generate ssl certs

cert_generator.rb

# GENERATE CERTIFICATES
require 'openssl'

class CertGenerator

  def self.generate
    CertGenerator.new.generate
  end

  def generate
    create_ca_key
    generate_ca_csr
    generate_ca_cert
    save_ca_cert
    create_client_key
    generate_client_cert
    sign_client_cert
    save_client_cert
  end

  private

  def initialize
    subject = 'C=PL/ST=Mazowsze/O=Test Sp. z o.o./OU=IT/CN=Test CA/emailAddress=test@test.com'
    @name = OpenSSL::X509::Name.parse subject
    @cert_destination = "/certs"
    FileUtils.mkdir_p(spec_relative_path(@cert_destination))
    @expired_cert_destination = "/certs/expired"
    FileUtils.mkdir_p(spec_relative_path(@expired_cert_destination))
  end

  def create_ca_key
    @ca_key = OpenSSL::PKey::RSA.new 2048
  end

  def generate_ca_csr
    ca_csr = OpenSSL::X509::Request.new
    ca_csr.version = 0
    ca_csr.subject = @name
    ca_csr.public_key = @ca_key.public_key
    ca_csr.sign @ca_key, OpenSSL::Digest::SHA1.new
    @ca_csr = ca_csr
  end

  def generate_ca_cert
    ca_cert = OpenSSL::X509::Certificate.new
    ca_cert.version = 2
    ca_cert.serial = 0
    ca_cert.not_before = Time.now
    ca_cert.not_after = ca_cert.not_before + 1 * 365 * 24 * 60 * 60 # 1 years validity
    ca_cert.public_key = @ca_key.public_key
    ca_cert.subject = @name
    ca_cert.issuer = @name
    ef = OpenSSL::X509::ExtensionFactory.new
    ef.subject_certificate = ca_cert
    ef.issuer_certificate = ca_cert
    ca_cert.add_extension(ef.create_extension("basicConstraints","CA:TRUE",true))
    ca_cert.add_extension(ef.create_extension("keyUsage","keyCertSign, cRLSign", true))
    ca_cert.add_extension(ef.create_extension("subjectKeyIdentifier","hash",false))
    ca_cert.add_extension(ef.create_extension("authorityKeyIdentifier","keyid:always",false))
    ca_cert.sign(@ca_key, OpenSSL::Digest::SHA256.new)
    @ca_cert = ca_cert
  end

  def save_ca_cert
    ca_cert_path = spec_relative_path("#{@cert_destination}/root.pem")
    File.open(ca_cert_path, 'w+') do |file|
      file.write(@ca_cert.to_text)
      file.write(@ca_cert.to_pem)
      file.close
    end
  end

  def create_client_key
    @client_key = OpenSSL::PKey::RSA.new 2048
  end

  def generate_client_cert
    client_cert = OpenSSL::X509::Certificate.new
    client_cert.version = 2
    client_cert.serial = 2
    client_cert.subject = @name
    client_cert.issuer = @ca_cert.subject # root CA is the issuer
    client_cert.public_key = @client_key.public_key
    client_cert.not_before = Time.now
    client_cert.not_after = client_cert.not_before + 1 * 365 * 24 * 60 * 60 # 1 years validity
    ef = OpenSSL::X509::ExtensionFactory.new
    ef.subject_certificate = client_cert
    ef.issuer_certificate = @ca_cert
    client_cert.add_extension(ef.create_extension("keyUsage","digitalSignature", true))
    client_cert.add_extension(ef.create_extension("subjectKeyIdentifier","hash",false))
    @client_cert = client_cert
  end

  def sign_client_cert
    @client_cert.sign(@ca_key, OpenSSL::Digest::SHA256.new)
  end

  def save_client_cert
    cert_path = spec_relative_path("#{@cert_destination}/client.pem")
    File.open(cert_path, 'w+') do |file|
      file.write(@client_key.to_pem)
      file.write(@client_cert.to_pem)
      file.close
    end
  end

  def spec_relative_path(relative_path)
    File.join( File.dirname(__FILE__),  relative_path )
  end
end