class Configuration

Represents transport-neutral TLS certificate and verification configuration.

Definitions

def initialize(trust_store: nil, certificate_chain: nil, private_key: nil, verification: nil)

Initialize a TLS configuration from PEM-encoded certificate and private key material.

Signature

parameter trust_store TrustStore | Nil

The trusted certificate sources.

parameter certificate_chain Array(String) | Nil

The ordered local certificate chain encoded as individual PEM strings, with the leaf certificate followed by any intermediates.

parameter private_key String | Nil

The private key encoded as PEM.

parameter verification Symbol | Nil

The peer verification policy: :none, :peer, or :required. When omitted, :peer is used if a trust store is provided.

raises ArgumentError

If the certificate chain and private key are not provided together, or the verification policy is invalid.

raises TypeError

If the certificate chain or private key uses an unsupported representation.

Implementation

def initialize(trust_store: nil, certificate_chain: nil, private_key: nil, verification: nil)
	if certificate_chain
		unless certificate_chain.is_a?(Array) && certificate_chain.all?{|certificate| certificate.is_a?(String)}
			raise TypeError, "The certificate chain must be provided as an array of strings!"
		end
		
		unless certificate_chain.any?
			raise ArgumentError, "The certificate chain must contain at least one certificate!"
		end
	end
	
	unless private_key.nil? || private_key.is_a?(String)
		raise TypeError, "The private key must be provided as a string!"
	end
	
	if certificate_chain.nil? != private_key.nil?
		raise ArgumentError, "The certificate chain and private key must be provided together!"
	end
	
	verification = :peer if verification.nil? && trust_store
	unless [nil, :none, :peer, :required].include?(verification)
		raise ArgumentError, "Unsupported verification policy: #{verification.inspect}!"
	end
	
	@trust_store = trust_store
	@certificate_chain = certificate_chain
	@private_key = private_key
	@verification = verification
end

attr :trust_store

Signature

attribute TrustStore | Nil

The trusted certificate sources.

attr :certificate_chain

Signature

attribute Array(String) | Nil

The ordered local certificate chain encoded as individual PEM strings, with the leaf certificate followed by any intermediates.

attr :private_key

Signature

attribute String | Nil

The private key encoded as PEM.

attr :verification

Signature

attribute Symbol | Nil

The peer verification policy.

def ==(other)

Compare configurations by their certificate material and verification policy.

Signature

parameter other Object

The object to compare.

returns Boolean

Whether both configurations have the same class and values.

Implementation

def ==(other)
	return other.instance_of?(self.class) &&
		@trust_store.eql?(other.trust_store) &&
		@certificate_chain.eql?(other.certificate_chain) &&
		@private_key.eql?(other.private_key) &&
		@verification.eql?(other.verification)
end

def hash

Compute a hash from the configuration values. Freeze the configuration before using it as a hash key.

Signature

returns Integer

The hash of the configuration.

Implementation

def hash
	return [self.class, @trust_store, @certificate_chain, @private_key, @verification].hash
end

def freeze

Freeze the configuration and independent copies of its certificate material, without freezing caller-owned values.

Signature

returns Configuration

This immutable configuration. Use dup.freeze to preserve the original configuration too.

Implementation

def freeze
	return self if frozen?
	
	@trust_store = @trust_store&.dup&.freeze
	@certificate_chain = @certificate_chain&.map{|certificate| certificate.dup.freeze}&.freeze
	@private_key = @private_key&.dup&.freeze
	
	super
end

def verify_peer?

Whether peer certificates should be verified.

Signature

returns Boolean

Whether peer verification is enabled.

Implementation

def verify_peer?
	return @verification == :peer || @verification == :required
end

def inspect

Get a representation of the configuration without exposing certificate or private key material.

Signature

returns String

A redacted representation of the configuration.

Implementation

def inspect
	attributes = {
		trust_store: !@trust_store.nil?,
		certificate_chain: !@certificate_chain.nil?,
		private_key: !@private_key.nil?,
		verification: @verification,
	}
	
	return "\#<#{self.class} #{attributes.inspect}>"
end