Module: IO::Endpoint::TLS::OpenSSL

Defined in:
lib/io/endpoint/tls/openssl.rb

Overview

Provides OpenSSL compilation for transport-neutral TLS configuration.

Class Method Summary collapse

Class Method Details

.apply(context, configuration, hostname: nil) ⇒ Object

Apply transport-neutral TLS configuration to an OpenSSL context.



33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/io/endpoint/tls/openssl.rb', line 33

def self.apply(context, configuration, hostname: nil)
	if trust_store = configuration.trust_store
		context.cert_store = build_certificate_store(trust_store)
	end
	
	if certificate_chain = configuration.certificate_chain
		certificates = certificate_chain.map do |certificate|
			::OpenSSL::X509::Certificate.new(certificate)
		end
		
		context.cert = certificates.shift
		context.extra_chain_cert = certificates
		context.key = ::OpenSSL::PKey.read(configuration.private_key)
	end
	
	case configuration.verification
	when :none
		context.verify_mode = ::OpenSSL::SSL::VERIFY_NONE
		context.verify_hostname = false
	when :peer
		context.verify_mode = ::OpenSSL::SSL::VERIFY_PEER
	when :required
		context.verify_mode = ::OpenSSL::SSL::VERIFY_PEER | ::OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
	end
	
	if hostname && configuration.verify_peer?
		context.verify_hostname = true
	end
	
	return context
end

.build_certificate_store(trust_store) ⇒ Object

Build an OpenSSL certificate store from transport-neutral trusted certificate configuration.



18
19
20
21
22
23
24
25
26
 
# File 'lib/io/endpoint/tls/openssl.rb', line 18

def self.build_certificate_store(trust_store)
	::OpenSSL::X509::Store.new.tap do |store|
		store.set_default_paths if trust_store.system_certificates?
		
		trust_store.certificates.each do |certificate_pem|
			store.add_cert(::OpenSSL::X509::Certificate.new(certificate_pem))
		end
	end
end