SSL Auth for Services

application_controller.rb

class ApplicationController < ActionController::Base
  before_filter :require_authentication
  
private

  def require_authentication
    unless current_certificate.verify(public_key)
      head :forbidden
    end
  end
  
  def public_key
    @public_key ||= OpenSSL::PKey::RSA.new(ENV['AUTH_PUBLIC_KEY'])
  end
  
  def current_certificate
    @current_certificate ||= OpenSSL::X509::Certificate.new(request.headers['X-SSL-Auth'])
  end
  
  # Identify the client application for access control
  def current_client
    current_certificate.issuer.to_a.assoc('OU')[1]
  end
end

gistfile1.sh

openssl genrsa -out master.key 1024

openssl req -new -key master.key -out web-client.csr

openssl x509 -req -in web-client.csr -signkey master.key -out web-client.crt

# Servers don't need the private master to authenticate certs
# requests are authenticated via the public key, private key is kept secret
openssl rsa -in master.key -pubout > master.pub