Class: OpenSSL::X509::Store

Relationships & Source Files
Inherits:	Object
Defined in:	ext/openssl/ossl_x509store.c

Overview

The X509 certificate store holds trusted CA certificates used to verify peer certificates.

The easiest way to create a useful certificate store is:

cert_store = OpenSSL::X509::Store.new
cert_store.set_default_paths

This will use your system’s built-in certificates.

If your system does not have a default set of certificates you can obtain a set extracted from Mozilla CA certificate store by cURL maintainers here: curl.haxx.se/docs/caextract.html (You may wish to use the firefox-db2pem.sh script to extract the certificates from a local install to avoid man-in-the-middle attacks.)

After downloading or generating a cacert.pem from the above link you can create a certificate store from the pem file like this:

cert_store = OpenSSL::X509::Store.new
cert_store.add_file 'cacert.pem'

The certificate store can be used with an SSLSocket like this:

ssl_context = OpenSSL::SSL::SSLContext.new
ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER
ssl_context.cert_store = cert_store

tcp_socket = TCPSocket.open 'example.com', 443

ssl_socket = OpenSSL::SSL::SSLSocket.new tcp_socket, ssl_context

Class Method Summary

X509::Store.new ⇒ Store constructor

Creates a new Store.

Instance Attribute Summary

#flags=(flags) writeonly

Sets the default flags used by certificate chain verification performed with the Store.
#purpose=(purpose) writeonly

Sets the store’s default verification purpose.
#time=(time) writeonly

Sets the time to be used in the certificate verifications with the store.
#trust=(trust) writeonly

Sets the default trust settings used by the certificate verification with the store.
#verify_callback=(cb) writeonly

General callback for ::OpenSSL verify.

Instance Method Summary

#add_cert(cert) ⇒ self

Adds the Certificate cert to the certificate store.
#add_crl(crl) ⇒ self

Adds the CRL crl to the store.
#add_file(file) ⇒ self

Adds the certificates in file to the certificate store.
#add_path(path) ⇒ self

Adds path as the hash dir to be looked up by the store.
#set_default_paths

Configures store to look up CA certificates from the system default certificate store as needed basis.
#verify(cert, chain = nil) ⇒ Boolean

Performs a certificate verification on the Certificate cert.

Constructor Details

X509::Store.new ⇒ `Store`

Creates a new Store.

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 207


static VALUE
ossl_x509store_initialize(int argc, VALUE *argv, VALUE self)
{
    X509_STORE *store;

    GetX509Store(self, store);
    if (argc != 0)
        rb_warn("OpenSSL::X509::Store.new does not take any arguments");
#if !defined(HAVE_OPAQUE_OPENSSL)
    /* [Bug #405] [Bug #1678] [Bug #3000]; already fixed? */
    store->ex_data.sk = NULL;
#endif
    X509_STORE_set_verify_cb(store, x509store_verify_cb);
    ossl_x509store_set_vfy_cb(self, Qnil);

    /* last verification status */
    rb_iv_set(self, "@error", Qnil);
    rb_iv_set(self, "@error_string", Qnil);
    rb_iv_set(self, "@chain", Qnil);

    return self;
}

Instance Attribute Details

#flags=(flags) (writeonly)

Sets the default flags used by certificate chain verification performed with the Store.

flags consists of zero or more of the constants defined in ::OpenSSL::X509 with name V_FLAG_* or’ed together.

StoreContext#flags= can be used to change the flags for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_flags(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 245


static VALUE
ossl_x509store_set_flags(VALUE self, VALUE flags)
{
    X509_STORE *store;
    long f = NUM2LONG(flags);

    GetX509Store(self, store);
    X509_STORE_set_flags(store, f);

    return flags;
}

#purpose=(purpose) (writeonly)

Sets the store’s default verification purpose. If specified, the verifications on the store will check every certificate’s extensions are consistent with the purpose. The purpose is specified by constants:

X509::PURPOSE_SSL_CLIENT
X509::PURPOSE_SSL_SERVER
X509::PURPOSE_NS_SSL_SERVER
X509::PURPOSE_SMIME_SIGN
X509::PURPOSE_SMIME_ENCRYPT
X509::PURPOSE_CRL_SIGN
X509::PURPOSE_ANY
X509::PURPOSE_OCSP_HELPER
X509::PURPOSE_TIMESTAMP_SIGN

StoreContext#purpose= can be used to change the value for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_purpose(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 280


static VALUE
ossl_x509store_set_purpose(VALUE self, VALUE purpose)
{
    X509_STORE *store;
    int p = NUM2INT(purpose);

    GetX509Store(self, store);
    X509_STORE_set_purpose(store, p);

    return purpose;
}

#time=(time) (writeonly)

Sets the time to be used in the certificate verifications with the store. By default, if not specified, the current system time is used.

StoreContext#time= can be used to change the value for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_time(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 328


static VALUE
ossl_x509store_set_time(VALUE self, VALUE time)
{
    X509_STORE *store;
    X509_VERIFY_PARAM *param;

    GetX509Store(self, store);
#ifdef HAVE_X509_STORE_GET0_PARAM
    param = X509_STORE_get0_param(store);
#else
    param = store->param;
#endif
    X509_VERIFY_PARAM_set_time(param, NUM2LONG(rb_Integer(time)));
    return time;
}

#trust=(trust) (writeonly)

Sets the default trust settings used by the certificate verification with the store.

StoreContext#trust= can be used to change the value for a single verification operation.

See also the man page X509_VERIFY_PARAM_set_trust(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 304


static VALUE
ossl_x509store_set_trust(VALUE self, VALUE trust)
{
    X509_STORE *store;
    int t = NUM2INT(trust);

    GetX509Store(self, store);
    X509_STORE_set_trust(store, t);

    return trust;
}

#verify_callback=(cb) (writeonly)

General callback for ::OpenSSL verify

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 187


static VALUE
ossl_x509store_set_vfy_cb(VALUE self, VALUE cb)
{
    X509_STORE *store;

    GetX509Store(self, store);
    rb_iv_set(self, "@verify_callback", cb);
    // We don't need to trigger a write barrier because `rb_iv_set` did it.
    X509_STORE_set_ex_data(store, store_ex_verify_cb_idx, (void *)cb);

    return cb;
}

Instance Method Details

#add_cert(cert) ⇒ `self`

Adds the Certificate cert to the certificate store.

See also the man page X509_STORE_add_cert(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 440


static VALUE
ossl_x509store_add_cert(VALUE self, VALUE arg)
{
    X509_STORE *store;
    X509 *cert;

    cert = GetX509CertPtr(arg); /* NO NEED TO DUP */
    GetX509Store(self, store);
    if (X509_STORE_add_cert(store, cert) != 1)
        ossl_raise(eX509StoreError, "X509_STORE_add_cert");

    return self;
}

#add_crl(crl) ⇒ `self`

Adds the CRL crl to the store.

See also the man page X509_STORE_add_crl(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 462


static VALUE
ossl_x509store_add_crl(VALUE self, VALUE arg)
{
    X509_STORE *store;
    X509_CRL *crl;

    crl = GetX509CRLPtr(arg); /* NO NEED TO DUP */
    GetX509Store(self, store);
    if (X509_STORE_add_crl(store, crl) != 1)
        ossl_raise(eX509StoreError, "X509_STORE_add_crl");

    return self;
}

#add_file(file) ⇒ `self`

Adds the certificates in file to the certificate store. file is the path to the file, and the file contains one or more certificates in PEM format concatenated together.

See also the man page X509_LOOKUP_file(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 354


static VALUE
ossl_x509store_add_file(VALUE self, VALUE file)
{
    X509_STORE *store;
    X509_LOOKUP *lookup;
    const char *path;

    GetX509Store(self, store);
    path = StringValueCStr(file);
    lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
    if (!lookup)
        ossl_raise(eX509StoreError, "X509_STORE_add_lookup");
    if (X509_LOOKUP_load_file(lookup, path, X509_FILETYPE_PEM) != 1)
        ossl_raise(eX509StoreError, "X509_LOOKUP_load_file");
#if OPENSSL_VERSION_NUMBER < 0x10101000 || defined(LIBRESSL_VERSION_NUMBER)
    /*
     * X509_load_cert_crl_file() which is called from X509_LOOKUP_load_file()
     * did not check the return value of X509_STORE_add_{cert,crl}(), leaking
     * "cert already in hash table" errors on the error queue, if duplicate
     * certificates are found. This will be fixed by OpenSSL 1.1.1.
     */
    ossl_clear_error();
#endif

    return self;
}

#add_path(path) ⇒ `self`

Adds path as the hash dir to be looked up by the store.

See also the man page X509_LOOKUP_hash_dir(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 389


static VALUE
ossl_x509store_add_path(VALUE self, VALUE dir)
{
    X509_STORE *store;
    X509_LOOKUP *lookup;
    const char *path;

    GetX509Store(self, store);
    path = StringValueCStr(dir);
    lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
    if (!lookup)
        ossl_raise(eX509StoreError, "X509_STORE_add_lookup");
    if (X509_LOOKUP_add_dir(lookup, path, X509_FILETYPE_PEM) != 1)
        ossl_raise(eX509StoreError, "X509_LOOKUP_add_dir");

    return self;
}

#set_default_paths

Configures store to look up CA certificates from the system default certificate store as needed basis. The location of the store can usually be determined by:

OpenSSL::X509::DEFAULT_CERT_FILE
OpenSSL::X509::DEFAULT_CERT_DIR

See also the man page X509_STORE_set_default_paths(3).

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 420


static VALUE
ossl_x509store_set_default_paths(VALUE self)
{
    X509_STORE *store;

    GetX509Store(self, store);
    if (X509_STORE_set_default_paths(store) != 1)
        ossl_raise(eX509StoreError, "X509_STORE_set_default_paths");

    return Qnil;
}

#verify(cert, chain = nil) ⇒ `Boolean`

Performs a certificate verification on the Certificate cert.

chain can be an array of Certificate that is used to construct the certificate chain.

If a block is given, it overrides the callback set by #verify_callback=.

After finishing the verification, the error information can be retrieved by #error, #error_string, and the resulting complete certificate chain can be retrieved by #chain.

[ GitHub ]

# File 'ext/openssl/ossl_x509store.c', line 495


static VALUE
ossl_x509store_verify(int argc, VALUE *argv, VALUE self)
{
    VALUE cert, chain;
    VALUE ctx, proc, result;

    rb_scan_args(argc, argv, "11", &cert, &chain);
    ctx = rb_funcall(cX509StoreContext, rb_intern("new"), 3, self, cert, chain);
    proc = rb_block_given_p() ?  rb_block_proc() :
	   rb_iv_get(self, "@verify_callback");
    rb_iv_set(ctx, "@verify_callback", proc);
    result = rb_funcall(ctx, rb_intern("verify"), 0);

    rb_iv_set(self, "@error", ossl_x509stctx_get_err(ctx));
    rb_iv_set(self, "@error_string", ossl_x509stctx_get_err_string(ctx));
    rb_iv_set(self, "@chain", ossl_x509stctx_get_chain(ctx));

    return result;
}

Class: OpenSSL::X509::Store

Overview

Class Method Summary

Instance Attribute Summary

Instance Method Summary

Constructor Details

X509::Store.new ⇒ Store

Instance Attribute Details

#flags=(flags) (writeonly)

#purpose=(purpose) (writeonly)

#time=(time) (writeonly)

#trust=(trust) (writeonly)

#verify_callback=(cb) (writeonly)

Instance Method Details

#add_cert(cert) ⇒ self

#add_crl(crl) ⇒ self

#add_file(file) ⇒ self

#add_path(path) ⇒ self

#set_default_paths

#verify(cert, chain = nil) ⇒ Boolean

X509::Store.new ⇒ `Store`

#add_cert(cert) ⇒ `self`

#add_crl(crl) ⇒ `self`

#add_file(file) ⇒ `self`

#add_path(path) ⇒ `self`

#verify(cert, chain = nil) ⇒ `Boolean`