D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
proc
/
self
/
root
/
opt
/
alt
/
ruby34
/
share
/
ri
/
system
/
OpenSSL
/
X509
/
Certificate
/
Filename :
cdesc-Certificate.ri
back
Copy
U:RDoc::NormalClass[iI"Certificate:ETI" OpenSSL::X509::Certificate;TI" Object;To:RDoc::Markup::Document: @parts[o;;[ : @fileI"$ext/openssl/lib/openssl/x509.rb;T:0@omit_headings_from_table_of_contents_below0o;;["o: RDoc::Markup::Paragraph;[ I"FImplementation of an X.509 certificate as specified in RFC 5280. ;TI"KProvides access to a certificate's attributes and allows certificates ;TI"Eto be read from a string, but also supports the creation of new ;TI" certificates from scratch.;To: RDoc::Markup::BlankLine S:RDoc::Markup::Heading: leveli: textI"&Reading a certificate from a file;T@o; ;[I"ECertificate is capable of handling DER-encoded certificates and ;TI"2certificates encoded in OpenSSL's PEM format.;T@o:RDoc::Markup::Verbatim;[I"9raw = File.binread "cert.cer" # DER- or PEM-encoded ;TI"6certificate = OpenSSL::X509::Certificate.new raw ;T: @format0S; ;i;I"#Saving a certificate to a file;T@o; ;[I"/A certificate may be encoded in DER format;T@o;;[I"cert = ... ;TI"=File.open("cert.cer", "wb") { |f| f.print cert.to_der } ;T;0o; ;[I"or in PEM format;T@o;;[I"cert = ... ;TI"=File.open("cert.pem", "wb") { |f| f.print cert.to_pem } ;T;0o; ;[ I"GX.509 certificates are associated with a private/public key pair, ;TI"Ctypically a RSA, DSA or ECC key (see also OpenSSL::PKey::RSA, ;TI"IOpenSSL::PKey::DSA and OpenSSL::PKey::EC), the public key itself is ;TI"Estored within the certificate and can be accessed in form of an ;TI"LOpenSSL::PKey. Certificates are typically used to be able to associate ;TI"Lsome form of identity with a key pair, for example web servers serving ;TI"Npages over HTTPs use certificates to authenticate themselves to the user.;T@o; ;[ I"MThe public key infrastructure (PKI) model relies on trusted certificate ;TI"Iauthorities ("root CAs") that issue these certificates, so that end ;TI"Gusers need to base their trust just on a selected few authorities ;TI"Cthat themselves again vouch for subordinate CAs issuing their ;TI" certificates to end users.;T@o; ;[I"JThe OpenSSL::X509 module provides the tools to set up an independent ;TI"HPKI, similar to scenarios where the 'openssl' command line tool is ;TI"4used for issuing certificates in a private PKI.;T@S; ;i;I"ACreating a root CA certificate and an end-entity certificate;T@o; ;[ I"JFirst, we need to create a "self-signed" root certificate. To do so, ;TI"Iwe need to generate a key first. Please note that the choice of "1" ;TI"Mas a serial number is considered a security flaw for real certificates. ;TI"ISecure choices are integers in the two-digit byte range and ideally ;TI"Jnot sequential but secure random numbers, steps omitted here to keep ;TI"the example concise.;T@o;;[I"Jroot_key = OpenSSL::PKey::RSA.new 2048 # the CA's public/private key ;TI".root_ca = OpenSSL::X509::Certificate.new ;TI"Hroot_ca.version = 2 # cf. RFC 5280 - to make it a "v3" certificate ;TI"root_ca.serial = 1 ;TI"Sroot_ca.subject = OpenSSL::X509::Name.parse "/DC=org/DC=ruby-lang/CN=Ruby CA" ;TI"Droot_ca.issuer = root_ca.subject # root CA's are "self-signed" ;TI".root_ca.public_key = root_key.public_key ;TI"#root_ca.not_before = Time.now ;TI"Xroot_ca.not_after = root_ca.not_before + 2 * 365 * 24 * 60 * 60 # 2 years validity ;TI".ef = OpenSSL::X509::ExtensionFactory.new ;TI"&ef.subject_certificate = root_ca ;TI"%ef.issuer_certificate = root_ca ;TI"Sroot_ca.add_extension(ef.create_extension("basicConstraints","CA:TRUE",true)) ;TI"Yroot_ca.add_extension(ef.create_extension("keyUsage","keyCertSign, cRLSign", true)) ;TI"Uroot_ca.add_extension(ef.create_extension("subjectKeyIdentifier","hash",false)) ;TI"_root_ca.add_extension(ef.create_extension("authorityKeyIdentifier","keyid:always",false)) ;TI";root_ca.sign(root_key, OpenSSL::Digest.new('SHA256')) ;T;0o; ;[I"MThe next step is to create the end-entity certificate using the root CA ;TI"certificate.;T@o;;[I"'key = OpenSSL::PKey::RSA.new 2048 ;TI"+cert = OpenSSL::X509::Certificate.new ;TI"cert.version = 2 ;TI"cert.serial = 2 ;TI"Ycert.subject = OpenSSL::X509::Name.parse "/DC=org/DC=ruby-lang/CN=Ruby certificate" ;TI";cert.issuer = root_ca.subject # root CA is the issuer ;TI"&cert.public_key = key.public_key ;TI" cert.not_before = Time.now ;TI"Rcert.not_after = cert.not_before + 1 * 365 * 24 * 60 * 60 # 1 years validity ;TI".ef = OpenSSL::X509::ExtensionFactory.new ;TI"#ef.subject_certificate = cert ;TI"%ef.issuer_certificate = root_ca ;TI"Rcert.add_extension(ef.create_extension("keyUsage","digitalSignature", true)) ;TI"Rcert.add_extension(ef.create_extension("subjectKeyIdentifier","hash",false)) ;TI"7cert.sign(root_key, OpenSSL::Digest.new('SHA256'));T;0; I" ext/openssl/ossl_x509cert.c;T; 0; 0; 0[ [ [ [I"OpenSSL::Marshal;To;;[ ; @; 0I"$ext/openssl/lib/openssl/x509.rb;T[I"$Extension::SubjectKeyIdentifier;To;;[ ; @; 0@|[I"&Extension::AuthorityKeyIdentifier;To;;[ ; @; 0@|[I"%Extension::CRLDistributionPoints;To;;[ ; @; 0@|[I"#Extension::AuthorityInfoAccess;To;;[ ; @; 0@|[[I" class;T[[: public[[I" load;TI" ext/openssl/ossl_x509cert.c;T[I"load_file;T@|[I"new;T@�[:protected[ [: private[ [I" instance;T[[;[#[I"==;T@�[I"add_extension;T@�[I"check_private_key;T@�[I"extensions;T@�[I"extensions=;T@�[I"initialize_copy;T@�[I" inspect;T@�[I" issuer;T@�[I" issuer=;T@�[I"not_after;T@�[I"not_after=;T@�[I"not_before;T@�[I"not_before=;T@�[I"pretty_print;T@|[I"public_key;T@�[I"public_key=;T@�[I" serial;T@�[I" serial=;T@�[I" sign;T@�[I"signature_algorithm;T@�[I" subject;T@�[I" subject=;T@�[I"tbs_bytes;T@�[I" to_der;T@�[I" to_pem;T@�[I" to_s;T@�[I" to_text;T@�[I" verify;T@�[I" version;T@�[I" version=;T@�[;[ [;[ [ [U:RDoc::Context::Section[i 0o;;[ ; 0; 0[@I" ext/openssl/ossl_x509attr.c;TI"OpenSSL::X509;TcRDoc::NormalModule