vagrant-docker-certificates-manager 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 023a4ac2fc48aacbf0de2d60bfa2b91a8890318b623c2169538ea748db884367
-  data.tar.gz: 8b709c9e9c8a637e80df487b3ca0381e9ff1cd0c2334941024819a842050e4b6
+  metadata.gz: 7205874687ebbce5453b9267447c8a007d949416b370e67d141b4e633193ce1b
+  data.tar.gz: 5970d32848bbb46f63f4d3b1dd0c12823350937e69363dbd1c4e1d7e7cf1ab16
 SHA512:
-  metadata.gz: 2cdba816ec1797ad404199e153bdb3e25b9b105bc62ea872d1068efbdaf0649e9e80ea8b1044c46f966b19e19cda29c85fb09c80af5632cf1acbe794e3152fc0
-  data.tar.gz: 8697e75304b157574141dc5b7ebeef2d81ffcc4c6bb27d23277f45f25418a40bb8c1e3de045f8b7bb418adfff601d3eb7058b2af15df97d4ecf16e92f324274e
+  metadata.gz: da2f09201144ccaa74456e248c84d3c89297be73764c7d7cd2cc5a5fda5547c08b03d1eb9099fdab2808bf7a51e392faab5496ed3033ef86a4e96c9121388e88
+  data.tar.gz: 8a8f01b14910172242e72b62bd9dd889fcc79f56e0449f2d48ccffd763c91f5dab7a887ca52b214efdd8038d976c7e0c9464d4069b95c03ecd226fa1f30ebefd

data/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [0.4.0](https://github.com/julienpoirou/vagrant-docker-certificates-manager/compare/v0.3.0...v0.4.0) (2026-07-03)
+
+
+### Fonctionnalités ✨
+
+* Improve plugin quality and publish RubyDoc ([278298b](https://github.com/julienpoirou/vagrant-docker-certificates-manager/commit/278298b614ac9e4b0797d806bed3e0015d7fdb1f))
+
+
+### Corrections 🐛
+
+* Resolve rubocop offenses and enable pages for RubyDoc deploy ([227c596](https://github.com/julienpoirou/vagrant-docker-certificates-manager/commit/227c5967c1480a2771413cf5738d2ac1f030d495))
+
+## [0.3.0](https://github.com/julienpoirou/vagrant-docker-certificates-manager/compare/v0.2.0...v0.3.0) (2026-03-09)
+
+
+### Fonctionnalités ✨
+
+* **firefox:** Adding certificate management to Firefox ([6e067c3](https://github.com/julienpoirou/vagrant-docker-certificates-manager/commit/6e067c3a99f7963aa27b8cfc7b1e481a443af4ec))
+
+
+### Corrections 🐛
+
+* **rubocop:** Migrate rubocop-rspec from require to plugins ([9a22642](https://github.com/julienpoirou/vagrant-docker-certificates-manager/commit/9a226421d98aab0d781fd1ac3d0845e5b1c43ff4))
+* **rubocop:** Restore explicit *args for Ruby 3.1 compatibility ([595438d](https://github.com/julienpoirou/vagrant-docker-certificates-manager/commit/595438d061e2f1aafb7616b91110935ef4718a5c))
+
 ## [0.2.0](https://github.com/julienpoirou/vagrant-docker-certificates-manager/compare/v0.1.0...v0.2.0) (2025-08-20)
 
 

data/lib/vagrant-docker-certificates-manager/VERSION

@@ -1 +1 @@
-0.2.0
+0.4.0

data/lib/vagrant-docker-certificates-manager/actions/install.rb

@@ -24,6 +24,15 @@ module VagrantDockerCertificatesManager
         @app.call(env)
       end
 
+      # Installs a configured certificate into the current host trust store.
+      #
+      # The operation is idempotent: when the fingerprint is already tracked,
+      # the current machine adopts the existing registry entry instead of
+      # reinstalling the certificate.
+      #
+      # @param cfg [#cert_path, #cert_name] Vagrant certificate configuration.
+      # @param env [Hash, nil] Vagrant environment hash.
+      # @return [Hash] Normalized result with code, status, data, or error.
       def self.perform_install(cfg, env)
         unless File.file?(cfg.cert_path)
           return { code: 1, status: "error",
@@ -32,9 +41,11 @@ error: UiHelpers.t("errors.invalid_path", path: cfg.cert_path) }
 
         name = cfg.cert_name.to_s.strip.empty? ? Cert.default_name_from(cfg.cert_path) : cfg.cert_name
         fp   = Cert.sha1(cfg.cert_path)
+        mid  = env && env[:machine]&.id
+
         if Registry.all.key?(fp)
-          return { code: 1, status: "error",
-error: UiHelpers.t("errors.already_present", name: name) }
+          Registry.adopt(fp, mid) if mid
+          return { code: 0, status: "success", data: { os: OS.detect, cert: name, already: true } }
         end
 
         os = OS.detect
@@ -51,7 +62,8 @@ firefox: cfg.manage_firefox)
           "path"      => File.expand_path(cfg.cert_path),
           "name"      => name,
           "nickname"  => Cert.nickname_for(name),
-          "os"        => os.to_s
+          "os"        => os.to_s,
+          "owners"    => [mid].compact
         })
         { code: 0, status: "success", data: { os: os, cert: name } }
       end

data/lib/vagrant-docker-certificates-manager/actions/uninstall.rb

@@ -1,8 +1,10 @@
 # frozen_string_literal: true
 
+require "fileutils"
 require_relative "../util/os"
 require_relative "../util/ui"
 require_relative "../util/cert"
+require_relative "../util/generator"
 require_relative "../util/registry"
 require_relative "../helpers"
 
@@ -12,7 +14,7 @@ module VagrantDockerCertificatesManager
       def initialize(app, env); @app = app; @env = env; end
 
       def call(env)
-        cfg = env[:machine].config.docker_certs
+        cfg = env[:machine].config.docker_certificates
         UiHelpers.set_locale!(cfg.locale || "en")
         if cfg.remove_on_destroy
           Ui.say(env, :info, "uninstall.start", name: cfg.cert_name)
@@ -21,22 +23,61 @@ module VagrantDockerCertificatesManager
                  result[:status] == "success" ? "uninstall.success" : "uninstall.fail",
                  name: cfg.cert_name)
         end
+        purge_generated(cfg, env)
         @app.call(env)
       end
 
-      def self.perform_uninstall(cfg, _env)
+      def purge_generated(cfg, env)
+        # Generated material is purged only through explicit env flags to avoid
+        # deleting a CA/server certificate that may be shared outside this action.
+        files = []
+        files += [Generator::CA_CERT, Generator::CA_KEY, Generator::CRL] if env_flag?("VDCM_PURGE_CA_ON_DESTROY")
+        files += [Generator::SRV_CRT, Generator::SRV_KEY]                if env_flag?("VDCM_PURGE_SERVER_ON_DESTROY")
+        return if files.empty?
+
+        dir = cfg.cert_dir
+        files.uniq.each do |name|
+          path = File.join(dir, name)
+          next unless File.exist?(path)
+
+          File.delete(path)
+          Ui.say(env, :info, "purge.removed", path: path)
+        rescue StandardError => e
+          Ui.say(env, :warn, "purge.failed", path: path, error: e.message)
+        end
+      end
+
+      def env_flag?(name)
+        ENV[name].to_s == "1"
+      end
+
+      # Removes a configured certificate when the current machine is the last owner.
+      #
+      # Shared certificates stay installed until every machine recorded in the
+      # registry has released ownership.
+      #
+      # @param cfg [#cert_path, #cert_name] Vagrant certificate configuration.
+      # @param env [Hash, nil] Vagrant environment hash.
+      # @return [Hash] Normalized result with code, status, data, or error.
+      def self.perform_uninstall(cfg, env)
         fp_entry = Registry.find_by_path(cfg.cert_path)
         unless fp_entry
           return({ code: 1, status: "error",
                    error: UiHelpers.t("errors.not_found_for_remove", path: cfg.cert_path) })
         end
         fp, rec = fp_entry
+        mid = env && env[:machine]&.id
+
+        if mid && Registry.release(fp, mid)
+          return({ code: 0, status: "success", data: { kept: true, cert: rec["name"] } })
+        end
+
         os = OS.detect
         ok = case os
              when :mac     then OS.mac_remove_by_fp(fp)
              when :linux   then OS.linux_uninstall_cert(rec["name"], nss: cfg.manage_nss_browsers,
                                                                      firefox: cfg.manage_firefox)
-             when :windows then OS.win_remove_by_fp(fp)
+             when :windows then OS.win_remove_by_fp(fp, disable_firefox: !Registry.others_for_os?(fp, "windows"))
              else return({ code: 2, status: "error", error: UiHelpers.t("errors.os_unsupported") })
              end
         Registry.untrack(fp) if ok

data/lib/vagrant-docker-certificates-manager/config.rb

@@ -1,38 +1,86 @@
 # frozen_string_literal: true
 
 module VagrantDockerCertificatesManager
+  # Vagrant configuration for certificate generation, installation, and cleanup.
+  #
+  # @!attribute cert_path
+  #   @return [String] Path to the CA certificate installed into the trust store.
+  # @!attribute cert_name
+  #   @return [String] Friendly certificate name used in host trust stores.
+  # @!attribute install_on_up
+  #   @return [Boolean] Whether to install the certificate during `vagrant up`.
+  # @!attribute remove_on_destroy
+  #   @return [Boolean] Whether to remove the certificate during `vagrant destroy`.
+  # @!attribute manage_firefox
+  #   @return [Boolean] Whether Firefox stores should be managed where supported.
+  # @!attribute manage_nss_browsers
+  #   @return [Boolean] Whether NSS browser stores should be managed where supported.
+  # @!attribute generate_on_up
+  #   @return [Boolean] Whether local certificate material should be generated during `vagrant up`.
   class Config < Vagrant.plugin("2", :config)
     attr_accessor :cert_path, :cert_name, :install_on_up, :remove_on_destroy,
                   :manage_firefox, :manage_nss_browsers, :locale, :verbose,
-                  :container_name
+                  :container_name,
+                  :generate_on_up, :ca_cn, :ca_days, :server_domain, :crl_url
 
     def initialize
-      @cert_path            = "certs/rootca.cert.pem"
-      @cert_name            = "local.dev"
-      @install_on_up        = false
-      @remove_on_destroy    = false
-      @manage_firefox       = false
-      @manage_nss_browsers  = true
-      @locale               = "en"
-      @verbose              = false
-      @container_name       = nil
+      @cert_path            = UNSET_VALUE
+      @cert_name            = UNSET_VALUE
+      @install_on_up        = UNSET_VALUE
+      @remove_on_destroy    = UNSET_VALUE
+      @manage_firefox       = UNSET_VALUE
+      @manage_nss_browsers  = UNSET_VALUE
+      @locale               = UNSET_VALUE
+      @verbose              = UNSET_VALUE
+      @container_name       = UNSET_VALUE
+      @generate_on_up       = UNSET_VALUE
+      @ca_cn                = UNSET_VALUE
+      @ca_days              = UNSET_VALUE
+      @server_domain        = UNSET_VALUE
+      @crl_url              = UNSET_VALUE
     end
 
     def finalize!
-      @cert_path = @container_name unless @container_name.to_s.strip.empty?
+      @cert_path           = "certs/rootca.cert.pem" if @cert_path == UNSET_VALUE
+      @cert_name           = "local.dev"             if @cert_name == UNSET_VALUE
+      @install_on_up       = false                   if @install_on_up == UNSET_VALUE
+      @remove_on_destroy   = false                   if @remove_on_destroy == UNSET_VALUE
+      @manage_firefox      = false                   if @manage_firefox == UNSET_VALUE
+      @manage_nss_browsers = true                    if @manage_nss_browsers == UNSET_VALUE
+      @locale              = "en"                    if @locale == UNSET_VALUE
+      @verbose             = false                   if @verbose == UNSET_VALUE
+      @container_name      = nil                     if @container_name == UNSET_VALUE
+      @generate_on_up      = false                   if @generate_on_up == UNSET_VALUE
+      @ca_cn               = "local-ca"              if @ca_cn == UNSET_VALUE
+      @ca_days             = 3650                    if @ca_days == UNSET_VALUE
+      @server_domain       = nil                     if @server_domain == UNSET_VALUE
+      @crl_url             = nil                     if @crl_url == UNSET_VALUE
+
       @install_on_up       = !!@install_on_up
       @remove_on_destroy   = !!@remove_on_destroy
       @manage_firefox      = !!@manage_firefox
       @manage_nss_browsers = !!@manage_nss_browsers
       @verbose             = !!@verbose
+      @generate_on_up      = !!@generate_on_up
       @locale              = (@locale || "en").to_s
+      @ca_cn               = (@ca_cn || "local-ca").to_s
+      @ca_days             = @ca_days.to_i
     end
 
     def validate(_machine)
       errors = []
       errors << "cert_path must be provided" if @cert_path.to_s.strip.empty?
       errors << "cert_name must be provided" if @cert_name.to_s.strip.empty?
+      unless @locale.is_a?(String) && %w[en fr].include?(@locale.to_s[0, 2].downcase)
+        errors << "locale must be 'en' or 'fr'"
+      end
+      errors << "ca_days must be a positive integer" if @generate_on_up && @ca_days.to_i <= 0
       { "vagrant-docker-certificates-manager" => errors }
     end
+
+    def cert_dir
+      d = File.dirname(@cert_path.to_s)
+      d.empty? ? "certs" : d
+    end
   end
 end

data/lib/vagrant-docker-certificates-manager/helpers.rb

@@ -21,7 +21,8 @@ module VagrantDockerCertificatesManager
       error:    "❌",
       version:  "💾",
       broom:    "🧹",
-      question: "❓"
+      question: "❓",
+      bug:      "🐛"
     }.freeze
 
     module_function
@@ -30,33 +31,34 @@ module VagrantDockerCertificatesManager
       return if defined?(@i18n_setup) && @i18n_setup
       ::I18n.enforce_available_locales = false
       base  = File.expand_path("../../locales", __dir__)
-      ::I18n.load_path |= Dir[File.join(base, "*.yml")]
+      paths = Dir[File.join(base, "*.yml")]
+      if paths.empty? && File.directory?(base)
+        paths = Dir.children(base).grep(/\.ya?ml\z/).map { |file| File.join(base, file) }
+      end
+      ::I18n.load_path |= paths
       ::I18n.available_locales = SUPPORTED
-      default = ((ENV["VDCM_LANG"] || ENV["LANG"] || "en")[0,2] rescue "en").to_sym
+      default = ((ENV["VDCM_LANG"] || ENV["LANG"] || "en")[0, 2] rescue "en").to_sym
       ::I18n.default_locale = SUPPORTED.include?(default) ? default : :en
       ::I18n.backend.load_translations
       @i18n_setup = true
     end
 
     def set_locale!(lang, strict: false)
-        setup_i18n!
-
-        raw = (lang || ENV["VDCM_LANG"] || ENV["LANG"] || "en").to_s
-        sym = raw[0, 2].to_s.downcase.to_sym
-        sym = :en if sym.nil? || sym == :""
-
-        unless SUPPORTED.include?(sym)
-            if strict
-            raise UnsupportedLocaleError,
-                    "#{e(:error)} Unsupported language: #{sym}. Available: #{SUPPORTED.join(', ')}"
-            else
-            sym = :en
-            end
+      setup_i18n!
+      raw = (lang || ENV["VDCM_LANG"] || ENV["LANG"] || "en").to_s
+      sym = raw[0, 2].to_s.downcase.to_sym
+      sym = :en if sym.nil? || sym == :""
+      unless SUPPORTED.include?(sym)
+        if strict
+          raise UnsupportedLocaleError,
+                "#{e(:error)} Unsupported language: #{sym}. Available: #{SUPPORTED.join(', ')}"
+        else
+          sym = :en
         end
-
-    ::I18n.locale = sym
-    ::I18n.backend.load_translations
-    sym
+      end
+      ::I18n.locale = sym
+      ::I18n.backend.load_translations
+      sym
     end
 
     def e(key, no_emoji: false)
@@ -88,6 +90,18 @@ module VagrantDockerCertificatesManager
       v.is_a?(Hash) ? v : {}
     end
 
+    def exists?(key)
+      ::I18n.exists?(ns_key(key), ::I18n.locale)
+    end
+
+    def our_key?(k)
+      OUR_SPACES.any? { |ns| k.start_with?("#{NAMESPACE}.#{ns}") || k.start_with?(ns) }
+    end
+
+    def debug_enabled?
+      ENV["VDCM_DEBUG"].to_s == "1"
+    end
+
     def level_to_emoji(level)
       case level
       when :success then :success
@@ -114,8 +128,8 @@ module VagrantDockerCertificatesManager
     end
 
     def debug(env_or_ui, msg)
-      return unless ENV["VDCM_DEBUG"].to_s == "1"
-      say(env_or_ui, :info, nil, raw: "#{e(:question)} #{msg}")
+      return unless debug_enabled?
+      say(env_or_ui, :info, nil, raw: "#{e(:bug)} #{msg}")
     end
 
     def print_general_help(no_emoji: false, ui: nil)
@@ -125,6 +139,10 @@ module VagrantDockerCertificatesManager
       lines << "  #{t('cli.usage')}"
       t_hash("help.commands").each_value { |line| lines << "  #{line}" }
 
+      emit_lines(lines, ui)
+    end
+
+    def emit_lines(lines, ui)
       if ui
         lines.each { |ln| ui.info(ln) }
       else
@@ -137,43 +155,53 @@ module VagrantDockerCertificatesManager
       topic = (topic || "").to_s.strip.downcase
       return print_general_help(no_emoji: no_emoji, ui: ui) if topic.empty?
 
-      base  = "help.topic.#{topic}"
-      title = t("#{base}.title",       default: nil)
-      usage = t("#{base}.usage",       default: nil)
-      desc  = t("#{base}.description", default: nil)
-      opts  = t_hash("#{base}.options")
-      exs   = ::I18n.t("#{base}.examples", default: [])
+      fields = topic_help_fields("help.topic.#{topic}")
+      return print_general_help(no_emoji: no_emoji, ui: ui) if topic_help_empty?(fields)
 
-      if title.nil? && usage.nil? && desc.nil? && opts.empty? && exs.empty?
-        return print_general_help(no_emoji: no_emoji, ui: ui)
-      end
+      emit_lines(build_topic_help_lines(topic, fields, no_emoji), ui)
+    end
+
+    def topic_help_fields(base)
+      {
+        title: t("#{base}.title",       default: nil),
+        usage: t("#{base}.usage",       default: nil),
+        desc:  t("#{base}.description", default: nil),
+        opts:  t_hash("#{base}.options"),
+        exs:   ::I18n.t(ns_key("#{base}.examples"), default: [])
+      }
+    end
+
+    def topic_help_empty?(fields)
+      fields[:title].nil? && fields[:usage].nil? && fields[:desc].nil? &&
+        fields[:opts].empty? && fields[:exs].empty?
+    end
 
+    def build_topic_help_lines(topic, fields, no_emoji)
       lines = []
-      lines << "#{e(:info, no_emoji: no_emoji)} #{title || t('help.topic_fallback_title', topic: topic)}"
+      lines << "#{e(:info, no_emoji: no_emoji)} #{fields[:title] || t('help.topic_fallback_title', topic: topic)}"
       lines << "  #{t('help.usage_label')}"
-      lines << "    #{usage || 'vagrant certs help'}"
-      if desc && !desc.strip.empty?
-        lines << "  #{t('help.description_label')}"
-        lines << "    #{desc}"
-      end
-      unless opts.empty?
-        lines << "  #{t('help.options_label')}"
-        opts.each_value { |line| lines << "    #{line}" }
-      end
-      if exs.is_a?(Array) && !exs.empty?
-        lines << "  #{t('help.examples_label')}"
-        exs.each { |ex| lines << "    #{ex}" }
+      lines << "    #{fields[:usage] || 'vagrant certs help'}"
+
+      desc = fields[:desc]
+      append_help_section(lines, t("help.description_label"), ["    #{desc}"]) if desc && !desc.strip.empty?
+      unless fields[:opts].empty?
+        append_help_section(lines, t("help.options_label"), fields[:opts].values.map do |l|
+          "    #{l}"
+        end)
       end
 
-      if ui
-        lines.each { |ln| ui.info(ln) }
-      else
-        lines.each { |ln| puts ln }
+      exs = fields[:exs]
+      if exs.is_a?(Array) && !exs.empty?
+        append_help_section(lines, t("help.examples_label"), exs.map do |ex|
+          "    #{ex}"
+        end)
       end
+      lines
     end
 
-    def our_key?(k)
-      OUR_SPACES.any? { |ns| k.start_with?("#{NAMESPACE}.#{ns}") || k.start_with?(ns) }
+    def append_help_section(lines, label, body_lines)
+      lines << "  #{label}"
+      body_lines.each { |line| lines << line }
     end
   end
 end

data/lib/vagrant-docker-certificates-manager/util/cert.rb

@@ -31,5 +31,99 @@ module VagrantDockerCertificatesManager
     def nickname_for(name)
       "#{MARKER}:#{name}"
     end
+
+    def fingerprint_of(cert)
+      OpenSSL::Digest::SHA1.hexdigest(cert.to_der).upcase
+    end
+
+    # Generates a local development certificate authority.
+    #
+    # The generated CA is intended for local Docker/Vagrant workflows, not as a
+    # public browser-trusted certificate authority.
+    #
+    # @param cn [String] Common name for the CA certificate.
+    # @param days [Integer] Validity period in days.
+    # @param org [String] Organization attribute written to the subject.
+    # @param country [String] Country attribute written to the subject.
+    # @return [Array<OpenSSL::X509::Certificate, OpenSSL::PKey::RSA>] Generated certificate and private key.
+    def generate_ca(common_name:, days: 3650, org: "VDCM", country: "FR")
+      key  = OpenSSL::PKey::RSA.generate(2048)
+      cert = OpenSSL::X509::Certificate.new
+
+      cert.version    = 2
+      cert.serial     = 1
+      cert.subject    = OpenSSL::X509::Name.parse("/CN=#{common_name}/O=#{org}/C=#{country}")
+      cert.issuer     = cert.subject
+      cert.public_key = key.public_key
+      cert.not_before = Time.now
+      cert.not_after  = Time.now + (days * 24 * 60 * 60)
+
+      ef = OpenSSL::X509::ExtensionFactory.new(cert, cert)
+      cert.add_extension(ef.create_extension("basicConstraints",     "CA:TRUE",             true))
+      cert.add_extension(ef.create_extension("keyUsage",             "keyCertSign,cRLSign", true))
+      cert.add_extension(ef.create_extension("subjectKeyIdentifier", "hash"))
+      cert.sign(key, OpenSSL::Digest.new("SHA256"))
+
+      [cert, key]
+    end
+
+    def load_ca(cert_path, key_path)
+      [
+        OpenSSL::X509::Certificate.new(File.read(cert_path)),
+        OpenSSL::PKey::RSA.new(File.read(key_path))
+      ]
+    end
+
+    # Generates a server certificate signed by the supplied local CA.
+    #
+    # Modern clients validate the SAN extension; the CN is kept mainly for
+    # readability and compatibility with older tooling.
+    #
+    # @param ca_cert [OpenSSL::X509::Certificate] CA certificate used as issuer.
+    # @param ca_key [OpenSSL::PKey::RSA] CA private key used to sign the certificate.
+    # @param domain [String] DNS name written to CN and subjectAltName.
+    # @param days [Integer] Validity period in days.
+    # @param crl_url [String, nil] Optional CRL distribution point URL.
+    # @return [Array<OpenSSL::X509::Certificate, OpenSSL::PKey::RSA>] Generated certificate and private key.
+    def generate_server(ca_cert, ca_key, domain:, days: 825, crl_url: nil)
+      key  = OpenSSL::PKey::RSA.generate(2048)
+      cert = OpenSSL::X509::Certificate.new
+
+      cert.version    = 2
+      cert.serial     = 2
+      cert.subject    = OpenSSL::X509::Name.parse("/CN=#{domain}")
+      cert.issuer     = ca_cert.subject
+      cert.public_key = key.public_key
+      cert.not_before = Time.now
+      cert.not_after  = Time.now + (days * 24 * 60 * 60)
+
+      ef = OpenSSL::X509::ExtensionFactory.new(ca_cert, cert)
+      cert.add_extension(ef.create_extension("subjectAltName",   "DNS:#{domain}"))
+      cert.add_extension(ef.create_extension("basicConstraints", "CA:FALSE"))
+      cert.add_extension(ef.create_extension("keyUsage",         "digitalSignature,keyEncipherment", true))
+      cert.add_extension(ef.create_extension("extendedKeyUsage", "serverAuth"))
+      unless crl_url.to_s.strip.empty?
+        cert.add_extension(ef.create_extension("crlDistributionPoints", "URI:#{crl_url}"))
+      end
+      cert.sign(ca_key, OpenSSL::Digest.new("SHA256"))
+
+      [cert, key]
+    end
+
+    # Generates an empty certificate revocation list for the local CA.
+    #
+    # @param ca_cert [OpenSSL::X509::Certificate] CA certificate used as issuer.
+    # @param ca_key [OpenSSL::PKey::RSA] CA private key used to sign the CRL.
+    # @param days [Integer] Validity period in days.
+    # @return [OpenSSL::X509::CRL] Signed CRL.
+    def generate_crl(ca_cert, ca_key, days: 3650)
+      crl = OpenSSL::X509::CRL.new
+      crl.issuer      = ca_cert.subject
+      crl.version     = 1
+      crl.last_update = Time.now
+      crl.next_update = Time.now + (days * 24 * 60 * 60)
+      crl.sign(ca_key, OpenSSL::Digest.new("SHA256"))
+      crl
+    end
   end
 end

data/lib/vagrant-docker-certificates-manager/util/os.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "open3"
+require "base64"
 require_relative "cert"
 
 module VagrantDockerCertificatesManager
@@ -9,50 +10,57 @@ module VagrantDockerCertificatesManager
 
     def detect
       if defined?(Vagrant) && Vagrant.const_defined?(:Util) && Vagrant::Util.const_defined?(:Platform)
-        return :mac if Vagrant::Util::Platform.darwin?
+        return :mac     if Vagrant::Util::Platform.darwin?
         return :windows if Vagrant::Util::Platform.windows?
-        return :linux if Vagrant::Util::Platform.linux?
+        return :linux   if Vagrant::Util::Platform.linux?
       else
         plat = RbConfig::CONFIG["host_os"].downcase
-        return :mac if plat.include?("darwin")
+        return :mac     if plat.include?("darwin")
         return :windows if plat =~ /mswin|mingw|windows/
-        return :linux if plat.include?("linux")
+        return :linux   if plat.include?("linux")
       end
       :unknown
     end
 
-    def run(cmd)
-      out, err, st = Open3.capture3(cmd)
+    # Runs an external command safely using the array form (no shell interpolation).
+    def run(*args)
+      out, err, st = Open3.capture3(*args)
       [st.success?, out, err]
     end
 
-    def mac_add_trusted_cert(path, name)
-      ok, *_ = run(%(sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "#{path}"))
-      ok
+    # ── macOS ─────────────────────────────────────────────────────────────────
+
+    def mac_add_trusted_cert(path, _name)
+      run("sudo", "security", "add-trusted-cert",
+          "-d", "-r", "trustRoot",
+          "-k", "/Library/Keychains/System.keychain",
+          path.to_s).first
     end
 
     def mac_has_cert_fingerprint?(fp)
-      ok, out, _ = run(%(security find-certificate -a -Z /Library/Keychains/System.keychain 2>/dev/null))
-      return false unless ok
-      out.include?(fp)
+      ok, out, = run("security", "find-certificate", "-a", "-Z",
+                     "/Library/Keychains/System.keychain")
+      ok && out.include?(fp.to_s)
     end
 
     def mac_remove_by_fp(fp)
-      ok, out, _ = run(%(security find-certificate -a -Z /Library/Keychains/System.keychain 2>/dev/null))
+      ok, out, = run("security", "find-certificate", "-a", "-Z",
+                     "/Library/Keychains/System.keychain")
       return true unless ok
-      hash = out.lines.find { |l| l =~ /SHA-1 hash:\s*#{fp}/i } ? fp : nil
+      hash = out.lines.find { |l| l =~ /SHA-1 hash:\s*#{Regexp.escape(fp)}/i } ? fp : nil
       return true unless hash
-      run(%(sudo security delete-certificate -Z #{hash} /Library/Keychains/System.keychain)).first
+      run("sudo", "security", "delete-certificate",
+          "-Z", hash.to_s, "/Library/Keychains/System.keychain").first
     end
 
+    # ── Linux ─────────────────────────────────────────────────────────────────
+
     def linux_install_cert(path, name, nss: true, firefox: false)
       dest = "/usr/local/share/ca-certificates/#{Cert::MARKER.downcase}-#{name}.crt"
-      ok1, = run(%(sudo cp "#{path}" "#{dest}"))
-      ok2, = run("sudo update-ca-certificates")
-      okn = true
-      okn &&= linux_nss_install(path, name) if nss
-      okf = true
-      okf &&= linux_firefox_install(path, name) if firefox
+      ok1, = run("sudo", "cp", path.to_s, dest)
+      ok2, = run("sudo", "update-ca-certificates")
+      okn = nss     ? linux_nss_install(path, name)     : true
+      okf = firefox ? linux_firefox_install(path, name) : true
       ok1 && ok2 && okn && okf
     end
 
@@ -62,71 +70,149 @@ module VagrantDockerCertificatesManager
 
     def linux_uninstall_cert(name, nss: true, firefox: false)
       dest = "/usr/local/share/ca-certificates/#{Cert::MARKER.downcase}-#{name}.crt"
-      run(%(sudo rm -f "#{dest}"))
-      run("sudo update-ca-certificates")
-      linux_nss_uninstall(name) if nss
+      run("sudo", "rm", "-f", dest)
+      run("sudo", "update-ca-certificates")
+      linux_nss_uninstall(name)     if nss
       linux_firefox_uninstall(name) if firefox
       true
     end
 
     def linux_nss_install(path, name)
-      db = %(sql:"$HOME/.pki/nssdb")
-      run(%(certutil -d #{db} -A -t "C,," -n "#{Cert.nickname_for(name)}" -i "#{path}")).first
+      db = "sql:#{File.join(Dir.home, '.pki', 'nssdb')}"
+      run("certutil", "-d", db, "-A", "-t", "C,,",
+          "-n", Cert.nickname_for(name), "-i", path.to_s).first
     end
 
     def linux_nss_uninstall(name)
-      db = %(sql:"$HOME/.pki/nssdb")
-      run(%(certutil -d #{db} -D -n "#{Cert.nickname_for(name)}"))
+      db = "sql:#{File.join(Dir.home, '.pki', 'nssdb')}"
+      run("certutil", "-d", db, "-D", "-n", Cert.nickname_for(name))
       true
     end
 
     def linux_firefox_profiles
-      home = ENV["HOME"]
+      home = Dir.home
       [
         "#{home}/.mozilla/firefox",
         "#{home}/.var/app/org.mozilla.firefox/.mozilla/firefox",
         "#{home}/snap/firefox/common/.mozilla/firefox"
-      ].select { |d| File.directory?(d) }.flat_map { |base| Dir.glob(File.join(base, "*.default*")) }
+      ].select { |d| File.directory?(d) }
+       .flat_map { |base| Dir.glob(File.join(base, "*.default*")) }
     end
 
     def linux_firefox_install(path, name)
-      profiles = linux_firefox_profiles
-      profiles.all? do |profile|
-        run(%(certutil -A -n "#{Cert.nickname_for(name)}" -t "C,," -i "#{path}" -d "sql:#{profile}")).first
+      linux_firefox_profiles.all? do |profile|
+        run("certutil", "-A",
+            "-n", Cert.nickname_for(name), "-t", "C,,",
+            "-i", path.to_s, "-d", "sql:#{profile}").first
       end
     end
 
     def linux_firefox_uninstall(name)
       linux_firefox_profiles.each do |profile|
-        run(%(certutil -D -n "#{Cert.nickname_for(name)}" -d "sql:#{profile}"))
+        run("certutil", "-D", "-n", Cert.nickname_for(name), "-d", "sql:#{profile}")
+      end
+      true
+    end
+
+    # ── Windows ───────────────────────────────────────────────────────────────
+
+    # Firefox on Windows does not ship with NSS certutil, so we enable
+    # security.enterprise_roots.enabled in each profile's user.js instead.
+    # This makes Firefox delegate trust to the Windows system cert store,
+    # which already contains the CA installed by win_install_cert.
+
+    FIREFOX_ENTERPRISE_ROOTS_PREF = 'user_pref("security.enterprise_roots.enabled", true);'
+    FIREFOX_ENTERPRISE_ROOTS_KEY  = "security.enterprise_roots.enabled"
+
+    def win_firefox_profiles
+      appdata = (ENV["APPDATA"] || File.join(Dir.home, "AppData", "Roaming")).tr("\\", "/")
+      base    = "#{appdata}/Mozilla/Firefox/Profiles"
+      return [] unless File.directory?(base)
+      Dir.glob("#{base}/*").select { |d| File.directory?(d) }
+    end
+
+    def win_firefox_enable_enterprise_roots
+      win_firefox_profiles.each do |profile|
+        user_js = File.join(profile, "user.js")
+        content = File.exist?(user_js) ? File.read(user_js) : ""
+        next if content.include?(FIREFOX_ENTERPRISE_ROOTS_KEY)
+        File.open(user_js, "a") { |f| f.puts FIREFOX_ENTERPRISE_ROOTS_PREF }
+      end
+      true
+    rescue StandardError
+      false
+    end
+
+    def win_firefox_disable_enterprise_roots
+      win_firefox_profiles.each do |profile|
+        user_js = File.join(profile, "user.js")
+        next unless File.exist?(user_js)
+        updated = File.read(user_js)
+                      .lines
+                      .reject { |l| l.include?(FIREFOX_ENTERPRISE_ROOTS_KEY) }
+                      .join
+        File.write(user_js, updated)
       end
       true
+    rescue StandardError
+      false
     end
 
     def win_install_cert(path, name)
-      ok, out, err = run(%(certutil -addstore -f "ROOT" "#{path}"))
-      return false unless ok
-      fp = Cert.sha1(path)
-      ps = %(
-        $cert = Get-ChildItem Cert:\\LocalMachine\\Root | Where-Object { $_.Thumbprint -eq "#{fp}" };
-        if ($cert) { $cert.FriendlyName = "#{Cert.nickname_for(name)}"; }
-      ).strip
-      run(%(powershell -NoProfile -NonInteractive -Command "#{ps}"))
+      fp   = Cert.sha1(path)
+      nick = Cert.nickname_for(name).gsub("'", "''")
+      abs  = File.expand_path(path).tr("/", "\\").gsub("'", "''")
+
+      ps = <<~PS
+        $ErrorActionPreference = 'Stop'
+        Import-Certificate -FilePath '#{abs}' -CertStoreLocation Cert:\\LocalMachine\\Root | Out-Null
+        $cert = Get-ChildItem Cert:\\LocalMachine\\Root | Where-Object { $_.Thumbprint -eq '#{fp}' }
+        if ($cert) { $cert.FriendlyName = '#{nick}' }
+      PS
+      encoded = Base64.strict_encode64(ps.encode("UTF-16LE"))
+
+      # Try non-elevated first (works if already admin)
+      ok, = run("powershell", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded)
+
+      unless ok
+        # Elevate via UAC
+        elev = "Start-Process PowerShell -Verb RunAs -Wait " \
+               "-ArgumentList '-NonInteractive','-NoProfile','-EncodedCommand','#{encoded}'"
+        elev_encoded = Base64.strict_encode64(elev.encode("UTF-16LE"))
+        ok, = run("powershell", "-NoProfile", "-NonInteractive", "-EncodedCommand", elev_encoded)
+        return false unless ok
+      end
+
+      win_firefox_enable_enterprise_roots
       true
     end
 
     def win_has_cert_fingerprint?(fp)
-        ps = %q{
-            $c = Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Thumbprint -eq "__FP__" };
-            if ($c) { "YES" } else { "NO" }
-        }.strip.gsub("__FP__", fp.to_s)
-
-        ok, out, _ = run(%(powershell -NoProfile -NonInteractive -Command "#{ps}"))
-        ok && out.to_s.strip == "YES"
+      ps = "if (Get-ChildItem Cert:\\LocalMachine\\Root | " \
+           "Where-Object { $_.Thumbprint -eq '#{fp}' }) { 'YES' } else { 'NO' }"
+      ok, out, = run("powershell", "-NoProfile", "-NonInteractive",
+                     "-EncodedCommand", Base64.strict_encode64(ps.encode("UTF-16LE")))
+      ok && out.to_s.strip == "YES"
     end
 
     def win_remove_by_fp(fp)
-      run(%(certutil -delstore "ROOT" #{fp})).first
+      ps = <<~PS
+        $ErrorActionPreference = 'Stop'
+        Get-ChildItem Cert:\\LocalMachine\\Root |
+          Where-Object { $_.Thumbprint -eq '#{fp}' } |
+          Remove-Item
+      PS
+      encoded = Base64.strict_encode64(ps.encode("UTF-16LE"))
+
+      ok, = run("powershell", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded)
+      return true if ok
+
+      elev = "Start-Process PowerShell -Verb RunAs -Wait " \
+             "-ArgumentList '-NonInteractive','-NoProfile','-EncodedCommand','#{encoded}'"
+      elev_encoded = Base64.strict_encode64(elev.encode("UTF-16LE"))
+      ok = run("powershell", "-NoProfile", "-NonInteractive", "-EncodedCommand", elev_encoded).first
+      win_firefox_disable_enterprise_roots if ok
+      ok
     end
   end
 end

data/lib/vagrant-docker-certificates-manager/util/registry.rb

@@ -15,11 +15,17 @@ module VagrantDockerCertificatesManager
       FileUtils.mkdir_p(File.dirname(db_path))
     end
 
+    # Loads tracked certificates from the best-effort local registry.
+    #
+    # A corrupt or missing registry must not block Vagrant actions, because the
+    # OS trust store remains the source of truth.
+    #
+    # @return [Hash] Registry data keyed by certificate fingerprint.
     def load
       ensure_dir!
       return {} unless File.exist?(db_path)
       JSON.parse(File.read(db_path))
-    rescue
+    rescue StandardError
       {}
     end
 
@@ -28,6 +34,11 @@ module VagrantDockerCertificatesManager
       File.write(db_path, JSON.pretty_generate(data))
     end
 
+    # Tracks a certificate fingerprint and its ownership metadata.
+    #
+    # @param fp [String] Certificate fingerprint.
+    # @param attrs [Hash] Persisted metadata such as path, name, OS, and owners.
+    # @return [void]
     def track(fp, attrs)
       data = load
       data[fp] = attrs
@@ -41,6 +52,42 @@ module VagrantDockerCertificatesManager
       removed
     end
 
+    # Adds an owner to an already tracked certificate.
+    #
+    # @param fp [String] Certificate fingerprint.
+    # @param owner [String, #to_s] Vagrant machine id adopting the certificate.
+    # @return [Boolean] Whether the certificate was already tracked.
+    # rubocop:disable Naming/PredicateMethod -- boolean return kept for symmetry with #release
+    def adopt(fp, owner)
+      data = load
+      return false unless data[fp]
+      data[fp]["owners"] = Array(data[fp]["owners"]) | [owner.to_s]
+      save(data)
+      true
+    end
+    # rubocop:enable Naming/PredicateMethod
+
+    # Releases one owner from a tracked certificate.
+    #
+    # Keep the certificate installed while at least one Vagrant machine still
+    # owns it.
+    #
+    # @param fp [String] Certificate fingerprint.
+    # @param owner [String, #to_s] Vagrant machine id releasing the certificate.
+    # @return [Boolean] Whether other owners remain after the release.
+    # rubocop:disable Naming/PredicateMethod -- boolean return kept for symmetry with #adopt
+    def release(fp, owner)
+      data = load
+      rec  = data[fp]
+      return false unless rec
+      owners = Array(rec["owners"])
+      owners.delete(owner.to_s)
+      rec["owners"] = owners
+      save(data)
+      !owners.empty?
+    end
+    # rubocop:enable Naming/PredicateMethod
+
     def find_by_path(path)
       data = load
       data.find { |_fp, v| File.expand_path(v["path"]) == File.expand_path(path) }
@@ -49,5 +96,9 @@ module VagrantDockerCertificatesManager
     def all
       load
     end
+
+    def others_for_os?(fp, os)
+      load.any? { |k, v| k != fp && v["os"].to_s == os.to_s }
+    end
   end
 end

data/lib/vagrant-docker-certificates-manager/version.rb

@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 
 module VagrantDockerCertificatesManager
-  VERSION = begin
-    path = File.expand_path("VERSION", __dir__)
-    File.exist?(path) ? File.read(path).strip : "0.1.0"
-  rescue
-    "0.1.0"
+  unless defined?(VERSION)
+    VERSION = begin
+      path = File.expand_path("VERSION", __dir__)
+      File.exist?(path) ? File.read(path).strip : "0.1.0"
+    rescue StandardError
+      "0.1.0"
+    end
   end
 end

data/locales/en.yml

@@ -80,14 +80,3 @@ en:
       success: "Certificate %{name} removed."
       fail: "Failed to remove certificate %{name}."
       skip: "Remove on destroy disabled; skipping."
-
-    errors:
-      invalid_path: "Invalid certificate path: %{path}"
-      missing_path_remove: "You must provide a path for removal."
-      not_found_for_remove: "No tracked certificate found for path: %{path}"
-      already_present: "The certificate %{name} already exists."
-      install_failed: "Certificate installation failed."
-      uninstall_failed: "Certificate removal failed."
-      remove_failed: "Remove failed."
-      os_unsupported: "Unsupported OS for this action."
-      unknown_command: "Unknown command: %{cmd}"

data/locales/fr.yml

@@ -80,14 +80,3 @@ fr:
       success: "Certificat %{name} supprimé."
       fail: "Échec de la suppression du certificat %{name}."
       skip: "Suppression à la destruction désactivée ; on ignore."
-
-    errors:
-      invalid_path: "Chemin de certificat invalide : %{path}"
-      missing_path_remove: "Vous devez fournir un chemin à supprimer."
-      not_found_for_remove: "Aucun certificat suivi pour le chemin : %{path}"
-      already_present: "Le certificat %{name} existe déjà."
-      install_failed: "Échec de l'installation du certificat."
-      uninstall_failed: "Échec de la suppression du certificat."
-      remove_failed: "Échec de la suppression."
-      os_unsupported: "Système non pris en charge pour cette action."
-      unknown_command: "Commande inconnue : %{cmd}"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vagrant-docker-certificates-manager
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Julien Poirou
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-20 00:00:00.000000000 Z
+date: 2026-07-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n