Skip to content

Add chained certificate support #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cspenceiv wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add chained certificate support #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 25 additions & 3 deletions lib/lumberjack/server.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,9 +50,31 @@ def initialize(options={})

if @options[:ssl]
# load SSL certificate
@ssl = OpenSSL::SSL::SSLContext.new
@ssl.cert = OpenSSL::X509::Certificate.new(File.read(@options[:ssl_certificate]))
@ssl.key = OpenSSL::PKey::RSA.new(File.read(@options[:ssl_key]),
ssl = OpenSSL::SSL::SSLContext.new
raw_cert = File.read(@options[:ssl_certificate])

@jordansissel jordansissel Oct 27, 2015

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect there's a library method for reading certificates from a file that we can reuse instead of crafting our own here. I don't know what that is right now, though.

@jordansissel jordansissel Oct 27, 2015

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new code might be best in a separate file as a function that returns an array of OpenSSL::X509::Certificates.

ssl.cert = OpenSSL::X509::Certificate.new(raw_cert)

# Parse chain certificates from @ssl_cert
certPosition = [0]
while certPosition[-1]
certPosition.push(raw_cert.index("-----B", certPosition[-1] + 1))
end

# Gather chain from certificate
if certPosition.length > 2
ssl.extra_chain_cert = Array.new
for i in 1..(certPosition.length - 2)
if certPosition[i+1]
certEnd = certPosition[i+1] - 1
else
certEnd = raw_cert.length - 1
end
certLink = OpenSSL::X509::Certificate.new(raw_cert[certPosition[i]..certEnd])
ssl.extra_chain_cert.push(certLink)

@jordansissel jordansissel Oct 27, 2015

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Like most things in Ruby OpenSSL, the extra_chain_cert setting has practically no documentation available nor are there any decent examples I can find of its usage online (all the examples I see are copy/pasted from Ruby's own source tree, blah).

I'll have to read MRI's code to figure out what this really does under the hood.

@jordansissel jordansissel Oct 27, 2015

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(Notes from reading MRI's code) extra_chain_cert is an accessor (in MRI, anyway) that is used in both the SSLContext initialize and connect(?) methods. It invokes this OpenSSL method: SSL_CTX_add_extra_chain_cert for each item in the Enumerable extra_chain_cert accessor.

end
end

ssl.key = OpenSSL::PKey::RSA.new(File.read(@options[:ssl_key]),
@options[:ssl_key_passphrase])
end
end # def initialize
Expand Down