letscert 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 52add53a57fa00b0778f2a493f17f60c52c66420
-  data.tar.gz: 918a0428e5ec2c2c7f05c29eb41fcd60cd43a5f6
+  metadata.gz: 510c269bc1fe51684e676d4b566f03535f5d8a58
+  data.tar.gz: 241b3100db0e5bf7682273adceed0a6ed164bb4a
 SHA512:
-  metadata.gz: 7a5017b39b842d751148c95666fc2372c4af7158c2dada7ad5b5d4dd6e53fe1d38582090827271611fc7ddb94c1e8c8473f0ed6837f855e3c66eedca38b544b4
-  data.tar.gz: 9c9462d83f3b2fecba4c0d3ef73760257d4814df0aeb8aafeb177f096e34fec2ed896f8cea923b37ed358592c1b345ca8de1cd03c93b6f43df0dc44647502987
+  metadata.gz: f14a0d228cd125277d4c55df41417e62d761492496b5cd02bc43a2c333f8c47329206c39a1bd579030059601da6c40c0aac8701f2b148642c766c90e8e18bedc
+  data.tar.gz: be1d7083454b4e65580e6de083e020ee7705ac59a652fe6c44cea85f5ab3195a634576597bcd0ddc28825848c3c1816b703e3f25ab6643addd3811567a387051

data/README.md

@@ -26,8 +26,11 @@ letscert -d example.org:/var/www/example.org/html --email my.name@example.org \
   -f account_key.json -f key.pem -f cert.pem -f chain.pem
 ```
 
-Commands are the sames for certificate renewal.
+Theses commands generate RSA certificates, using a RSA account key. To generate ECDSA
+keys and certificates, use `--cert-ecdsa CURVE` (CURVE: `prime256v1` or `sec384r1`)
+and/or `--account-key-type ecdsa` options.
 
+Commands are the sames for certificate renewal.
 
 ## Generate a key pair and get a signed certificate for multi-domains:
 Generate a single certificate for `example.org` and `www.example.org`:

data/letscert.gemspec

@@ -23,7 +23,7 @@ EOF
 
   s.required_ruby_version = '>= 2.1.0'
 
-  s.add_dependency 'acme-client', '~>0.5.5'
+  s.add_dependency 'acme-client', '~>0.6.1'
 
   s.add_development_dependency 'bundler', '~> 1.12'
   s.add_development_dependency 'rake', '~> 11.0'

data/lib/letscert/certificate.rb

@@ -50,7 +50,7 @@ module LetsCert
     # @param [OpenSSL::PKey::PKey,nil] account_key private key to
     #   authenticate to ACME server
     # @param [OpenSSL::PKey::PKey, nil] key private key from which make a
-    #   certificate. If +nil+, generate a new one with +options[:cet_key_size]+
+    #   certificate. If +nil+, generate a new one with +options[:cert_key_size]+
     #   bits.
     # @param [Hash] options option hash
     # @option options [Fixnum] :account_key_size ACME account private key size
@@ -72,6 +72,9 @@ module LetsCert
       check_roots(options[:roots])
       logger.debug { "webroots are: #{options[:roots].inspect}" }
 
+      account_key = get_account_key(account_key, options[:account_key_type],
+                                    options[:account_key_size])
+
       client = get_acme_client(account_key, options)
 
       do_challenges client, options[:roots]
@@ -88,7 +91,7 @@ module LetsCert
 
       options[:files] ||= []
       options[:files].each do |plugname|
-        IOPlugin.registered[plugname].save(account_key: client.private_key,
+        IOPlugin.registered[plugname].save(account_key: account_key,
                                            key: pkey, cert: @cert,
                                            chain: @chain)
       end
@@ -157,10 +160,8 @@ module LetsCert
     def get_acme_client(account_key, options)
       return @client if @client
 
-      key = get_account_key(account_key, options[:account_key_size])
-
       logger.debug { "connect to #{options[:server]}" }
-      @client = Acme::Client.new(private_key: key, endpoint: options[:server])
+      @client = Acme::Client.new(private_key: account_key, endpoint: options[:server])
 
       yield @client if block_given?
 
@@ -212,12 +213,28 @@ module LetsCert
 
     # Generate a new account key if no one is given in +data+
     # @param [OpenSSL::PKey,nil] key
+    # @param [String] key_type +'rsa'+ or +'ecdsa'+
     # @param [Integer] key_size
     # @return [OpenSSL::PKey::PKey]
-    def get_account_key(key, key_size)
+    def get_account_key(key, key_type, key_size)
       if key.nil?
         logger.info { 'No account key. Generate a new one...' }
-        OpenSSL::PKey::RSA.new(key_size)
+        case key_type
+        when 'rsa'
+          OpenSSL::PKey::RSA.new key_size
+        when 'ecdsa'
+          curve = case key_size
+                  when 256
+                    'prime256v1'
+                  when 384
+                    'secp384r1'
+                  else
+                    raise Error, 'ECDSA account key size: only 256 or 384 bits'
+                  end
+          generate_ecdsa_key curve
+        else
+          raise Error, "unsupported '#{key_type}' account key type"
+        end
       else
         key
       end
@@ -313,8 +330,10 @@ module LetsCert
       end
 
       if options[:cert_ecdsa]
+        logger.debug { "generate a #{options[:cert_ecdsa]}-bit ECDSA private key" }
         generate_ecdsa_key options[:cert_ecdsa]
       else
+        logger.debug { "generate a #{options[:cert_rsa]}-bit RSA private key" }
         OpenSSL::PKey::RSA.generate options[:cert_rsa]
       end
     end
@@ -351,8 +370,10 @@ module LetsCert
     # @param [OpenSSL::PKey::PKey] pkey private key to use
     # @return [OpenSSL::PKey::PKey] +pkey+
     def generate_certificate_from_pkey(domains, pkey)
+      logger.debug { 'generate certificate request' }
       csr = Acme::Client::CertificateRequest.new(names: domains,
                                                  private_key: pkey)
+      logger.debug { 'requesting certificate...' }
       acme_cert = client.new_certificate(csr)
       @cert = acme_cert.x509
       @chain = acme_cert.x509_chain

data/lib/letscert/runner.rb

@@ -45,6 +45,12 @@ module LetsCert
     # Default key size for RSA certificates
     RSA_DEFAULT_KEY_SIZE = 2048
 
+    # Default account key size for RSA type
+    RSA_DEFAULT_ACCOUNT_KEY_SIZE = 4096
+
+    # Default account key size for ECDSA type
+    ECDSA_DEFAULT_ACCOUNT_KEY_SIZE = 384
+
     # Get options
     # @return [Hash]
     attr_reader :options
@@ -66,7 +72,7 @@ module LetsCert
         domains: [],
         files: [],
         valid_min: ValidTime.new('30d'),
-        account_key_size: 4096,
+        account_key_type: 'rsa',
         tos_sha256: '33d233c8ab558ba6c8ebc370a509acdded8b80e5d587aa5d192193f3' \
                     '5226540f',
         server: 'https://acme-v01.api.letsencrypt.org/directory'
@@ -188,9 +194,16 @@ module LetsCert
                        ' specified  by --server')
         opts.separator('')
 
+        opts.on('--account-key-type TYPE', %w(rsa ecdsa),
+                'Account key type: rsa or ecdsa',
+                '(Defaul: rsa)') do |type|
+          @options[:account_key_type] = type
+        end
+
         opts.on('--account-key-size BITS', Integer,
                 'Account key size (default: ' \
-                "#{@options[:account_key_size]})") do |bits|
+                "#{RSA_DEFAULT_ACCOUNT_KEY_SIZE} (RSA) or ",
+                "#{ECDSA_DEFAULT_ACCOUNT_KEY_SIZE} (ECDSA))") do |bits|
           @options[:account_key_size] = bits
         end
 
@@ -221,6 +234,7 @@ module LetsCert
       @opt_parser.parse!
       compute_roots
       select_default_cert_type_if_none_specified
+      select_default_account_key_size_if_none_specified
     end
 
     # Check all components are covered by plugins
@@ -374,6 +388,15 @@ module LetsCert
       end
     end
 
+    def select_default_account_key_size_if_none_specified
+      case @options[:account_key_type]
+      when 'rsa'
+        @options[:account_key_size] ||= RSA_DEFAULT_ACCOUNT_KEY_SIZE
+      when 'ecdsa'
+        @options[:account_key_size] ||= ECDSA_DEFAULT_ACCOUNT_KEY_SIZE
+      end
+    end
+
     def persisted_data
       persisted = IOPlugin.empty_data
       @options[:files].each do |file|

data/lib/letscert/version.rb

@@ -1,6 +1,6 @@
 module LetsCert
 
   # Letscert version number
-  VERSION = '0.5.0'.freeze
+  VERSION = '0.6.0'.freeze
 
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: letscert
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Sylvain Daubert
@@ -31,7 +31,7 @@ cert_chain:
   dMi8WSKt03lfzyxIqZseBwVYYn+XMlzCcJLXCUgZXHcBRRRDH5wGDqOqXjL25b2O
   6m3JJngqkCFrOw==
   -----END CERTIFICATE-----
-date: 2017-04-18 00:00:00.000000000 Z
+date: 2017-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acme-client
@@ -39,14 +39,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.5
+        version: 0.6.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.5
+        version: 0.6.1
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement