_CA_EXPIRATION, CLIENTS_CA_SERIAL, 'clients')
+        end
+
+        def ca_config(name, expiration, serial, key_size, ca, parent, extensions: {}) # rubocop: disable Metrics/ParameterLists:
+          { name:, expiration:, serial:, key_size:, ca:, parent:, extensions: }
+        end
+
+        def sub_ca_config(name, expiration, serial, ca)
+          ca_config(name, expiration, serial, SUB_CA_KEY_SIZE, ca, 'root', extensions: {
+                      basicConstraints: extension_details('CA:true, pathlen:0', critical: true)
+                    })
+        end
+
+        def default_authorities
+          {
+            defaults: {
+              parent: 'root',
+              extensions: {
+                basicConstraints: extension_details('CA:true', critical: true),
+                keyUsage: extension_details('Digital Signature, keyCertSign, cRLSign', critical: true)
+              }
+            },
+            certificates: [root_ca, servers_ca, clients_ca]
+          }
+        end
+
+        def default_config(parent, extensions, extra_defaults = {})
+          {
+            defaults: {
+              parent:,
+              extensions:
+            }.merge(extra_defaults),
+            certificates: []
+          }
+        end
+
+        def default_servers_config
+          extensions = {
+            'Netscape Cert Type': extension_details('SSL Server'),
+            'Netscape Comment': extension_details('Server certificate'),
+            keyUsage: extension_details('Digital Signature, Key Encipherment', critical: true),
+            extendedKeyUsage: extension_details('TLS Web Server Authentication'),
+            authorityKeyIdentifier: extension_details('keyid, issuer:always'),
+            subjectAltName: extension_details('$dns')
+          }
+          default_config('servers', extensions)
+        end
+
+        def default_clients_config
+          extensions = {
+            'Netscape Cert Type': extension_details('SSL Client, S/MIME'),
+            'Netscape Comment': extension_details('Client certificate'),
+            keyUsage: extension_details('Digital Signature, Non Repudiation, Key Encipherment', critical: true),
+            extendedKeyUsage: extension_details('TLS Web Client Authentication, E-mail Protection'),
+            subjectAltName: extension_details('$email')
+          }
+          default_config('clients', extensions, team: @opts[:team])
+        end
+
+        def run
+          abort 'File already exists. Use --force to overwrite.' if pki_file_exist? && !@opts[:force]
+          build_default_config
+          FileUtils.mkdir_p(@opts[:path])
+          save_template
+        end
+      end
+    end
+  end
+end

data/lib/kybus/ssl/cli/update_crl.rb

@@ -0,0 +1,12 @@
+module Kybus
+  module SSL
+    module CLI
+      class UpdateCRL < BaseCommand
+        def run
+          inv = Kybus::SSL::Inventory.load_inventory(@opts[:pki_file])
+          inv.update_crl!
+        end
+      end
+    end
+  end
+end

data/lib/kybus/ssl/cli.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+require_relative 'cli/init'
+require_relative 'cli/add_ca'
+require_relative 'cli/add_certificate'
+require_relative 'cli/build'

data/lib/kybus/ssl/configuration.rb

@@ -11,8 +11,6 @@ module Kybus
       end
 
       def saving_directory(type)
-        path = @config['saving_directory']
-        serial = @config['serial']
         "#{path}/#{serial}.#{type}.pem"
       end
 
@@ -24,10 +22,14 @@ module Kybus
         saving_directory('key')
       end
 
+      def pfx_path
+        "#{path}/#{serial}-#{@config['email'] || @config['name']}.pfx"
+      end
+
       def subject_string
         "/C=#{@config['country']}/ST=#{@config['state']}" \
-        "/L=#{@config['city']}/O=#{@config['organization']}" \
-        "/OU=#{@config['team']}/CN=#{@config['name']}"
+          "/L=#{@config['city']}/O=#{@config['organization']}" \
+          "/OU=#{@config['team']}/CN=#{@config['name']}"
       end
 
       def configure_cert_details!(cert)
@@ -35,14 +37,23 @@ module Kybus
         cert.serial = @config['serial']
         cert.subject = OpenSSL::X509::Name.parse(subject_string)
         cert.not_before = Time.now
-        cert.not_after = cert.not_before + ONE_YEAR * @config['expiration']
+        cert.not_after = cert.not_before + (ONE_YEAR * @config['expiration'])
+      end
+
+      def apply_placeholders(description)
+        if description.include?('$')
+          description.gsub('$email', "email:#{@config['email']}").gsub('$dns', "DNS:#{@config['dns']}")
+        else
+          description
+        end
       end
 
       def configure_extensions!(cert, extension_factory)
         @config['extensions'].each do |name, details|
+          applied_description = apply_placeholders(details['details'])
           extension = extension_factory.create_extension(
             name,
-            details['details'],
+            applied_description,
             details['critical']
           )
           cert.add_extension(extension)
@@ -52,6 +63,15 @@ module Kybus
       def [](key)
         @config[key]
       end
+      private
+
+      def path
+        @config['saving_directory']
+      end
+
+      def serial
+        @config['serial']
+      end
     end
   end
 end

data/lib/kybus/ssl/inventory.rb

@@ -3,6 +3,7 @@
 require_relative 'configuration'
 require_relative 'certificate'
 require_relative 'revocation_list'
+require 'yaml'
 
 require 'fileutils'
 
@@ -23,17 +24,31 @@ module Kybus
         @servers = SubInventory.new(servers, self)
       end
 
+      def self.load_inventory(path)
+        inventory = YAML.load_file(path)
+        data = inventory['certificate_descriptions']
+        new(data['defaults'], data['authorities'], data['clients'], data['servers'])
+      end
+
       def create_certificates!
         validate_inventories!
         create_directory!
         [@authorities, @clients, @servers].each(&:create_certificates!)
       end
 
+      def ca_cert_chain(parent)
+        @authorities.ca_cert_chain(parent)
+      end
+
       # TODO: Implement validation of inventories
       def validate_inventories!
         true
       end
 
+      def update_crl
+        @authorities.update_crl
+      end
+
       def create_directory!
         FileUtils.mkdir_p(@defaults['saving_directory'])
       end
@@ -47,6 +62,8 @@ module Kybus
     # configurations.
     class SubInventory
       def initialize(configs, inventory)
+        raise 'Nil config' if configs.nil?
+
         defaults = configs['defaults']
         @parent = inventory
         @certificates = configs['certificates'].map do |cert|
@@ -59,12 +76,30 @@ module Kybus
         end
       end
 
+      def ca_cert_chain(name)
+        chain = []
+        cert = ca(name)
+
+        while cert && cert.ca_name != 'root'
+          puts cert.ca_name
+          chain << cert.cert
+          cert = @certificates.find { |c| c.ca_name == cert.config['parent'] }
+        end
+        chain
+      end
+
+      def update_crl
+      end
+
       def create_certificates!
         @certificates.each(&:create!)
       end
 
       def ca(name)
-        @certificates.find { |cert| cert.ca_name == name }
+        ca = @certificates.find { |cert| cert.ca_name == name }
+        raise "CA #{name} not found" if ca.nil?
+
+        ca
       end
     end
   end

data/lib/kybus/ssl/revocation_list.rb

@@ -4,7 +4,9 @@ module Kybus
   module SSL
     # Generates revocation list after revocating a list of certs
     # TODO: Implement CRL
+    # rubocop: disable Lint/EmptyClass
     class RevocationList
     end
+    # rubocop: enable Lint/EmptyClass
   end
 end

data/lib/kybus/ssl/version.rb

@@ -2,6 +2,6 @@
 
 module Kybus
   module SSL
-    VERSION = '0.1.0'
+    VERSION = '0.3.1'
   end
 end

metadata

@@ -1,117 +1,55 @@
 --- !ruby/object:Gem::Specification
 name: kybus-ssl
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Gilberto Vargas
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-06-15 00:00:00.000000000 Z
+date: 2025-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: optimist
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.11'
-  type: :development
+        version: '3.0'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.11'
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.12'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.12'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '12.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '12.3'
-- !ruby/object:Gem::Dependency
-  name: rdoc
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '6.1'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '6.1'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.16'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.16'
-- !ruby/object:Gem::Dependency
-  name: webmock
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.5'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.5'
+        version: '3.0'
 description: Package for creating self signed certificates for development purpose
 email:
-- tachoguitar@gmail.com
+- tachomexgems@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
 - lib/kybus/ssl.rb
 - lib/kybus/ssl/certificate.rb
+- lib/kybus/ssl/cli.rb
+- lib/kybus/ssl/cli/add_ca.rb
+- lib/kybus/ssl/cli/add_certificate.rb
+- lib/kybus/ssl/cli/base_command.rb
+- lib/kybus/ssl/cli/build.rb
+- lib/kybus/ssl/cli/init.rb
+- lib/kybus/ssl/cli/update_crl.rb
 - lib/kybus/ssl/configuration.rb
 - lib/kybus/ssl/inventory.rb
 - lib/kybus/ssl/revocation_list.rb
 - lib/kybus/ssl/version.rb
-homepage: https://github.com/KueskiEngineering/ruby-kybus-server
+homepage: https://github.com/tachomex/kybus
 licenses:
 - MIT
-metadata: {}
-post_install_message: 
+metadata:
+  rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -126,8 +64,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.5.9
+signing_key:
 specification_version: 4
 summary: Kybus SSL tools
 test_files: []