r509-cert-validator 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: f1727921e4d1ea7764cfd809a42478d3ec8cb4cf
+  data.tar.gz: ecca2f905cfe41c45a7130d3eeb095fecff9693a
+SHA512:
+  metadata.gz: 711bb8c8d34ffbbefcd0859f512cee2056696f2d047ff8c60ed6d629186122c0986501914db7397d726e997da1ec5bf26e3d4469e277750fd80962102298e4db
+  data.tar.gz: 5f4d58440734468761e8f8eb9363246f3cb12a05de8dd0aa27ab0e33fe15d933d38f62c3f37efc0e08b270f9e174907c089676b582ca4fea58ba1ef3d358c483

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/.rspec

@@ -0,0 +1 @@
+--color

data/.travis.yml

@@ -0,0 +1,6 @@
+language: ruby
+cache: bundler
+script: ./travis.sh
+rvm:
+  - 2.0.0
+  - 2.1.0

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in r509-cert-validator.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2014 Bryce Kerley
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,70 @@
+# R509::Cert::Validator
+
+Have an x.509 certificate that you need to validate against its Online
+Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL)
+endpoint? This gem uses the `r509` library for x.509 processing, and performs
+OCSP and CRL processing.
+
+[![Build Status](https://travis-ci.org/bkerley/r509-cert-validator.png?branch=master)](https://travis-ci.org/bkerley/r509-cert-validator)
+[![Code Climate](https://codeclimate.com/github/bkerley/r509-cert-validator.png)](https://codeclimate.com/github/bkerley/r509-cert-validator)
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'r509-cert-validator'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install r509-cert-validator
+
+## Usage
+
+```ruby
+validator = R509::Cert::Validator.new @socket.peer_cert
+
+# Returns false on invalid certificates
+# Raises R509::Cert::Validator::Error when checking failed
+validator.validate 
+
+# Raises R509::Cert::Validator::CrlError and
+#        R509::Cert::Validator::OcspError on invalid certificates
+# Raises R509::Cert::Validator::Error when checking failed
+validator.validate!
+
+# OCSP and CRL checking are enabled when present in certificates, but
+# can be disabled individually
+validator.validate ocsp: false
+validator.validate! crl: false
+
+# Attempting to validate OCSP and/or CRL when a cert does not have them raises
+# R509::Cert::Validator::Error
+validator.validate ocsp: true
+```
+
+## Development and Testing
+
+This library requires a bit of Public Key Infrastructure (PKI) for testing.
+Fortunately, it's easy to set up.
+
+0. Install dependencies with `bundle install`.
+0. Optional: clean out the existing PKI with `rake ca:clean`
+1. Generate a CA and testing certificates with `rake ca:all`
+2. Start the CRL and OCSP endpoint with `bundle exec ruby spec/support/ca_server.rb`
+   and let it run. This command starts a web server on port 22022.
+3. Run the specs with `bundle exec rspec`
+4. CTRL-C or otherwise kill the CRL and OCSP server when you no longer need it.
+
+This process is automated by `travis.sh`, and you can just run that :)
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request

data/Rakefile

@@ -0,0 +1,8 @@
+require "bundler/gem_tasks"
+require 'rspec/core/rake_task'
+require_relative './lib/tasks/ca'
+
+task :default => :spec
+
+desc "Run Specs"
+RSpec::Core::RakeTask.new :spec

data/lib/r509-cert-validator.rb

@@ -0,0 +1 @@
+require 'r509/cert/validator'

data/lib/r509/cert/validator.rb

@@ -0,0 +1,62 @@
+require 'r509'
+%w{version errors basic_validator ocsp_validator crl_validator}.each do |f|
+  require "r509/cert/validator/#{f}"
+end
+
+module R509
+  class Cert
+    class Validator
+      # The certificate this Validator will validate
+      attr_reader :cert
+
+      def initialize(cert, issuer = nil)
+        if cert.is_a? OpenSSL::X509::Certificate
+          cert = R509::Cert.new cert: cert
+        end
+        
+        if issuer.is_a? OpenSSL::X509::Certificate
+          cert = R509::Cert.new cert: cert
+        end
+
+        @cert = cert
+        @issuer = issuer
+
+        initialize_validators
+      end
+
+      def validate!(options={})
+        opts = { ocsp: @ocsp.available?, crl: @crl.available? }.merge options
+
+        if opts[:ocsp] && !@ocsp.available?
+          raise Error.new "Tried to validate OCSP but cert has no OCSP data" 
+        end
+
+        if opts[:crl] && !@crl.available?
+          
+        end
+
+        @ocsp.validate! if opts[:ocsp]
+        @crl.validate! if opts[:crl]
+        true
+      end
+
+      def validate(options={})
+        begin
+          validate! options
+        rescue OcspError
+          return false
+        rescue CrlError
+          return false
+        end
+
+        return true
+      end
+
+      private
+      def initialize_validators
+        @ocsp = OcspValidator.new @cert, @issuer
+        @crl = CrlValidator.new @cert, @issuer
+      end
+    end
+  end
+end

data/lib/r509/cert/validator/basic_validator.rb

@@ -0,0 +1,24 @@
+require 'net/http'
+
+module R509
+  class Cert
+    class Validator
+      class BasicValidator
+        def initialize(cert, issuer)
+          @cert = cert
+          @issuer = issuer
+        end
+
+        private
+        def get(uri)
+          resp = Net::HTTP.get_response URI(uri)
+          if resp.code != '200'
+            raise Error.new("Unexpected HTTP #{resp.code} from OCSP endpoint")
+          end
+
+          resp.body
+        end
+      end
+    end
+  end
+end

data/lib/r509/cert/validator/crl_validator.rb

@@ -0,0 +1,40 @@
+module R509
+  class Cert
+    class Validator
+      class CrlValidator < BasicValidator
+        def available?
+          return false unless cdp
+          return false if uris.empty?
+          return true
+        end
+
+        def validate!
+          unless available?
+            raise Error.new "Tried to validate CRL but cert has no CRL data"
+          end
+
+          body = R509::CRL::SignedList.new(get(uris.first))
+
+          unless body.verify @issuer.public_key
+            raise CrlError.new "CRL did not match certificate"
+          end
+
+          if body.revoked? @cert.serial
+            raise CrlError.new "CRL listed certificate as revoked"
+          end
+
+          return true
+        end
+
+        private
+        def cdp
+          @cert.crl_distribution_points
+        end
+
+        def uris
+          cdp.uris
+        end
+      end
+    end
+  end
+end

data/lib/r509/cert/validator/errors.rb

@@ -0,0 +1,14 @@
+module R509
+  class Cert
+    class Validator
+      class Error < ::StandardError
+      end
+
+      class OcspError < Error
+      end
+
+      class CrlError < Error
+      end
+    end
+  end
+end

data/lib/r509/cert/validator/ocsp_validator.rb

@@ -0,0 +1,87 @@
+require 'base64'
+
+module R509
+  class Cert
+    class Validator
+      class OcspValidator < BasicValidator
+        def available?
+          return false unless @issuer
+          return false unless aia && aia.ocsp
+          return false if ocsp_uris.empty?
+          return true
+        end
+
+        def validate!
+          unless available?
+            raise Error.new "Tried to validate OCSP but cert has no OCSP data"
+          end
+          
+          uri = build_request_uri
+          body = R509::OCSP::Response.parse(get(uri))
+          
+          check_ocsp_response body
+          check_ocsp_payload body.basic.status.first
+          return true
+        end
+
+        private
+        def build_request_uri
+          @req = OpenSSL::OCSP::Request.new
+          @req.add_nonce
+          @req.add_certid cert_id
+          pem = Base64.encode64(@req.to_der).strip
+          URI(ocsp_uris.first + '/' + URI.encode_www_form_component(pem))
+        end
+        
+        def check_ocsp_response(body)
+          unless body.status == 0
+            raise OcspError.new "OCSP status was #{body.status}, expected 0"
+          end
+
+          unless body.verify(@issuer.cert)
+            raise OcspError.new "OCSP response did not match issuer"
+          end
+
+          unless body.basic.status.first
+            raise OcspError.new "OCSP response was missing payload"
+          end
+
+          if body.check_nonce(@req) != R509::OCSP::Request::Nonce::PRESENT_AND_EQUAL
+            raise OcspError.new "OCSP Nonce was not present and equal to request"
+          end
+        end
+
+        def check_ocsp_payload(basic)
+          if basic[0].serial != @cert.serial
+            raise OcspError.new "OCSP cert serial was #{basic[0].serial}, expected #{@cert.serial}"
+          end
+          
+          if basic[1] == 1
+            raise OcspError.new "OCSP response indicates cert was revoked"
+          end
+          
+          if basic[1] != 0
+            raise OcspError.new "OCSP response was #{basic[1]}, expected 0"
+          end
+          
+          validity_range = (basic[4]..basic[5])
+          unless validity_range.cover? Time.now
+            raise OcspError.new "OCSP response outside validity window"
+          end
+        end
+
+        def aia
+          @aia ||= @cert.authority_info_access
+        end
+
+        def ocsp_uris
+          aia.ocsp.uris
+        end
+
+        def cert_id
+          @cert_id ||= OpenSSL::OCSP::CertificateId.new @cert.cert, @issuer.cert
+        end
+      end
+    end
+  end
+end

data/lib/r509/cert/validator/version.rb

@@ -0,0 +1,7 @@
+module R509
+  class Cert
+    class Validator
+      VERSION = "0.0.1"
+    end
+  end
+end

data/lib/tasks/ca.rb

@@ -0,0 +1,112 @@
+require 'r509'
+require 'erb'
+require_relative 'helper'
+
+namespace :ca do
+  desc 'Generate all the certificates for testing'
+  task :all => %i{ good ocsp_only crl_only empty revoked }
+
+  task :clean do
+    Dir.chdir 'spec/support/ca' do
+      sh 'rm -f *.crt *.crl *.key *.txt *.yaml'
+    end
+  end
+
+  desc 'Generate a signing CA for testing certificates'
+  task :root => 'spec/support/ca/root.key'
+  file 'spec/support/ca/root.key' do |t|
+    subject = OpenSSL::X509::Name.new
+    'C=US/ST=Florida/L=Miami/O=r509-cert-validator/CN='.split('/').each do |s|
+      key, value = s.split '=', 2
+      subject.add_entry key, value
+    end
+    csr = CaHelper.csr
+    cert = R509::CertificateAuthority::Signer.selfsign(
+                                                       csr: csr,
+                                                       not_after: (Time.now.to_i + (86400 * 3650)),
+                                                       message_digest: 'sha1'
+                                                       )
+    
+    csr.key.write_pem 'spec/support/ca/root.key'
+    cert.write_pem 'spec/support/ca/root.crt'
+
+    sh "touch spec/support/ca/rcv_spec_list.txt"
+    sh "touch spec/support/ca/rcv_spec_crlnumber.txt"
+  end
+  file 'spec/support/ca/root.crt' => 'spec/support/ca/root.key'
+  file 'spec/support/ca/rcv_spec_list.txt' => 'spec/support/ca/root.key'
+  file 'spec/support/ca/rcv_spec_crlnumber.txt' => 'spec/support/ca/root.key
+'
+
+  file 'spec/support/ca/config.yaml' => 'spec/support/ca/config.yaml.erb' do |s|
+    erb = ERB.new File.read s.prerequisites.first
+    b = binding
+    cert_path = File.expand_path 'spec/support/ca/'
+    File.open s.name, 'w' do |f|
+      f.write erb.result b
+    end
+  end
+
+  desc 'Generate a valid certificate with CRL and OCSP data'
+  task :good => 'spec/support/ca/good.crt'
+  file 'spec/support/ca/good.crt' => [:root, 'spec/support/ca/config.yaml'] do
+    ca = CaHelper.ca
+    csr = CaHelper.options_builder.build_and_enforce(
+                                                     csr: CaHelper.csr,
+                                                     profile_name: 'good'
+                                                     )
+
+    cert = ca.sign csr
+    cert.write_pem 'spec/support/ca/good.crt'
+  end
+
+  desc 'Generate a valid certificate with only CRL data'
+  task :crl_only => 'spec/support/ca/crl_only.crt'
+  file 'spec/support/ca/crl_only.crt' => [:root, 'spec/support/ca/config.yaml'] do |t|
+    ca = CaHelper.ca
+    csr = CaHelper.options_builder.build_and_enforce(
+                                                     csr: CaHelper.csr,
+                                                     profile_name: 'crl_only'
+                                                     )
+    cert = ca.sign csr
+    cert.write_pem 'spec/support/ca/crl_only.crt'
+  end
+
+  desc 'Generate a valid certificate with only OCSP data'
+  task :ocsp_only => 'spec/support/ca/ocsp_only.crt'
+  file 'spec/support/ca/ocsp_only.crt' => [:root, 'spec/support/ca/config.yaml'] do |t|
+    ca = CaHelper.ca
+    csr = CaHelper.options_builder.build_and_enforce(
+                                                     csr: CaHelper.csr,
+                                                     profile_name: 'ocsp_only'
+                                                     )
+    cert = ca.sign csr
+    cert.write_pem 'spec/support/ca/ocsp_only.crt'
+  end
+
+  desc 'Generate a certificate and revoke it in both CRL and OCSP'
+  task :revoked => 'spec/support/ca/revoked.crt'
+  file 'spec/support/ca/revoked.crt' => [:root, 'spec/support/ca/config.yaml'] do |t|
+    ca = CaHelper.ca
+    csr = CaHelper.options_builder.build_and_enforce(
+                                                     csr: CaHelper.csr,
+                                                     profile_name: 'good'
+                                                     )
+
+    cert = ca.sign csr
+    cert.write_pem 'spec/support/ca/revoked.crt'
+
+    admin = R509::CRL::Administrator.new CaHelper.pool['rcv_spec_ca']
+    admin.revoke_cert cert.serial
+    crl = admin.generate_crl
+    crl.write_pem 'spec/support/ca/rcv_spec.crl'
+  end
+
+  desc 'Generate a valid certificate with no CRL or OCSP data'
+  task :empty => 'spec/support/ca/empty.crt'
+  file 'spec/support/ca/empty.crt' => [:root, 'spec/support/ca/config.yaml'] do
+    ca = CaHelper.ca
+    cert = ca.sign csr: CaHelper.csr
+    cert.write_pem 'spec/support/ca/empty.crt'
+  end
+end

data/lib/tasks/helper.rb

@@ -0,0 +1,33 @@
+require 'r509'
+
+module CaHelper
+  def self.csr
+    R509::CSR.new(
+                  subject: {
+                    C: 'US',
+                    ST: 'Florida',
+                    L: 'Miami',
+                    O: 'r509-cert-validator',
+                    CN: 'localhost'
+                  },
+                  bit_length: 512,
+                  type: 'RSA',
+                  message_digest: 'sha1'
+                  )
+  end
+
+  def self.ca
+    @ca ||= R509::CertificateAuthority::Signer.new pool['rcv_spec_ca']
+  end
+
+  def self.options_builder
+    @builder ||= R509::CertificateAuthority::OptionsBuilder.new pool['rcv_spec_ca']
+  end
+
+  def self.pool
+    @pool ||= R509::Config::CAConfigPool.from_yaml(
+                                                   'certificate_authorities', 
+                                                   File.read('spec/support/ca/config.yaml')
+                                                   )
+  end
+end

data/r509-cert-validator.gemspec

@@ -0,0 +1,31 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'r509/cert/validator/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "r509-cert-validator"
+  spec.version       = R509::Cert::Validator::VERSION
+  spec.authors       = ["Bryce Kerley"]
+  spec.email         = ["bkerley@brycekerley.net"]
+  spec.description   = %q{Tool for validating x509 certificates against CRLs and OCSP.}
+  spec.summary       = %q{An r509-based tool for validating x509 certificates against CRLs and OCSP.}
+  spec.homepage      = ""
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files`.split($/)
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ["lib"]
+
+  spec.required_ruby_version = '~> 2.0'
+
+  spec.add_development_dependency "bundler", "~> 1.3"
+  spec.add_development_dependency "rake", "~> 10.1.1"
+  spec.add_development_dependency "rspec", "~> 2.14.1"
+  spec.add_development_dependency 'rack', '~> 1.5.2'
+  spec.add_development_dependency 'puma', '~> 2.7.1'
+  spec.add_development_dependency 'r509-ocsp-responder', '~> 0.3.3'
+  spec.add_development_dependency 'r509-validity-crl', '~> 0.1.1'
+  spec.add_runtime_dependency "r509", "~> 0.10.0"
+end

data/spec/spec_helper.rb

@@ -0,0 +1,11 @@
+require 'r509/cert/validator'
+
+def load_cert(name)
+  path = File.join(File.dirname(__FILE__), 'support', 'ca', name)
+  data = File.read path
+  return OpenSSL::X509::Certificate.new data
+end
+
+def cert(name)
+  R509::Cert.new cert: load_cert(name)
+end

data/spec/support/ca/.gitignore

@@ -0,0 +1,5 @@
+config.yaml
+*.crt
+*.crl
+*.txt
+*.key

data/spec/support/ca/config.yaml.erb

@@ -0,0 +1,35 @@
+---
+copy_nonce: true
+certificate_authorities:
+  rcv_spec_ca:
+    ca_cert:
+      cert: <%= cert_path %>/root.crt
+      key: <%= cert_path %>/root.key
+    ocsp_start_skew_seconds: 3600
+    ocsp_validity_hours: 168
+    crl_list_file: <%= cert_path %>/rcv_spec_list.txt
+    crl_number_file: <%= cert_path %>/rcv_spec_crlnumber.txt
+    crl_validity_hours: 87600
+    crl_md: SHA1
+    profiles:
+      good:
+        authority_info_access:
+          :ocsp_location:
+          -  :type: URI
+             :value: http://localhost:22022/ocsp
+        crl_distribution_points:
+          :value:
+          -  :type: URI
+             :value: http://localhost:22022/crl
+      crl_only:
+        crl_distribution_points:
+          :value:
+          -  :type: URI
+             :value: http://localhost:22022/crl
+      ocsp_only:
+        authority_info_access:
+          :ocsp_location:
+          -  :type: URI
+             :value: http://localhost:22022/ocsp
+certwriter:
+  path: <%= cert_path %>

data/spec/support/ca_server.rb

@@ -0,0 +1,29 @@
+require 'r509/ocsp/responder/server'
+require 'r509/validity/crl'
+require 'dependo'
+require 'logger'
+require 'rack'
+
+crl_paths = [File.join(File.dirname(__FILE__), 'ca/rcv_spec.crl')]
+
+reload_interval = '5s' #yolo
+Dependo::Registry[:validity_checker] = R509::Validity::CRL::Checker.new(
+                                                                        crl_paths, 
+                                                                        reload_interval
+                                                                        )
+Dependo::Registry[:log] = Logger.new STDERR
+
+Dir.chdir File.join(File.dirname(__FILE__), 'ca') do
+  R509::OCSP::Responder::OCSPConfig.load_config
+end
+R509::OCSP::Responder::OCSPConfig.print_config
+
+responder = R509::OCSP::Responder::Server
+
+Rack::Server.start(
+                   app: Rack::URLMap.new(
+                                         '/ocsp' => R509::OCSP::Responder::Server,
+                                         '/crl' => Rack::File.new(File.join(File.dirname(__FILE__), 'ca', 'rcv_spec.crl'))
+                                         ),
+                   Port: 22022
+                   )

data/spec/support/certs/README.md

@@ -0,0 +1,15 @@
+**DO NOT USE THESE IN PRODUCTION**
+
+This directory has certificates and a key for testing Riak authentication.
+
+* no_validator.crt - a certificate with no CRL or OCSP data
+* ca.crt - a certificate for the CA that issued no_validator.crt
+* github_chain.crt - the complete set of certificates presented by
+  https://github.com at 6:48 PM US Eastern time on Feb. 6, 2014. This
+  certificate has CRL and OCSP endpoints.
+* github.crt - the GitHub certificate from above
+* digicert_ev.crt - the Digicert EV CA that issued github.crt
+
+**DO NOT USE THESE IN PRODUCTION**
+
+These were generated using https://github.com/basho-labs/riak-ruby-ca .

data/spec/support/certs/ca.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDjDCCAnQCCQDrkNSIB3EtsDANBgkqhkiG9w0BAQUFADCBhzELMAkGA1UEBhMC
+VVMxEDAOBgNVBAgMB0Zsb3JpZGExDjAMBgNVBAcMBU1pYW1pMQ4wDAYDVQQKDAVC
+YXNobzEZMBcGA1UECwwQUmlhayBSdWJ5IENsaWVudDELMAkGA1UEAwwCQ0ExHjAc
+BgkqhkiG9w0BCQEWD2JyeWNlQGJhc2hvLmNvbTAeFw0xNDAyMDUxNjI5MDBaFw0x
+MzA4MDUxNjI5MDBaMIGHMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHRmxvcmlkYTEO
+MAwGA1UEBwwFTWlhbWkxDjAMBgNVBAoMBUJhc2hvMRkwFwYDVQQLDBBSaWFrIFJ1
+YnkgQ2xpZW50MQswCQYDVQQDDAJDQTEeMBwGCSqGSIb3DQEJARYPYnJ5Y2VAYmFz
+aG8uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0OuLzsUEbF53
+BGhI1uLbwAK+DoWWQL0kPB0cCFYXkfR0Y/wCeq0iDgwq0+CR2otmcMR8Sg13h8dm
+YfKWnKeVh1uvWDasE9t1BXvi0b8gunwMvSz2DKwyxYqjI8+PGmL6tg2lcmlC/eHA
+Y6ObowXycMW5mugcp524yeWpsJ+YBnDPwctKtMJExPAl4mZp9Y5kffeROBrWwkeg
+1nbB1GJCPw9t2/4kMl7ksa7/b6dKbq/ra/zcfB0b0BC8dkoTKgcSaGVycFguIn1R
+Xn0i3ruwN644ODt/H/3qQp1Qyh/jrz/aRMjuk/3jpwwzo5buoUYgk8FVGnG4x+FE
+S+trFWOs7QIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQBFxRahSTOmyYtqbcrDG7S5
+eLghOpUr1jXU3dfVOf+/1u9g/HZCXYGPr+tRw+OsxiR5Cw6U8Nj2gQdZmsCkVMRp
+3XUE2Wo5O+ogaV4l68ODZ+uS1yxjvRqoOC0M1/XtihCvNJtpLiaRMxysARp4wnH2
+ReksBUMxwDl2tEYcczTXRiKRk2QL6BeQ+l08O9scbSjClso8Wfq+z5Z+qSuFwjC9
+LpxR6aEc6HVnKgio/Pi+6MJwP7NafBXVfTUK9RoFnG8F/fPAbAPqxXK1qYoTHzHr
+d44rhxSOHHNDq3074VlBbMtx+NvCoIk3k5/5Am1rmezxGtA9ESofEgSo1/H9oQYH
+-----END CERTIFICATE-----

data/spec/support/certs/digicert_ev.crt

@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIG5jCCBc6gAwIBAgIQAze5KDR8YKauxa2xIX84YDANBgkqhkiG9w0BAQUFADBs
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
+ZSBFViBSb290IENBMB4XDTA3MTEwOTEyMDAwMFoXDTIxMTExMDAwMDAwMFowaTEL
+MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
+LmRpZ2ljZXJ0LmNvbTEoMCYGA1UEAxMfRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
+RVYgQ0EtMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPOWYth1bhn/
+PzR8SU8xfg0ETpmB4rOFVZEwscCvcLssqOcYqj9495BoUoYBiJfiOwZlkKq9ZXbC
+7L4QWzd4g2B1Rca9dKq2n6Q6AVAXxDlpufFP74LByvNK28yeUE9NQKM6kOeGZrzw
+PnYoTNF1gJ5qNRQ1A57bDIzCKK1Qss72kaPDpQpYSfZ1RGy6+c7pqzoC4E3zrOJ6
+4GAiBTyC01Li85xH+DvYskuTVkq/cKs+6WjIHY9YHSpNXic9rQpZL1oRIEDZaARo
+LfTAhAsKG3jf7RpY3PtBWm1r8u0c7lwytlzs16YDMqbo3rcoJ1mIgP97rYlY1R4U
+pPKwcNSgPqcCAwEAAaOCA4UwggOBMA4GA1UdDwEB/wQEAwIBhjA7BgNVHSUENDAy
+BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwYBBQUH
+AwgwggHEBgNVHSAEggG7MIIBtzCCAbMGCWCGSAGG/WwCATCCAaQwOgYIKwYBBQUH
+AgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5o
+dG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0
+AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1
+AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABp
+AGcAaQBDAGUAcgB0ACAARQBWACAAQwBQAFMAIABhAG4AZAAgAHQAaABlACAAUgBl
+AGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUAZQBtAGUAbgB0ACAAdwBo
+AGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABhAG4AZAAg
+AGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAg
+AGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wEgYDVR0TAQH/BAgwBgEB/wIBADCB
+gwYIKwYBBQUHAQEEdzB1MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2Vy
+dC5jb20wTQYIKwYBBQUHMAKGQWh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NBQ2Vy
+dHMvRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3J0MIGPBgNVHR8EgYcw
+gYQwQKA+oDyGOmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEhpZ2hB
+c3N1cmFuY2VFVlJvb3RDQS5jcmwwQKA+oDyGOmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0
+LmNvbS9EaWdpQ2VydEhpZ2hBc3N1cmFuY2VFVlJvb3RDQS5jcmwwHQYDVR0OBBYE
+FExYyyXwQU9S9CjIgUObpqig5pLlMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSYJhoI
+Au9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQBMeheHKF0XvLIyc7/NLvVYMR3wsXFU
+nNabZ5PbLwM+Fm8eA8lThKNWYB54lBuiqG+jpItSkdfdXJW777UWSemlQk808kf/
+roF/E1S3IMRwFcuBCoHLdFfcnN8kpCkMGPAc5K4HM+zxST5Vz25PDVR708noFUjU
+xbvcNRx3RQdIRYW9135TuMAW2ZXNi419yWBP0aKb49Aw1rRzNubS+QOy46T15bg+
+BEkAui6mSnKDcp33C4ypieez12Qf1uNgywPE3IjpnSUBAHHLA7QpYCWP+UbRe3Gu
+zVMSW4SOwg/H7ZMZ2cn6j1g0djIvruFQFGHUqFijyDATI+/GJYw2jxyA
+-----END CERTIFICATE-----

data/spec/support/certs/github.crt

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHOjCCBiKgAwIBAgIQBH++LkveAITSyvjj7P5wWDANBgkqhkiG9w0BAQUFADBp
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSgwJgYDVQQDEx9EaWdpQ2VydCBIaWdoIEFzc3VyYW5j
+ZSBFViBDQS0xMB4XDTEzMDYxMDAwMDAwMFoXDTE1MDkwMjEyMDAwMFowgfAxHTAb
+BgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYBBAGCNzwCAQMTAlVT
+MRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQFEwc1MTU3NTUwMRcw
+FQYDVQQJEw41NDggNHRoIFN0cmVldDEOMAwGA1UEERMFOTQxMDcxCzAJBgNVBAYT
+AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
+MRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xEzARBgNVBAMTCmdpdGh1Yi5jb20wggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt04nDXXByCfMzTxpydNm2WpVQ
+u2hhn/f7Hxnh2gQxrxV8Gn/5c68d5UMrVgkARWlK6MRb38J3UlEZW9Er2TllNqAy
+GRxBc/sysj2fmOyCWws3ZDkstxCDcs3w6iRL+tmULsOFFTmpOvaI2vQniaaVT4Si
+N058JXg6yYNtAheVeH1HqFWD7hPIGRqzPPFf/jsC4YX7EWarCV2fTEPwxyReKXIo
+ztR1aE8kcimuOSj8341PTYNzdAxvEZun3WLe/+LrF+b/DL/ALTE71lmi8t2HSkh7
+bTMRFE00nzI49sgZnfG2PcVG71ELisYz7UhhxB0XG718tmfpOc+lUoAK9OrNAgMB
+AAGjggNUMIIDUDAfBgNVHSMEGDAWgBRMWMsl8EFPUvQoyIFDm6aooOaS5TAdBgNV
+HQ4EFgQUh9GPGW7kh29TjHeRB1Dfo79VRyAwJQYDVR0RBB4wHIIKZ2l0aHViLmNv
+bYIOd3d3LmdpdGh1Yi5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
+AQUFBwMBBggrBgEFBQcDAjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vY3JsMy5k
+aWdpY2VydC5jb20vZXZjYTEtZzIuY3JsMCugKaAnhiVodHRwOi8vY3JsNC5kaWdp
+Y2VydC5jb20vZXZjYTEtZzIuY3JsMIIBxAYDVR0gBIIBuzCCAbcwggGzBglghkgB
+hv1sAgEwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z
+c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4A
+eQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQA
+ZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUA
+IABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAA
+YQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcA
+cgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIA
+aQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQA
+ZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMH0G
+CCsGAQUFBwEBBHEwbzAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQu
+Y29tMEcGCCsGAQUFBzAChjtodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGln
+aUNlcnRIaWdoQXNzdXJhbmNlRVZDQS0xLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqG
+SIb3DQEBBQUAA4IBAQBfFW1nwzrVo94WnEUzJtU9yRZ0NMqHSBsUkG31q0eGufW4
+4wFFZWjuqRJ1n3Ym7xF8fTjP3fdKGQnxIHKSsE0nuuh/XbQX5DpBJknHdGFoLwY8
+xZ9JPI57vgvzLo8+fwHyZp3Vm/o5IYLEQViSo+nlOSUQ8YAVqu6KcsP/e612UiqS
++UMBmgdx9KPDDzZy4MJZC2hbfUoXj9A54mJN8cuEOPyw3c3yKOcq/h48KzVguQXi
+SdJbwfqNIbQ9oJM+YzDjzS62+TCtNSNWzWbwABZCmuQxK0oEOSbTmbhxUF7rND3/
++mx9u8cY//7uAxLWYS5gIZlCbxcf0lkiKSHJB319
+-----END CERTIFICATE-----

data/spec/support/certs/github_chain.crt

@@ -0,0 +1,112 @@
+CONNECTED(00000003)
+---
+Certificate chain
+ 0 s:/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/serialNumber=5157550/street=548 4th Street/postalCode=94107/C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=github.com
+   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV CA-1
+-----BEGIN CERTIFICATE-----
+MIIHOjCCBiKgAwIBAgIQBH++LkveAITSyvjj7P5wWDANBgkqhkiG9w0BAQUFADBp
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSgwJgYDVQQDEx9EaWdpQ2VydCBIaWdoIEFzc3VyYW5j
+ZSBFViBDQS0xMB4XDTEzMDYxMDAwMDAwMFoXDTE1MDkwMjEyMDAwMFowgfAxHTAb
+BgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYBBAGCNzwCAQMTAlVT
+MRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQFEwc1MTU3NTUwMRcw
+FQYDVQQJEw41NDggNHRoIFN0cmVldDEOMAwGA1UEERMFOTQxMDcxCzAJBgNVBAYT
+AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
+MRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xEzARBgNVBAMTCmdpdGh1Yi5jb20wggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt04nDXXByCfMzTxpydNm2WpVQ
+u2hhn/f7Hxnh2gQxrxV8Gn/5c68d5UMrVgkARWlK6MRb38J3UlEZW9Er2TllNqAy
+GRxBc/sysj2fmOyCWws3ZDkstxCDcs3w6iRL+tmULsOFFTmpOvaI2vQniaaVT4Si
+N058JXg6yYNtAheVeH1HqFWD7hPIGRqzPPFf/jsC4YX7EWarCV2fTEPwxyReKXIo
+ztR1aE8kcimuOSj8341PTYNzdAxvEZun3WLe/+LrF+b/DL/ALTE71lmi8t2HSkh7
+bTMRFE00nzI49sgZnfG2PcVG71ELisYz7UhhxB0XG718tmfpOc+lUoAK9OrNAgMB
+AAGjggNUMIIDUDAfBgNVHSMEGDAWgBRMWMsl8EFPUvQoyIFDm6aooOaS5TAdBgNV
+HQ4EFgQUh9GPGW7kh29TjHeRB1Dfo79VRyAwJQYDVR0RBB4wHIIKZ2l0aHViLmNv
+bYIOd3d3LmdpdGh1Yi5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
+AQUFBwMBBggrBgEFBQcDAjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vY3JsMy5k
+aWdpY2VydC5jb20vZXZjYTEtZzIuY3JsMCugKaAnhiVodHRwOi8vY3JsNC5kaWdp
+Y2VydC5jb20vZXZjYTEtZzIuY3JsMIIBxAYDVR0gBIIBuzCCAbcwggGzBglghkgB
+hv1sAgEwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z
+c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4A
+eQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQA
+ZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUA
+IABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAA
+YQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcA
+cgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIA
+aQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQA
+ZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMH0G
+CCsGAQUFBwEBBHEwbzAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQu
+Y29tMEcGCCsGAQUFBzAChjtodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGln
+aUNlcnRIaWdoQXNzdXJhbmNlRVZDQS0xLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqG
+SIb3DQEBBQUAA4IBAQBfFW1nwzrVo94WnEUzJtU9yRZ0NMqHSBsUkG31q0eGufW4
+4wFFZWjuqRJ1n3Ym7xF8fTjP3fdKGQnxIHKSsE0nuuh/XbQX5DpBJknHdGFoLwY8
+xZ9JPI57vgvzLo8+fwHyZp3Vm/o5IYLEQViSo+nlOSUQ8YAVqu6KcsP/e612UiqS
++UMBmgdx9KPDDzZy4MJZC2hbfUoXj9A54mJN8cuEOPyw3c3yKOcq/h48KzVguQXi
+SdJbwfqNIbQ9oJM+YzDjzS62+TCtNSNWzWbwABZCmuQxK0oEOSbTmbhxUF7rND3/
++mx9u8cY//7uAxLWYS5gIZlCbxcf0lkiKSHJB319
+-----END CERTIFICATE-----
+ 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV CA-1
+   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
+-----BEGIN CERTIFICATE-----
+MIIG5jCCBc6gAwIBAgIQAze5KDR8YKauxa2xIX84YDANBgkqhkiG9w0BAQUFADBs
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
+ZSBFViBSb290IENBMB4XDTA3MTEwOTEyMDAwMFoXDTIxMTExMDAwMDAwMFowaTEL
+MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
+LmRpZ2ljZXJ0LmNvbTEoMCYGA1UEAxMfRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
+RVYgQ0EtMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPOWYth1bhn/
+PzR8SU8xfg0ETpmB4rOFVZEwscCvcLssqOcYqj9495BoUoYBiJfiOwZlkKq9ZXbC
+7L4QWzd4g2B1Rca9dKq2n6Q6AVAXxDlpufFP74LByvNK28yeUE9NQKM6kOeGZrzw
+PnYoTNF1gJ5qNRQ1A57bDIzCKK1Qss72kaPDpQpYSfZ1RGy6+c7pqzoC4E3zrOJ6
+4GAiBTyC01Li85xH+DvYskuTVkq/cKs+6WjIHY9YHSpNXic9rQpZL1oRIEDZaARo
+LfTAhAsKG3jf7RpY3PtBWm1r8u0c7lwytlzs16YDMqbo3rcoJ1mIgP97rYlY1R4U
+pPKwcNSgPqcCAwEAAaOCA4UwggOBMA4GA1UdDwEB/wQEAwIBhjA7BgNVHSUENDAy
+BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwYBBQUH
+AwgwggHEBgNVHSAEggG7MIIBtzCCAbMGCWCGSAGG/WwCATCCAaQwOgYIKwYBBQUH
+AgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5o
+dG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0
+AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1
+AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABp
+AGcAaQBDAGUAcgB0ACAARQBWACAAQwBQAFMAIABhAG4AZAAgAHQAaABlACAAUgBl
+AGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUAZQBtAGUAbgB0ACAAdwBo
+AGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABhAG4AZAAg
+AGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAg
+AGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wEgYDVR0TAQH/BAgwBgEB/wIBADCB
+gwYIKwYBBQUHAQEEdzB1MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2Vy
+dC5jb20wTQYIKwYBBQUHMAKGQWh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NBQ2Vy
+dHMvRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3J0MIGPBgNVHR8EgYcw
+gYQwQKA+oDyGOmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEhpZ2hB
+c3N1cmFuY2VFVlJvb3RDQS5jcmwwQKA+oDyGOmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0
+LmNvbS9EaWdpQ2VydEhpZ2hBc3N1cmFuY2VFVlJvb3RDQS5jcmwwHQYDVR0OBBYE
+FExYyyXwQU9S9CjIgUObpqig5pLlMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSYJhoI
+Au9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQBMeheHKF0XvLIyc7/NLvVYMR3wsXFU
+nNabZ5PbLwM+Fm8eA8lThKNWYB54lBuiqG+jpItSkdfdXJW777UWSemlQk808kf/
+roF/E1S3IMRwFcuBCoHLdFfcnN8kpCkMGPAc5K4HM+zxST5Vz25PDVR708noFUjU
+xbvcNRx3RQdIRYW9135TuMAW2ZXNi419yWBP0aKb49Aw1rRzNubS+QOy46T15bg+
+BEkAui6mSnKDcp33C4ypieez12Qf1uNgywPE3IjpnSUBAHHLA7QpYCWP+UbRe3Gu
+zVMSW4SOwg/H7ZMZ2cn6j1g0djIvruFQFGHUqFijyDATI+/GJYw2jxyA
+-----END CERTIFICATE-----
+---
+Server certificate
+subject=/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/serialNumber=5157550/street=548 4th Street/postalCode=94107/C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=github.com
+issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV CA-1
+---
+No client certificate CA names sent
+---
+SSL handshake has read 3796 bytes and written 456 bytes
+---
+New, TLSv1/SSLv3, Cipher is AES128-SHA
+Server public key is 2048 bit
+Secure Renegotiation IS supported
+Compression: NONE
+Expansion: NONE
+SSL-Session:
+    Protocol  : TLSv1
+    Cipher    : AES128-SHA
+    Session-ID: 68A4FF6A1FAFD9EF2AC080C4E9A42433A0C27815CB17F0A6C24B455E17A49D0B
+    Session-ID-ctx: 
+    Master-Key: 324790F1157F795B7716645002F4E5515CF874B8AF64370245B67C45B4CBFF50A71CA54E5FDDF8AEE58ED4201C127B64
+    Key-Arg   : None
+    Start Time: 1391730515
+    Timeout   : 300 (sec)
+    Verify return code: 0 (ok)
+---

data/spec/support/certs/no_validator.crt

@@ -0,0 +1,94 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7353680 (0x703550)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Florida, L=Miami, O=Basho, OU=Riak Ruby Client, CN=CA/emailAddress=bryce@basho.com
+        Validity
+            Not Before: Feb  5 16:29:00 2014 GMT
+            Not After : Feb  3 16:29:00 2024 GMT
+        Subject: C=US, ST=Florida, O=Basho, OU=Riak Ruby client, CN=localhost/emailAddress=bryce@basho.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:cc:37:29:ad:9d:f1:93:6f:6c:61:ba:14:ac:70:
+                    98:7d:5c:11:97:64:6e:10:72:7a:81:d0:97:c7:5d:
+                    b3:5e:6b:ed:57:29:eb:54:3b:ee:c8:40:3c:57:54:
+                    7f:1a:0f:66:f7:8d:4c:49:d0:56:3f:8f:27:6a:1c:
+                    98:31:4d:c5:d5:01:50:6a:e3:d2:a4:19:65:b6:38:
+                    b8:81:c9:e7:46:51:79:8b:1a:92:ee:a4:d8:0e:ef:
+                    dc:4b:1d:08:ec:b8:13:22:7c:85:7f:ff:a3:ef:bc:
+                    23:ba:dd:b4:e8:bf:f3:6a:e9:3c:89:fc:9c:b9:7d:
+                    1e:a5:61:b0:fe:b5:74:e2:ab:9e:42:7d:9e:f0:ee:
+                    28:5a:d4:fb:b5:fc:d0:05:6c:72:cf:04:6a:d4:6d:
+                    5f:f9:eb:97:a8:cf:fa:79:ee:82:ed:00:47:18:80:
+                    a3:9f:2e:86:74:c4:6e:b9:e1:da:d1:87:1c:10:d5:
+                    f3:87:fb:71:ce:55:ee:7e:53:f2:88:b6:15:aa:a9:
+                    4e:d0:b4:a2:27:04:3b:af:61:88:2a:b3:c1:90:c0:
+                    41:d7:e0:43:63:ee:55:b7:3a:f4:c3:56:c7:88:d4:
+                    c9:4e:ca:55:9d:d4:3f:30:7c:ea:34:8a:5c:31:90:
+                    0b:ad:7f:35:cc:b8:0d:5a:f4:f4:f1:2b:86:0a:c2:
+                    df:4f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            Netscape Comment: 
+                Riak Ruby Client Testing Certificate
+            X509v3 Subject Key Identifier: 
+                CD:69:91:9F:7F:4F:EC:4D:76:95:87:41:D4:A7:5F:62:9C:E2:7F:8A
+            X509v3 Authority Key Identifier: 
+                DirName:/C=US/ST=Florida/L=Miami/O=Basho/OU=Riak Ruby Client/CN=CA/emailAddress=bryce@basho.com
+                serial:EB:90:D4:88:07:71:2D:B0
+
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha1WithRSAEncryption
+         39:20:28:de:26:20:af:e3:d2:59:92:a9:43:95:b9:25:83:2e:
+         6e:a2:32:66:53:a8:ef:6b:96:b1:44:8f:74:3f:f2:01:6f:96:
+         af:3b:70:67:1a:1e:39:68:6a:57:b0:b8:89:e7:ed:50:34:ef:
+         53:bd:96:68:94:ab:8b:3f:f7:20:be:1a:52:80:0a:11:ee:dc:
+         dc:93:01:11:3d:91:e5:93:d8:0c:b0:05:44:fa:a7:d1:c9:32:
+         be:58:58:48:40:66:dd:8f:bc:b0:02:84:05:c3:e8:e4:77:f9:
+         ff:a9:09:b7:a0:9b:3a:ea:a5:c9:02:8f:eb:30:aa:f6:92:bf:
+         38:ef:fb:6c:5d:e5:7b:c7:57:86:74:06:ca:e5:86:70:40:35:
+         50:51:df:28:44:fa:d0:a3:30:ae:aa:71:34:32:a5:dc:f7:7e:
+         70:a7:ed:c1:e7:20:77:a0:27:16:00:4d:74:90:5a:29:9b:b3:
+         43:5f:0b:b2:4e:d5:c8:8f:ab:e6:92:f5:57:b0:b4:f8:fd:be:
+         a1:12:9f:06:fa:5e:da:bd:1c:fc:08:e4:d8:de:5e:82:a8:dc:
+         8b:3b:61:b5:65:ce:b3:2c:a0:fc:8e:a1:28:33:ca:a5:b8:0a:
+         45:29:b8:ba:ab:f1:77:42:e5:a8:2d:b7:67:6c:75:18:f4:ce:
+         91:ea:62:80
+-----BEGIN CERTIFICATE-----
+MIIE0DCCA7igAwIBAgIDcDVQMA0GCSqGSIb3DQEBBQUAMIGHMQswCQYDVQQGEwJV
+UzEQMA4GA1UECAwHRmxvcmlkYTEOMAwGA1UEBwwFTWlhbWkxDjAMBgNVBAoMBUJh
+c2hvMRkwFwYDVQQLDBBSaWFrIFJ1YnkgQ2xpZW50MQswCQYDVQQDDAJDQTEeMBwG
+CSqGSIb3DQEJARYPYnJ5Y2VAYmFzaG8uY29tMB4XDTE0MDIwNTE2MjkwMFoXDTI0
+MDIwMzE2MjkwMFowfjELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0Zsb3JpZGExDjAM
+BgNVBAoMBUJhc2hvMRkwFwYDVQQLDBBSaWFrIFJ1YnkgY2xpZW50MRIwEAYDVQQD
+DAlsb2NhbGhvc3QxHjAcBgkqhkiG9w0BCQEWD2JyeWNlQGJhc2hvLmNvbTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMw3Ka2d8ZNvbGG6FKxwmH1cEZdk
+bhByeoHQl8dds15r7Vcp61Q77shAPFdUfxoPZveNTEnQVj+PJ2ocmDFNxdUBUGrj
+0qQZZbY4uIHJ50ZReYsaku6k2A7v3EsdCOy4EyJ8hX//o++8I7rdtOi/82rpPIn8
+nLl9HqVhsP61dOKrnkJ9nvDuKFrU+7X80AVscs8EatRtX/nrl6jP+nnugu0ARxiA
+o58uhnTEbrnh2tGHHBDV84f7cc5V7n5T8oi2FaqpTtC0oicEO69hiCqzwZDAQdfg
+Q2PuVbc69MNWx4jUyU7KVZ3UPzB86jSKXDGQC61/Ncy4DVr09PErhgrC308CAwEA
+AaOCAUswggFHMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgbAMAsGA1UdDwQE
+AwIF4DAzBglghkgBhvhCAQ0EJhYkUmlhayBSdWJ5IENsaWVudCBUZXN0aW5nIENl
+cnRpZmljYXRlMB0GA1UdDgQWBBTNaZGff0/sTXaVh0HUp19inOJ/ijCBpgYDVR0j
+BIGeMIGboYGNpIGKMIGHMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHRmxvcmlkYTEO
+MAwGA1UEBwwFTWlhbWkxDjAMBgNVBAoMBUJhc2hvMRkwFwYDVQQLDBBSaWFrIFJ1
+YnkgQ2xpZW50MQswCQYDVQQDDAJDQTEeMBwGCSqGSIb3DQEJARYPYnJ5Y2VAYmFz
+aG8uY29tggkA65DUiAdxLbAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MA0GCSqGSIb3DQEBBQUAA4IBAQA5ICjeJiCv49JZkqlDlbklgy5uojJmU6jva5ax
+RI90P/IBb5avO3BnGh45aGpXsLiJ5+1QNO9TvZZolKuLP/cgvhpSgAoR7tzckwER
+PZHlk9gMsAVE+qfRyTK+WFhIQGbdj7ywAoQFw+jkd/n/qQm3oJs66qXJAo/rMKr2
+kr847/tsXeV7x1eGdAbK5YZwQDVQUd8oRPrQozCuqnE0MqXc935wp+3B5yB3oCcW
+AE10kFopm7NDXwuyTtXIj6vmkvVXsLT4/b6hEp8G+l7avRz8COTY3l6CqNyLO2G1
+Zc6zLKD8jqEoM8qluApFKbi6q/F3QuWoLbdnbHUY9M6R6mKA
+-----END CERTIFICATE-----

data/spec/validator_spec.rb

@@ -0,0 +1,73 @@
+require 'spec_helper'
+
+describe R509::Cert::Validator do
+  let(:issuer_cert){ cert('root.crt') }
+
+  describe 'with a cert without CRL or OCSP data' do
+    let(:no_validator_cert){ cert('empty.crt') }
+    subject{ described_class.new no_validator_cert }
+
+    it 'should validate' do
+      expect{ subject.validate }.to_not raise_error
+    end
+
+    it 'should refuse to validate with CRL or OCSP' do
+      expect{ subject.validate crl: true }.to raise_error
+      expect{ subject.validate ocsp: true }.to raise_error
+    end
+  end
+
+  describe 'with a cert with CRL and OCSP data' do
+    let(:good_cert){ cert('good.crt') }
+    subject{ described_class.new good_cert, issuer_cert }
+
+    it 'should validate against a CRL' do
+      expect{ subject.validate crl: true, ocsp: false }.to_not raise_error
+    end
+    
+    it 'should validate a cert against OCSP' do
+      expect{ subject.validate crl: false, ocsp: true }.to_not raise_error
+    end
+  end
+
+  describe 'with a cert with CRL and no OCSP' do
+    let(:crl_only_cert){ cert('crl_only.crt') }
+    subject{ described_class.new crl_only_cert, issuer_cert }
+
+    it 'should validate against a CRL' do
+      expect{ subject.validate crl: true, ocsp: false }.to_not raise_error
+    end
+
+    it 'should fail to validate against OCSP' do
+      expect{ subject.validate crl: false, ocsp: true }.to raise_error
+    end
+  end
+
+  describe 'with a cert with OCSP and no CRL' do
+    let(:ocsp_only_cert){ cert('ocsp_only.crt') }
+    subject{ described_class.new ocsp_only_cert, issuer_cert }
+
+    it 'should fail to validate against a CRL' do
+      expect{ subject.validate crl: true, ocsp: false }.to raise_error
+    end
+
+    it 'should validate against OCSP' do
+      expect{ subject.validate crl: false, ocsp: true }.to_not raise_error
+    end
+  end
+
+  describe 'with a revoked cert' do
+    let(:revoked_cert){ cert('revoked.crt') }
+    subject{ described_class.new revoked_cert, issuer_cert }
+
+    it 'should validate false against a CRL' do
+      expect(subject.validate crl: true, ocsp: false).to_not be
+      expect{ subject.validate! crl: true, ocsp: false }.to raise_error /revoked/
+    end
+
+    it 'should validate false against OCSP' do
+      expect(subject.validate crl: false, ocsp: true).to_not be
+      expect{ subject.validate! crl: false, ocsp: true }.to raise_error /revoked/
+    end
+  end
+end

data/travis.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+bundle exec rake ca:all
+bundle exec ruby spec/support/ca_server.rb &
+sleep 5
+bundle exec rspec

metadata

@@ -0,0 +1,197 @@
+--- !ruby/object:Gem::Specification
+name: r509-cert-validator
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Bryce Kerley
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2014-02-12 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 10.1.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 10.1.1
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 2.14.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 2.14.1
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.5.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.5.2
+- !ruby/object:Gem::Dependency
+  name: puma
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 2.7.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 2.7.1
+- !ruby/object:Gem::Dependency
+  name: r509-ocsp-responder
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.3.3
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.3.3
+- !ruby/object:Gem::Dependency
+  name: r509-validity-crl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.1.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.1.1
+- !ruby/object:Gem::Dependency
+  name: r509
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.10.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.10.0
+description: Tool for validating x509 certificates against CRLs and OCSP.
+email:
+- bkerley@brycekerley.net
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- .rspec
+- .travis.yml
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- lib/r509-cert-validator.rb
+- lib/r509/cert/validator.rb
+- lib/r509/cert/validator/basic_validator.rb
+- lib/r509/cert/validator/crl_validator.rb
+- lib/r509/cert/validator/errors.rb
+- lib/r509/cert/validator/ocsp_validator.rb
+- lib/r509/cert/validator/version.rb
+- lib/tasks/ca.rb
+- lib/tasks/helper.rb
+- r509-cert-validator.gemspec
+- spec/spec_helper.rb
+- spec/support/ca/.gitignore
+- spec/support/ca/config.yaml.erb
+- spec/support/ca_server.rb
+- spec/support/certs/README.md
+- spec/support/certs/ca.crt
+- spec/support/certs/digicert_ev.crt
+- spec/support/certs/github.crt
+- spec/support/certs/github_chain.crt
+- spec/support/certs/no_validator.crt
+- spec/validator_spec.rb
+- travis.sh
+homepage: ''
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ~>
+    - !ruby/object:Gem::Version
+      version: '2.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.0.14
+signing_key: 
+specification_version: 4
+summary: An r509-based tool for validating x509 certificates against CRLs and OCSP.
+test_files:
+- spec/spec_helper.rb
+- spec/support/ca/.gitignore
+- spec/support/ca/config.yaml.erb
+- spec/support/ca_server.rb
+- spec/support/certs/README.md
+- spec/support/certs/ca.crt
+- spec/support/certs/digicert_ev.crt
+- spec/support/certs/github.crt
+- spec/support/certs/github_chain.crt
+- spec/support/certs/no_validator.crt
+- spec/validator_spec.rb
+has_rdoc: