Module: Confium::PKI::CNML

Defined in:
lib/confium/pki/cnml.rb

Constant Summary collapse

REQUIRED_EXTENSIONS =

Required X.509 v3 extensions for a CNML certificate.

{
  # Standard X.509 extensions required by CNML:
  '2.5.29.19' => 'basicConstraints (CA=true for IA certs, CA=false for leaf)',
  '2.5.29.15' => 'keyUsage (digitalSignature for signing certs)',
  '2.5.29.37' => 'extKeyUsage (id-kp-OCSPSigning or custom CNML OIDs)',
  '2.5.29.14' => 'subjectKeyIdentifier (required for CMS signer resolution)',
  '2.5.29.35' => 'authorityKeyIdentifier (required for chain building)'
}.freeze
OPTIONAL_EXTENSIONS =

Optional but recommended extensions.

{
  '2.5.29.31' => 'cRLDistributionPoints (for revocation checking)',
  '2.5.29.32' => 'certificatePolicies (CNML policy OID)',
  '1.3.6.1.5.5.7.1.1' => 'authorityInfoAccess (OCSP responder URL)'
}.freeze
CERT_ROLES =

CNML certificate roles (maps to ActorType in Confium::Identity).

%i[
  manufacturer
  testing_lab
  issuing_authority_officer
  biml_director
  quorum_coordinator
  verifier
].freeze

Class Method Summary collapse

Class Method Details

.cert_roles ⇒ Array<Symbol>

All known CNML certificate roles.

Returns:

  • (Array<Symbol>) 


75
76
77
 
# File 'lib/confium/pki/cnml.rb', line 75

def self.cert_roles
  CERT_ROLES
end

.missing_extensions(_cert) ⇒ Array<String>

Validate that a certificate has the required CNML extensions. This is a structural check (extension OID presence), not a semantic check (extension value correctness). Full validation requires the OIML R 76 specification.

Parameters:

  • cert (Confium::PKI::Certificate) —

    the cert to check

Returns:

  • (Array<String>) —

    list of missing required extension OIDs



50
51
52
53
54
55
56
57
58
59
 
# File 'lib/confium/pki/cnml.rb', line 50

def self.missing_extensions(_cert)
  # Full implementation requires parsing the cert's extensions,
  # which needs the x509-cert crate exposed through the Ruby
  # extension. For now, returns an empty array (no validation).
  #
  # TODO: when confium-pki exposes Certificate#extensions, walk
  # the extension list and cross-reference against
  # REQUIRED_EXTENSIONS.
  []
end

.optional_extension_oids ⇒ Array<String>

The list of optional extension OIDs.

Returns:

  • (Array<String>) 


69
70
71
 
# File 'lib/confium/pki/cnml.rb', line 69

def self.optional_extension_oids
  OPTIONAL_EXTENSIONS.keys
end

.required_extension_oids ⇒ Array<String>

The list of required extension OIDs.

Returns:

  • (Array<String>) 


63
64
65
 
# File 'lib/confium/pki/cnml.rb', line 63

def self.required_extension_oids
  REQUIRED_EXTENSIONS.keys
end