class Authority

def self.path(env = ENV, old_root: nil)
	path = File.expand_path("localhost.rb", env.fetch("XDG_STATE_HOME", "~/.local/state"))
	
	unless File.directory?(path)
		FileUtils.mkdir_p(path, mode: 0700)
	end
	
	# Migrates the legacy dir ~/.localhost/ to the XDG compliant directory
	old_root ||= File.expand_path("~/.localhost")
	if File.directory?(old_root)
		FileUtils.mv(Dir.glob(File.join(old_root, "*")), path, force: true)
		FileUtils.rmdir(old_root)
	end
	
	return path
end

def self.list(root = self.path)
	return to_enum(:list, root) unless block_given?
	
	Dir.glob("*.crt", base: root) do |path|
		name = File.basename(path, ".crt")
		
		authority = self.new(name, root: root)
		
		if authority.load
			yield authority
		end
	end
end

def self.fetch(*arguments, **options)
	authority = self.new(*arguments, **options)
	
	unless authority.load
		authority.save
	end
	
	return authority
end

parameter　hostname　String

The common name to use for the certificate.

parameter　root　String

The root path for loading and saving the certificate.

def initialize(hostname = "localhost", root: self.class.path)
	@root = root
	@hostname = hostname
	
	@key = nil
	@name = nil
	@certificate = nil
	@store = nil
end

def key_path
	File.join(@root, "#{@hostname}.key")
end

def certificate_path
	File.join(@root, "#{@hostname}.crt")
end

def key
	@key ||= OpenSSL::PKey::RSA.new(BITS)
end

def name
	@name ||= OpenSSL::X509::Name.parse("/O=Development/CN=#{@hostname}")
end

returns　OpenSSL::X509::Certificate

A self-signed certificate.

def certificate
	@certificate ||= OpenSSL::X509::Certificate.new.tap do |certificate|
		certificate.subject = self.name
		# We use the same issuer as the subject, which makes this certificate self-signed:
		certificate.issuer = self.name
		
		certificate.public_key = self.key.public_key
		
		certificate.serial = Time.now.to_i
		certificate.version = 2
		
		certificate.not_before = Time.now
		certificate.not_after = Time.now + (3600 * 24 * 365)
		
		extension_factory = OpenSSL::X509::ExtensionFactory.new
		extension_factory.subject_certificate = certificate
		extension_factory.issuer_certificate = certificate
		
		certificate.extensions = [
			extension_factory.create_extension("basicConstraints", "CA:FALSE", true),
			extension_factory.create_extension("subjectKeyIdentifier", "hash"),
		]
		
		certificate.add_extension extension_factory.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
		certificate.add_extension extension_factory.create_extension("subjectAltName", "DNS: #{@hostname}")
		
		certificate.sign self.key, OpenSSL::Digest::SHA256.new
	end
end

def store
	@store ||= OpenSSL::X509::Store.new.tap do |store|
		store.add_cert(self.certificate)
	end
end

returns　OpenSSL::SSL::SSLContext

An context suitable for implementing a secure server.

def server_context(*arguments)
	OpenSSL::SSL::SSLContext.new(*arguments).tap do |context|
		context.key = self.key
		context.cert = self.certificate
		
		context.session_id_context = "localhost"
		
		if context.respond_to? :tmp_dh_callback=
			context.tmp_dh_callback = proc {self.dh_key}
		end
		
		if context.respond_to? :ecdh_curves=
			context.ecdh_curves = 'P-256:P-384:P-521'
		end
		
		context.set_params(
			ciphers: SERVER_CIPHERS,
			verify_mode: OpenSSL::SSL::VERIFY_NONE,
		)
	end
end

returns　OpenSSL::SSL::SSLContext

An context suitable for connecting to a secure server using this authority.

def client_context(*args)
	OpenSSL::SSL::SSLContext.new(*args).tap do |context|
		context.cert_store = self.store
		
		context.set_params(
			verify_mode: OpenSSL::SSL::VERIFY_PEER,
		)
	end
end