puppetserver-ca 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7cdc97b5346544e3f5eaa1b6e8258e7f8ad6356d
-  data.tar.gz: fa5cafd9e26a01d03a0f9ffd73169b4ea98c77f0
+  metadata.gz: 675bbbde6ef2920bff8139cd7cbed1da317a26e4
+  data.tar.gz: 59856cf44f1a0f8629faadb2b69a4a9a66722225
 SHA512:
-  metadata.gz: 96260c55c8b9a1499ce112e20300801306ab9e7ce7ebdaf2a8a0cff5cffb9f692e5b266dccdf1a2df14bb3ff4f6a57dc2b4bb17dc93ce9a2f092b57e6f61a002
-  data.tar.gz: b9ffc226ca976e0359530d89a5c449f1ec089c9e75b560aa0dbb5b5db133900ebbd657d14a96884d55f9d098b963f207f57f5249c3df257e7715ad14ba55e4c2
+  metadata.gz: a4ffd3cbedefabf0ae8c5e33eb173addfea289fd984e9252ecc971d6eea1775a5d8bcfdf6446b1d1aaa1d8d69bb0d6c802afb1e797e50f7ace7304c26794f48f
+  data.tar.gz: 02ae98ec500429f7c4d589c5a2e0d975cb06bce415c09f27caf4f24d0b9cab707bc1bc40bca9ed33596229ea75fc0749252e77bc33e683e3054e32d1b30a28bb

data/lib/puppetserver/ca/action/create.rb

@@ -20,7 +20,7 @@ module Puppetserver
         BANNER = <<-BANNER
 Usage:
   puppetserver ca create [--help]
-  puppetserver ca create [--config] --certname CERTNAME[,ADDLCERTNAME]
+  puppetserver ca create [--config PATH] [--certname CERTNAME[,ADDLCERTNAME]]
 
 Description:
 Creates a new certificate signed by the intermediate CA
@@ -103,11 +103,6 @@ BANNER
           signer = SigningDigest.new
           return 1 if CliParsing.handle_errors(@logger, signer.errors)
 
-          # Make sure we have all the directories where we will be writing files
-          FileSystem.ensure_dir(puppet.settings[:certdir])
-          FileSystem.ensure_dir(puppet.settings[:privatekeydir])
-          FileSystem.ensure_dir(puppet.settings[:publickeydir])
-
           # Generate and save certs and associated keys
           all_passed = generate_certs(certnames, puppet.settings, signer.digest)
           return all_passed ? 0 : 1
@@ -118,6 +113,12 @@ BANNER
         # the signed certs and associated keys. Returns true if all certs were
         # successfully created and saved.
         def generate_certs(certnames, settings, digest)
+          # Make sure we have all the directories where we will be writing files
+          FileSystem.ensure_dirs([settings[:ssldir],
+                                  settings[:certdir],
+                                  settings[:privatekeydir],
+                                  settings[:publickeydir]])
+
           ca = Puppetserver::Ca::CertificateAuthority.new(@logger, settings)
 
           passed = certnames.map do |certname|

data/lib/puppetserver/ca/action/generate.rb

@@ -1,11 +1,9 @@
 require 'optparse'
-require 'openssl'
 require 'puppetserver/ca/utils/file_system'
-require 'puppetserver/ca/host'
+require 'puppetserver/ca/local_certificate_authority'
 require 'puppetserver/ca/utils/cli_parsing'
 require 'puppetserver/ca/utils/signing_digest'
 require 'puppetserver/ca/config/puppet'
-require 'facter'
 
 module Puppetserver
   module Ca
@@ -13,33 +11,6 @@ module Puppetserver
       class Generate
         include Puppetserver::Ca::Utils
 
-        CA_EXTENSIONS = [
-          ["basicConstraints", "CA:TRUE", true],
-          ["keyUsage", "keyCertSign, cRLSign", true],
-          ["subjectKeyIdentifier", "hash", false],
-          ["nsComment", "Puppet Server Internal Certificate", false],
-          ["authorityKeyIdentifier", "keyid:always", false]
-        ].freeze
-
-        SSL_SERVER_CERT = "1.3.6.1.5.5.7.3.1"
-        SSL_CLIENT_CERT = "1.3.6.1.5.5.7.3.2"
-
-        MASTER_EXTENSIONS = [
-          ["basicConstraints", "CA:FALSE", true],
-          ["nsComment", "Puppet Server Internal Certificate", false],
-          ["authorityKeyIdentifier", "keyid:always", false],
-          ["extendedKeyUsage", "#{SSL_SERVER_CERT}, #{SSL_CLIENT_CERT}", true],
-          ["keyUsage", "keyEncipherment, digitalSignature", true],
-          ["subjectKeyIdentifier", "hash", false]
-        ].freeze
-
-        # Make the certificate valid as of yesterday, because so many people's
-        # clocks are out of sync.  This gives one more day of validity than people
-        # might expect, but is better than making every person who has a messed up
-        # clock fail, and better than having every cert we generate expire a day
-        # before the user expected it to when they asked for "one year".
-        CERT_VALID_FROM = (Time.now - (60*60*24)).freeze
-
         SUMMARY = "Generate a root and intermediate signing CA for Puppet Server"
         BANNER = <<-BANNER
 Usage:
@@ -79,10 +50,10 @@ BANNER
           # Load, resolve, and validate puppet config settings
           settings_overrides = {}
           settings_overrides[:certname] = input['certname'] unless input['certname'].empty?
-          settings_overrides[:ca_name] = input['ca_name'] unless input['ca_name'].empty?
+          settings_overrides[:ca_name] = input['ca-name'] unless input['ca-name'].empty?
           # Since puppet expects the key to be called 'dns_alt_names', we need to use that here
           # to ensure that the overriding works correctly.
-          settings_overrides[:dns_alt_names] = input['subject_alt_names'] unless input['subject_alt_names'].empty?
+          settings_overrides[:dns_alt_names] = input['subject-alt-names'] unless input['subject-alt-names'].empty?
 
           puppet = Config::Puppet.new(config_path)
           puppet.load(settings_overrides)
@@ -102,40 +73,28 @@ BANNER
         end
 
         def generate_pki(settings, signing_digest)
-          valid_until = Time.now + settings[:ca_ttl]
-          host = Puppetserver::Ca::Host.new(signing_digest)
-          subject_alt_names = munge_alt_names(settings[:subject_alt_names])
-
-          root_key = host.create_private_key(settings[:keylength])
-          root_cert = self_signed_ca(root_key, settings[:root_ca_name], valid_until, signing_digest)
-          root_crl = create_crl_for(root_cert, root_key, valid_until, signing_digest)
-
-          int_key = host.create_private_key(settings[:keylength])
-          int_csr = host.create_csr(settings[:ca_name], int_key)
-          int_cert = sign_intermediate(root_key, root_cert, int_csr, valid_until, signing_digest)
-          int_crl = create_crl_for(int_cert, int_key, valid_until, signing_digest)
+          ca = Puppetserver::Ca::LocalCertificateAuthority.new(signing_digest, settings)
 
-          master_key = host.create_private_key(settings[:keylength])
-          master_csr = host.create_csr(settings[:certname], master_key)
-          master_cert = sign_master_cert(int_key, int_cert, master_csr,
-                                         valid_until, signing_digest,
-                                         subject_alt_names)
+          root_key, root_cert, root_crl = ca.create_root_cert
+          int_key, int_cert, int_crl = ca.create_intermediate_cert(root_key, root_cert)
+          master_key, master_cert = ca.create_master_cert(int_key, int_cert)
 
-          FileSystem.ensure_dir(settings[:cadir])
-          FileSystem.ensure_dir(settings[:certdir])
-          FileSystem.ensure_dir(settings[:privatekeydir])
-          FileSystem.ensure_dir(settings[:publickeydir])
-          FileSystem.ensure_dir(settings[:signeddir])
+          FileSystem.ensure_dirs([settings[:ssldir],
+                                  settings[:cadir],
+                                  settings[:certdir],
+                                  settings[:privatekeydir],
+                                  settings[:publickeydir],
+                                  settings[:signeddir]])
 
           public_files = [
             [settings[:cacert], [int_cert, root_cert]],
             [settings[:cacrl], [int_crl, root_crl]],
             [settings[:hostcert], master_cert],
             [settings[:localcacert], [int_cert, root_cert]],
-            [settings[:localcacrl], [int_crl, root_crl]],
+            [settings[:hostcrl], [int_crl, root_crl]],
             [settings[:hostpubkey], master_key.public_key],
             [settings[:capub], int_key.public_key],
-            [settings[:cert_inventory], inventory_entry(master_cert)],
+            [settings[:cert_inventory], ca.inventory_entry(master_cert)],
             [settings[:serial], "002"],
             [File.join(settings[:signeddir], "#{settings[:certname]}.pem"), master_cert],
           ]
@@ -146,8 +105,7 @@ BANNER
             [settings[:cakey], int_key],
           ]
 
-          errors = FileSystem.check_for_existing_files(public_files.map(&:first))
-          errors += FileSystem.check_for_existing_files(private_files.map(&:first))
+          errors = FileSystem.check_for_existing_files(public_files.map(&:first) + private_files.map(&:first))
 
           if !errors.empty?
             instructions = <<-ERR
@@ -170,124 +128,6 @@ ERR
           return []
         end
 
-        def self_signed_ca(key, name, valid_until, signing_digest)
-          cert = OpenSSL::X509::Certificate.new
-
-          cert.public_key = key.public_key
-          cert.subject = OpenSSL::X509::Name.new([["CN", name]])
-          cert.issuer = cert.subject
-          cert.version = 2
-          cert.serial = 1
-
-          cert.not_before = CERT_VALID_FROM
-          cert.not_after  = valid_until
-
-          ef = extension_factory_for(cert, cert)
-          CA_EXTENSIONS.each do |ext|
-            extension = ef.create_extension(*ext)
-            cert.add_extension(extension)
-          end
-
-          cert.sign(key, signing_digest)
-
-          cert
-        end
-
-        def inventory_entry(cert)
-          "0x%04x %s %s %s" % [cert.serial, format_time(cert.not_before),
-                               format_time(cert.not_after), cert.subject]
-        end
-
-        def format_time(time)
-          time.strftime('%Y-%m-%dT%H:%M:%S%Z')
-        end
-
-        def extension_factory_for(ca, cert = nil)
-          ef = OpenSSL::X509::ExtensionFactory.new
-          ef.issuer_certificate  = ca
-          ef.subject_certificate = cert if cert
-
-          ef
-        end
-
-        def create_crl_for(ca_cert, ca_key, valid_until, signing_digest)
-          crl = OpenSSL::X509::CRL.new
-          crl.version = 1
-          crl.issuer = ca_cert.subject
-
-          ef = extension_factory_for(ca_cert)
-          crl.add_extension(
-            ef.create_extension(["authorityKeyIdentifier", "keyid:always", false]))
-          crl.add_extension(
-            OpenSSL::X509::Extension.new("crlNumber", OpenSSL::ASN1::Integer(0)))
-
-          crl.last_update = CERT_VALID_FROM
-          crl.next_update = valid_until
-          crl.sign(ca_key, signing_digest)
-
-          crl
-        end
-
-        def sign_intermediate(ca_key, ca_cert, csr, valid_until, signing_digest)
-          cert = OpenSSL::X509::Certificate.new
-
-          cert.public_key = csr.public_key
-          cert.subject = csr.subject
-          cert.issuer = ca_cert.subject
-          cert.version = 2
-          cert.serial = 2
-
-          cert.not_before = CERT_VALID_FROM
-          cert.not_after = valid_until
-
-          ef = extension_factory_for(ca_cert, cert)
-          CA_EXTENSIONS.each do |ext|
-            extension = ef.create_extension(*ext)
-            cert.add_extension(extension)
-          end
-
-          cert.sign(ca_key, signing_digest)
-
-          cert
-        end
-
-        def sign_master_cert(int_key, int_cert, csr, valid_until, signing_digest, subject_alt_names)
-          cert = OpenSSL::X509::Certificate.new
-          cert.public_key = csr.public_key
-          cert.subject = csr.subject
-          cert.issuer = int_cert.subject
-          cert.version = 2
-          cert.serial = 1
-          cert.not_before = CERT_VALID_FROM
-          cert.not_after = valid_until
-
-          ef = extension_factory_for(int_cert, cert)
-          MASTER_EXTENSIONS.each do |ext|
-            extension = ef.create_extension(*ext)
-            cert.add_extension(extension)
-          end
-
-          if !subject_alt_names.empty?
-            alt_names_ext = ef.create_extension("subjectAltName", subject_alt_names, false)
-            cert.add_extension(alt_names_ext)
-          end
-
-          cert.sign(int_key, signing_digest)
-          cert
-        end
-
-        def munge_alt_names(names)
-          raw_names = names.split(/\s*,\s*/).map(&:strip)
-          munged_names = raw_names.map do |name|
-            # Prepend the DNS tag if no tag was specified
-            if !name.start_with?("IP:") && !name.start_with?("DNS:")
-              "DNS:#{name}"
-            else
-              name
-            end
-          end.sort.uniq.join(", ")
-        end
-
         def parse(cli_args)
           results = {}
           parser = self.class.parser(results)
@@ -298,8 +138,8 @@ ERR
         end
 
         def self.parser(parsed = {})
-          parsed['subject_alt_names'] = ''
-          parsed['ca_name'] = ''
+          parsed['subject-alt-names'] = ''
+          parsed['ca-name'] = ''
           parsed['certname'] = ''
           OptionParser.new do |opts|
             opts.banner = BANNER
@@ -311,11 +151,11 @@ ERR
             end
             opts.on('--subject-alt-names NAME1[,NAME2]',
                     'Subject alternative names for the master cert') do |sans|
-              parsed['subject_alt_names'] = sans
+              parsed['subject-alt-names'] = sans
             end
             opts.on('--ca-name NAME',
                     'Common name to use for the CA signing cert') do |name|
-              parsed['ca_name'] = name
+              parsed['ca-name'] = name
             end
             opts.on('--certname NAME',
                     'Common name to use for the master cert') do |name|

data/lib/puppetserver/ca/action/import.rb

@@ -2,7 +2,9 @@ require 'optparse'
 require 'puppetserver/ca/utils/file_system'
 require 'puppetserver/ca/x509_loader'
 require 'puppetserver/ca/config/puppet'
+require 'puppetserver/ca/local_certificate_authority'
 require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/utils/signing_digest'
 
 module Puppetserver
   module Ca
@@ -15,12 +17,16 @@ module Puppetserver
 Usage:
   puppetserver ca import [--help]
   puppetserver ca import [--config PATH] [--certname NAME]
+                         [--subject-alt-names ALTNAME1[,ALTNAME2...]]
       --private-key PATH --cert-bundle PATH --crl-chain PATH
 
 Description:
 Given a private key, cert bundle, and a crl chain,
 validate and import to the Puppet Server CA.
 
+Note that the cert and crl provided for the leaf CA must not
+have already issued or revoked any certificates.
+
 To determine the target location the default puppet.conf
 is consulted for custom values. If using a custom puppet.conf
 provide it with the --config flag
@@ -48,16 +54,53 @@ BANNER
 
           settings_overrides = {}
           settings_overrides[:certname] = input['certname'] unless input['certname'].empty?
+          settings_overrides[:dns_alt_names] = input['subject-alt-names'] unless input['subject-alt-names'].empty?
+
           puppet = Config::Puppet.new(config_path)
           puppet.load(settings_overrides)
           return 1 if CliParsing.handle_errors(@logger, puppet.errors)
 
-          target_locations = [puppet.settings[:cacert],
-                              puppet.settings[:cakey],
-                              puppet.settings[:cacrl],
-                              puppet.settings[:serial],
-                              puppet.settings[:cert_inventory]]
-          errors = FileSystem.check_for_existing_files(target_locations)
+          # Load most secure signing digest we can for cers/crl/csr signing.
+          signer = SigningDigest.new
+          return 1 if CliParsing.handle_errors(@logger, signer.errors)
+
+          errors = import(loader, puppet.settings, signer.digest)
+          return 1 if CliParsing.handle_errors(@logger, errors)
+
+          @logger.inform "Import succeeded. Find your files in #{puppet.settings[:cadir]}"
+          return 0
+        end
+
+        def import(loader, settings, signing_digest)
+          ca = Puppetserver::Ca::LocalCertificateAuthority.new(signing_digest, settings)
+          master_key, master_cert = ca.create_master_cert(loader.key, loader.certs.first)
+
+          FileSystem.ensure_dirs([settings[:ssldir],
+                                  settings[:cadir],
+                                  settings[:certdir],
+                                  settings[:privatekeydir],
+                                  settings[:publickeydir],
+                                  settings[:signeddir]])
+
+          public_files = [
+            [settings[:cacert], loader.certs],
+            [settings[:cacrl], loader.crls],
+            [settings[:localcacert], loader.certs],
+            [settings[:hostcrl], loader.crls],
+            [settings[:hostpubkey], master_key.public_key],
+            [settings[:hostcert], master_cert],
+            [settings[:cert_inventory], ca.inventory_entry(master_cert)],
+            [settings[:serial], "0x0002"],
+            [File.join(settings[:signeddir], "#{settings[:certname]}.pem"), master_cert]
+          ]
+
+          private_files = [
+            [settings[:hostprivkey], master_key],
+            [settings[:cakey], loader.key],
+          ]
+
+          errors = FileSystem.check_for_existing_files(public_files.map(&:first) + private_files.map(&:first))
+
           if !errors.empty?
             instructions = <<-ERR
 If you would really like to replace your CA, please delete the existing files first.
@@ -65,24 +108,18 @@ Note that any certificates that were issued by this CA will become invalid if yo
 replace it!
 ERR
             errors << instructions
-            CliParsing.handle_errors(@logger, errors)
-            return 1
+            return errors
           end
 
-          FileSystem.ensure_dir(puppet.settings[:cadir])
-
-          FileSystem.write_file(puppet.settings[:cacert], loader.certs, 0640)
-
-          FileSystem.write_file(puppet.settings[:cakey], loader.key, 0640)
-
-          FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0640)
+          public_files.each do |location, content|
+            FileSystem.write_file(location, content, 0644)
+          end
 
-          # Puppet's internal CA expects these file to exist.
-          FileSystem.ensure_file(puppet.settings[:serial], "001", 0640)
-          FileSystem.ensure_file(puppet.settings[:cert_inventory], "", 0640)
+          private_files.each do |location, content|
+            FileSystem.write_file(location, content, 0640)
+          end
 
-          @logger.inform "Import succeeded. Find your files in #{puppet.settings[:cadir]}"
-          return 0
+          return []
         end
 
         def check_flag_usage(results)
@@ -110,6 +147,8 @@ ERR
         end
 
         def self.parser(parsed = {})
+          parsed['certname'] = ''
+          parsed['subject-alt-names'] = ''
           OptionParser.new do |opts|
             opts.banner = BANNER
             opts.on('--help', 'Display this import specific help output') do |help|
@@ -131,6 +170,10 @@ ERR
                     'Common name to use for the master cert') do |name|
               parsed['certname'] = name
             end
+            opts.on('--subject-alt-names NAME1[,NAME2]',
+                    'Subject alternative names for the master cert') do |sans|
+              parsed['subject-alt-names'] = sans
+            end
           end
         end
       end

data/lib/puppetserver/ca/config/puppet.rb

@@ -126,9 +126,8 @@ module Puppetserver
             :ca_server => '$server',
             :ca_port => '$masterport',
             :localcacert => '$certdir/ca.pem',
-            :localcacrl => '$ssldir/crl.pem',
-            :hostcert => '$certdir/$certname.pem',
             :hostcrl => '$ssldir/crl.pem',
+            :hostcert => '$certdir/$certname.pem',
             :hostprivkey => '$privatekeydir/$certname.pem',
             :hostpubkey => '$publickeydir/$certname.pem',
             :publickeydir => '$ssldir/public_keys',
@@ -153,12 +152,13 @@ module Puppetserver
             settings[setting_name] = setting_value
           end
 
+          # rename dns_alt_names to subject_alt_names now that we support IP alt names
+          settings[:subject_alt_names] = overrides.fetch(:dns_alt_names, "puppet,$certname")
+
           # Some special cases where we need to manipulate config settings:
           settings[:ca_ttl] = munge_ttl_setting(settings[:ca_ttl])
           settings[:certificate_revocation] = parse_crl_usage(settings[:certificate_revocation])
-
-          # rename dns_alt_names to subject_alt_names now that we support IP alt names
-          settings[:subject_alt_names] = overrides.fetch(:dns_alt_names, "puppet,$certname")
+          settings[:subject_alt_names] = munge_alt_names(settings[:subject_alt_names])
 
           settings.each do |key, value|
             next unless value.is_a? String
@@ -227,6 +227,17 @@ module Puppetserver
           end
         end
 
+        def munge_alt_names(names)
+          raw_names = names.split(/\s*,\s*/).map(&:strip)
+          munged_names = raw_names.map do |name|
+            # Prepend the DNS tag if no tag was specified
+            if !name.start_with?("IP:") && !name.start_with?("DNS:")
+              "DNS:#{name}"
+            else
+              name
+            end
+          end.sort.uniq.join(", ")
+        end
 
         def parse_crl_usage(setting)
           case setting.to_s

data/lib/puppetserver/ca/local_certificate_authority.rb

@@ -0,0 +1,177 @@
+require 'puppetserver/ca/host'
+
+require 'openssl'
+
+module Puppetserver
+  module Ca
+    class LocalCertificateAuthority
+
+      # Make the certificate valid as of yesterday, because so many people's
+      # clocks are out of sync.  This gives one more day of validity than people
+      # might expect, but is better than making every person who has a messed up
+      # clock fail, and better than having every cert we generate expire a day
+      # before the user expected it to when they asked for "one year".
+      CERT_VALID_FROM = (Time.now - (60*60*24)).freeze
+
+      SSL_SERVER_CERT = "1.3.6.1.5.5.7.3.1"
+      SSL_CLIENT_CERT = "1.3.6.1.5.5.7.3.2"
+
+      MASTER_EXTENSIONS = [
+        ["basicConstraints", "CA:FALSE", true],
+        ["nsComment", "Puppet Server Internal Certificate", false],
+        ["authorityKeyIdentifier", "keyid:always", false],
+        ["extendedKeyUsage", "#{SSL_SERVER_CERT}, #{SSL_CLIENT_CERT}", true],
+        ["keyUsage", "keyEncipherment, digitalSignature", true],
+        ["subjectKeyIdentifier", "hash", false]
+      ].freeze
+
+      CA_EXTENSIONS = [
+        ["basicConstraints", "CA:TRUE", true],
+        ["keyUsage", "keyCertSign, cRLSign", true],
+        ["subjectKeyIdentifier", "hash", false],
+        ["nsComment", "Puppet Server Internal Certificate", false],
+        ["authorityKeyIdentifier", "keyid:always", false]
+      ].freeze
+
+      def initialize(digest, settings)
+        @digest = digest
+        @host = Host.new(digest)
+        @settings = settings
+      end
+
+      def valid_until
+        Time.now + @settings[:ca_ttl]
+      end
+
+      def extension_factory_for(ca, cert = nil)
+        ef = OpenSSL::X509::ExtensionFactory.new
+        ef.issuer_certificate  = ca
+        ef.subject_certificate = cert if cert
+
+        ef
+      end
+
+      def inventory_entry(cert)
+        "0x%04x %s %s %s" % [cert.serial, format_time(cert.not_before),
+                             format_time(cert.not_after), cert.subject]
+      end
+
+      def format_time(time)
+        time.strftime('%Y-%m-%dT%H:%M:%S%Z')
+      end
+
+      def create_master_cert(ca_key, ca_cert)
+        master_key = @host.create_private_key(@settings[:keylength])
+        master_csr = @host.create_csr(@settings[:certname], master_key)
+        master_cert = sign_master_cert(ca_key, ca_cert, master_csr)
+        return master_key, master_cert
+      end
+
+      def sign_master_cert(int_key, int_cert, csr)
+        cert = OpenSSL::X509::Certificate.new
+        cert.public_key = csr.public_key
+        cert.subject = csr.subject
+        cert.issuer = int_cert.subject
+        cert.version = 2
+        cert.serial = 1
+        cert.not_before = CERT_VALID_FROM
+        cert.not_after = valid_until
+
+        ef = extension_factory_for(int_cert, cert)
+        MASTER_EXTENSIONS.each do |ext|
+          extension = ef.create_extension(*ext)
+          cert.add_extension(extension)
+        end
+
+        if !@settings[:subject_alt_names].empty?
+          alt_names_ext = ef.create_extension("subjectAltName", @settings[:subject_alt_names], false)
+          cert.add_extension(alt_names_ext)
+        end
+
+        cert.sign(int_key, @digest)
+        cert
+      end
+
+      def create_root_cert
+        root_key = @host.create_private_key(@settings[:keylength])
+        root_cert = self_signed_ca(root_key)
+        root_crl = create_crl_for(root_cert, root_key)
+
+        return root_key, root_cert, root_crl
+      end
+
+      def self_signed_ca(key)
+        cert = OpenSSL::X509::Certificate.new
+
+        cert.public_key = key.public_key
+        cert.subject = OpenSSL::X509::Name.new([["CN", @settings[:root_ca_name]]])
+        cert.issuer = cert.subject
+        cert.version = 2
+        cert.serial = 1
+
+        cert.not_before = CERT_VALID_FROM
+        cert.not_after  = valid_until
+
+        ef = extension_factory_for(cert, cert)
+        CA_EXTENSIONS.each do |ext|
+          extension = ef.create_extension(*ext)
+          cert.add_extension(extension)
+        end
+
+        cert.sign(key, @digest)
+
+        cert
+      end
+
+      def create_crl_for(cert, key)
+        crl = OpenSSL::X509::CRL.new
+        crl.version = 1
+        crl.issuer = cert.subject
+
+        ef = extension_factory_for(cert)
+        crl.add_extension(
+          ef.create_extension(["authorityKeyIdentifier", "keyid:always", false]))
+        crl.add_extension(
+          OpenSSL::X509::Extension.new("crlNumber", OpenSSL::ASN1::Integer(0)))
+
+        crl.last_update = CERT_VALID_FROM
+        crl.next_update = valid_until
+        crl.sign(key, @digest)
+
+        crl
+      end
+
+      def create_intermediate_cert(root_key, root_cert)
+        int_key = @host.create_private_key(@settings[:keylength])
+        int_csr = @host.create_csr(@settings[:ca_name], int_key)
+        int_cert = sign_intermediate(root_key, root_cert, int_csr)
+        int_crl = create_crl_for(int_cert, int_key)
+
+        return int_key, int_cert, int_crl
+      end
+
+      def sign_intermediate(ca_key, ca_cert, csr)
+        cert = OpenSSL::X509::Certificate.new
+
+        cert.public_key = csr.public_key
+        cert.subject = csr.subject
+        cert.issuer = ca_cert.subject
+        cert.version = 2
+        cert.serial = 2
+
+        cert.not_before = CERT_VALID_FROM
+        cert.not_after = valid_until
+
+        ef = extension_factory_for(ca_cert, cert)
+        CA_EXTENSIONS.each do |ext|
+          extension = ef.create_extension(*ext)
+          cert.add_extension(extension)
+        end
+
+        cert.sign(ca_key, @digest)
+
+        cert
+      end
+    end
+  end
+end

data/lib/puppetserver/ca/utils/file_system.rb

@@ -6,6 +6,15 @@ module Puppetserver
     module Utils
       class FileSystem
 
+        DIR_MODES = {
+          :ssldir => 0771,
+          :cadir => 0755,
+          :certdir => 0755,
+          :privatekeydir => 0750,
+          :publickeydir => 0755,
+          :signeddir => 0755
+        }
+
         def self.instance
           @instance ||= new
         end
@@ -14,13 +23,9 @@ module Puppetserver
           instance.write_file(*args)
         end
 
-        def self.ensure_dir(setting)
-          instance.ensure_dir(setting)
-        end
-
-        def self.ensure_file(location, content, mode)
-          if !File.exist?(location)
-            instance.write_file(location, content, mode)
+        def self.ensure_dirs(one_or_more_dirs)
+          Array(one_or_more_dirs).each do |directory|
+            instance.ensure_dir(directory)
           end
         end
 
@@ -78,10 +83,11 @@ module Puppetserver
           FileUtils.chown(@user, @group, path)
         end
 
-        def ensure_dir(setting)
-          if !File.exist?(setting)
-            FileUtils.mkdir_p(setting, mode: 0750)
-            FileUtils.chown(@user, @group, setting)
+        # Warning: directory mode should be specified in DIR_MODES above
+        def ensure_dir(directory)
+          if !File.exist?(directory)
+            FileUtils.mkdir_p(directory, mode: DIR_MODES[directory])
+            FileUtils.chown(@user, @group, directory)
           end
         end
       end

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "0.4.1"
+    VERSION = "0.4.2"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-08-24 00:00:00.000000000 Z
+date: 2018-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter
@@ -105,6 +105,7 @@ files:
 - lib/puppetserver/ca/config/puppet.rb
 - lib/puppetserver/ca/config/puppetserver.rb
 - lib/puppetserver/ca/host.rb
+- lib/puppetserver/ca/local_certificate_authority.rb
 - lib/puppetserver/ca/logger.rb
 - lib/puppetserver/ca/stub.rb
 - lib/puppetserver/ca/utils/cli_parsing.rb