Class: DevPKI::CA

Inherits:
Object
  • Object
show all
Defined in:
lib/devpki/ca.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(id = 0) ⇒ CA

Returns a new instance of CA.

Raises:



13
14
15
16
17
18
 
# File 'lib/devpki/ca.rb', line 13

def initialize(id=0)
  raise CADBError.new("CA ##{id} does not exist. It must be initialized first.") if not DevPKI::CA.exists?(id)

  @sqlite_db = SQLite3::Database.open(DevPKI::CA.db_path(id))
  @id = id
end

Instance Attribute Details

#id ⇒ Object

Returns the value of attribute id.



11
12
13
 
# File 'lib/devpki/ca.rb', line 11

def id
  @id
end

#sqlite_db ⇒ Object

Returns the value of attribute sqlite_db.



10
11
12
 
# File 'lib/devpki/ca.rb', line 10

def sqlite_db
  @sqlite_db
end

Class Method Details

.db_path(id) ⇒ Object

Returns the path to a CA database



117
118
119
 
# File 'lib/devpki/ca.rb', line 117

def self.db_path(id)
  DevPKI::DataDirectory::absolute_path_for("ca_#{id}.db")
end

.delete(id) ⇒ Object

Raises:



20
21
22
23
 
# File 'lib/devpki/ca.rb', line 20

def self.delete(id)
  raise InvalidOption.new("CA with ID #{id} does not exist.") if not self.exists?(id)
  File.delete self.db_path(id)
end

.exists?(id) ⇒ Boolean

Checks if CA with given ID exists

Returns:

  • (Boolean) 


112
113
114
 
# File 'lib/devpki/ca.rb', line 112

def self.exists?(id)
  File.exists?(self.db_path(id))
end

.init(id, name = nil, parent_ca_id = nil) ⇒ Object

Initializes an empty CA database and generates a certificate for self

Raises:



26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'lib/devpki/ca.rb', line 26

def self.init(id, name=nil, parent_ca_id=nil)
  raise InvalidOption.new("CA with ID #{id} already exists!") if self.exists?(id)
  raise InvalidOption.new("Parent CA with ID #{id} does not exist!") if parent_ca_id != nil and not self.exists?(parent_ca_id)

  db = SQLite3::Database.new(self.db_path(id))

  sql = "    create table certificates (\n      id integer primary key autoincrement,\n      private_key_id integer not null,\n      pem text,\n\n      FOREIGN KEY(private_key_id) REFERENCES private_keys(id)\n    );\n\n    create table private_keys (\n      id integer primary key autoincrement,\n      pem text\n    );\n  SQL\n\n  db.execute_batch(sql)\n\n  if parent_ca_id != nil\n    raise InvalidOption.new(\"Parent CA with ID \#{id} does not exist!\") if not self.exists?(parent_ca_id)\n    puts \"Exists: \#{self.exists?(parent_ca_id)}\"\n    parent_db = SQLite3::Database.open(self.db_path(parent_ca_id))\n\n    parent_ca_raw = parent_db.get_first_value( \"select pem from certificates\" )\n    parent_key_raw = parent_db.get_first_value( \"select pem from private_keys\" )\n\n    parent_ca_cert = OpenSSL::X509::Certificate.new parent_ca_raw\n    parent_ca_key = OpenSSL::PKey::RSA.new parent_key_raw\n  end\n\n  key = OpenSSL::PKey::RSA.new(2048)\n  public_key = key.public_key\n\n  name ||= \"Generic DevPKI CA #\#{id}\"\n  subject = \"/CN=\#{name}\"\n\n  cert = OpenSSL::X509::Certificate.new\n  cert.subject = OpenSSL::X509::Name.parse(subject)\n  if parent_ca_id == nil\n    cert.issuer = cert.subject\n  else\n    cert.issuer = parent_ca_cert.subject\n  end\n  cert.not_before = Time.now\n  cert.not_after = Time.now + 2 * 365 * 24 * 60 * 60\n  cert.public_key = public_key\n  cert.serial = Random.rand(1..100000)\n  cert.version = 2\n\n  ef = OpenSSL::X509::ExtensionFactory.new\n  ef.subject_certificate = cert\n\n  if parent_ca_id == nil\n    ef.issuer_certificate = cert\n  else\n    ef.issuer_certificate = parent_ca_cert\n  end\n\n  cert.extensions = [\n    ef.create_extension(\"basicConstraints\",\"CA:TRUE\", true),\n    ef.create_extension(\"subjectKeyIdentifier\", \"hash\"),\n  ]\n  cert.add_extension ef.create_extension(\"authorityKeyIdentifier\",\n                                         \"keyid:always,issuer:always\")\n\n  if parent_ca_id == nil\n    cert.sign key, OpenSSL::Digest::SHA512.new\n  else\n    cert.sign parent_ca_key, OpenSSL::Digest::SHA512.new\n  end\n\n  db.execute( \"INSERT INTO private_keys (pem) VALUES ( ? )\", key.to_pem )\n  private_key_id = db.last_insert_row_id\n\n  db.execute( \"INSERT INTO certificates (private_key_id, pem) VALUES ( ?, ? )\", private_key_id, cert.to_pem)\n\n  puts key.to_pem\n  puts cert.to_pem\nend\n"