\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// # frozen_string_literal: true require 'openssl' require 'time' class CertificateBuilder attr_reader :start def initialize key_size = 2048 @start = Time.utc 2012, 01, 01, 00, 00, 00 @end_of_time = Time.utc 9999, 12, 31, 23, 59, 59 @end_of_time_32 = Time.utc 2038, 01, 19, 03, 14, 07 @key_size = key_size @serial = 0 end def create_certificates(key, subject, issuer_key = key, issuer_cert = nil, not_before: @start, not_after: :end_of_time, is_ca: false) certificates = [] not_before, not_before_32 = validity_for not_before not_after, not_after_32 = validity_for not_after issuer_cert, issuer_cert_32 = issuer_cert certificates << create_certificate(key, subject, issuer_key, issuer_cert, not_before, not_after, is_ca) certificates << create_certificate(key, subject, issuer_key, issuer_cert_32, not_before_32, not_after_32, is_ca) certificates end def create_certificate(key, subject, issuer_key, issuer_cert, not_before, not_after, is_ca) cert = OpenSSL::X509::Certificate.new issuer_cert ||= cert # if not specified, create self signing cert cert.version = 2 cert.serial = 0 cert.not_before = not_before cert.not_after = not_after cert.serial = next_serial cert.public_key = key.public_key cert.subject = OpenSSL::X509::Name.new [%W[CN #{subject}], %w[DC example]] cert.issuer = issuer_cert.subject ef = OpenSSL::X509::ExtensionFactory.new issuer_cert, cert cert.extensions = [ ef.create_extension('subjectAltName', "email:#{subject}@example"), ef.create_extension('subjectKeyIdentifier', 'hash') ] if cert != issuer_cert then # not self-signed cert cert.add_extension ef.create_extension('authorityKeyIdentifier', 'keyid:always') end if is_ca then cert.add_extension ef.create_extension('basicConstraints', 'CA:TRUE', true) cert.add_extension ef.create_extension('keyUsage', 'keyCertSign', true) end cert.sign issuer_key, OpenSSL::Digest::SHA1.new puts "created cert - subject: #{cert.subject}, issuer: #{cert.issuer}" cert end def create_key puts "creating key" OpenSSL::PKey::RSA.new @key_size end def create_keys names keys = {} names.each do |name| keys[name] = create_key end keys end def next_serial serial = @serial @serial += 1 serial end def validity_for time if time == :end_of_time then validity = @end_of_time validity_32 = @end_of_time_32 else validity = validity_32 = time end [validity, validity_32] end end cb = CertificateBuilder.new keys = cb.create_keys [ :alternate, :child, :grandchild, :invalid,