localhost 1.1.1 → 1.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 65d8e8c80055732d6028c82af3d645ebbe7105cef6eac392e571dc72ffd65e66
-  data.tar.gz: 3c839b359643656292bbd22c9e6d29c821a33be93eb70aa9b35aefbf297ab505
+  metadata.gz: bdb38bb72334de27b11b1eee998475657887f85f47f81a44b31888964d9fe88d
+  data.tar.gz: c71c4fa7959047645b0508145f3f9e6b9e6ee6fd42a54b009dd2cb5e7c1ef0c9
 SHA512:
-  metadata.gz: 3e7bb5f0b7a5a6bdb365e6bf89beaa5cf78bb8d252cfbfc0490efb54132fb834449109fb697c38e08edb567050c155ef095897f2da21d9b3e7151459315462e2
-  data.tar.gz: 4673411dbe5b27cd6a591735b8df05c8524e9fa7d3a5ce60ee0a6cff4b0a7d25e1b0478123d7795f3f02e1e48798835277e3b4b1d7d48aadeb7f06e6ecb847e1
+  metadata.gz: e8e4444acb08913da2359a9780869bdfdad35329a037822552d8f13a9c352fff51388a7070626c394d5ab7bbded237444e859aae68571e871e99d69ff8ad3503
+  data.tar.gz: 0cd28c7367ab533aa99a5dda6b4dc05485b6a8c79dd35ed68782ba29eb10fe16fe99d067e1bd13d99056cd9539600c228ecb8567f909bf96ffa3e5a5826f4076

data/README.md

@@ -61,9 +61,27 @@ server_thread.join
 
 If you use Safari to access such a server, it will allow you to add the certificate to your keychain without much work. Once you've done this, you won't need to do it again for any other site when running such a development environment from the same user account.
 
+### Safari
+
+If you use this with a web server, when you open the site in Safari:
+
+![Safari](media/safari.png)
+
+- Click "View the certificate" to check that it is the correct certificate.
+- Click "visit this website" which will prompt you to add the certificate to your keychain. Once you've done this, it should work for a long time.
+
+### Chrome
+
+If you use this with a web server, when you open the site in Safari:
+
+![Chrome](media/chrome.png)
+
+- Click "ADVANCED" to see additional details, including...
+- Click "Proceed to localhost (unsafe)" which will allow you to use the site for the current browser session.
+
 ### Files
 
-The certificate and private key are stored in `~/.localhost/`.
+The certificate and private key are stored in `~/.localhost/`. You can delete them and they will be regenerated. If you added the certificate to your keychain, you'll probably want to delete that too.
 
 ## Contributing
 

data/lib/localhost/authority.rb

@@ -50,13 +50,21 @@ module Localhost
 		end
 		
 		def key
-			@key ||= OpenSSL::PKey::RSA.new(1024)
+			@key ||= OpenSSL::PKey::RSA.new(1024*2)
+		end
+		
+		def key= key
+			@key = key
 		end
 		
 		def name
 			@name ||= OpenSSL::X509::Name.parse("O=Development/CN=#{@hostname}")
 		end
 		
+		def name= name
+			@name = name
+		end
+		
 		def certificate
 			@certificate ||= OpenSSL::X509::Certificate.new.tap do |certificate|
 				certificate.subject = self.name
@@ -66,6 +74,7 @@ module Localhost
 				certificate.public_key = self.key.public_key
 				
 				certificate.serial = 1
+				certificate.version = 2
 				
 				certificate.not_before = Time.now
 				certificate.not_after = Time.now + (3600 * 24 * 365 * 10)
@@ -74,11 +83,13 @@ module Localhost
 				extension_factory.subject_certificate = certificate
 				extension_factory.issuer_certificate = certificate
 				
-				# Because we are using a self-signed root certificate, we also need to make it a "pseudo-CA".
-				# https://security.stackexchange.com/questions/143061/does-openssl-refuse-self-signed-certificates-without-basic-constraints
-				certificate.add_extension extension_factory.create_extension("basicConstraints", "CA:TRUE", true)
-				certificate.add_extension extension_factory.create_extension("keyUsage", "keyCertSign, cRLSign, digitalSignature", true)
-				certificate.add_extension extension_factory.create_extension("subjectKeyIdentifier", "hash")
+				certificate.extensions = [
+					extension_factory.create_extension("basicConstraints", "CA:FALSE", true),
+					extension_factory.create_extension("subjectKeyIdentifier", "hash"),
+				]
+				
+				certificate.add_extension extension_factory.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
+				certificate.add_extension extension_factory.create_extension("subjectAltName", "DNS: #{@hostname}")
 				
 				certificate.sign self.key, OpenSSL::Digest::SHA256.new
 			end
@@ -99,10 +110,6 @@ module Localhost
 				context.session_id_context = "localhost"
 				
 				context.set_params
-				
-				if context.respond_to? :verify_hostname=
-					context.verify_hostname = false
-				end
 			end
 		end
 		
@@ -113,21 +120,24 @@ module Localhost
 				context.set_params(
 					verify_mode: OpenSSL::SSL::VERIFY_PEER,
 				)
-				
-				if context.respond_to? :verify_hostname=
-					context.verify_hostname = false
-				end
 			end
 		end
 		
 		def load(path)
-			if File.directory? path
+			if File.directory? path	
+				certificate_path = File.join(path, "#{@hostname}.crt")
 				key_path = File.join(path, "#{@hostname}.key")
-				return false unless File.exist?(key_path)
-				@key = OpenSSL::PKey::RSA.new(File.read(key_path))
 				
-				certificate_path = File.join(path, "#{@hostname}.crt")
-				@certificate = OpenSSL::X509::Certificate.new(File.read(certificate_path))
+				return false unless File.exist?(certificate_path) and File.exist?(key_path)
+				
+				certificate = OpenSSL::X509::Certificate.new(File.read(certificate_path))
+				key = OpenSSL::PKey::RSA.new(File.read(key_path))
+				
+				# Certificates with old version need to be regenerated.
+				return false if certificate.version < 2
+				
+				@certificate = certificate
+				@key = key
 				
 				return true
 			end

data/lib/localhost/version.rb

@@ -19,5 +19,5 @@
 # THE SOFTWARE.
 
 module Localhost
-	VERSION = "1.1.1"
+	VERSION = "1.1.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: localhost
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.1.2
 platform: ruby
 authors:
 - Samuel Williams
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-08-09 00:00:00.000000000 Z
+date: 2018-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -69,6 +69,8 @@ files:
 - lib/localhost/authority.rb
 - lib/localhost/version.rb
 - localhost.gemspec
+- media/chrome.png
+- media/safari.png
 homepage: https://github.com/socketry/localhost
 licenses: []
 metadata: {}