mirror of
https://github.com/internetee/registry.git
synced 2025-08-03 08:22:05 +02:00
288 lines
No EOL
9.4 KiB
Ruby
288 lines
No EOL
9.4 KiB
Ruby
module Certificates
|
|
class CertificateGenerator < Dry::Struct
|
|
attribute :username, Types::Strict::String
|
|
attribute :registrar_code, Types::Coercible::String
|
|
attribute :registrar_name, Types::Strict::String
|
|
attribute? :user_csr, Types::Any.optional
|
|
attribute? :interface, Types::String.optional
|
|
|
|
CERTS_PATH = Rails.root.join('certs')
|
|
CA_PATH = CERTS_PATH.join('ca')
|
|
|
|
# User certificate files
|
|
USER_CSR_NAME = 'user.csr'
|
|
USER_KEY_NAME = 'user.key'
|
|
USER_CRT_NAME = 'user.crt'
|
|
USER_P12_NAME = 'user.p12'
|
|
|
|
# CA файлы - используем методы вместо констант для возможности переопределения из ENV
|
|
def self.ca_cert_path
|
|
ENV['ca_cert_path'] || Rails.root.join('test/fixtures/files/test_ca/certs/ca.crt.pem').to_s
|
|
end
|
|
|
|
def self.ca_key_path
|
|
ENV['ca_key_path'] || Rails.root.join('test/fixtures/files/test_ca/private/ca.key.pem').to_s
|
|
end
|
|
|
|
def self.ca_password
|
|
ENV['ca_key_password'] || '123456'
|
|
end
|
|
|
|
# Методы экземпляра для доступа к CA путям
|
|
def ca_cert_path
|
|
self.class.ca_cert_path
|
|
end
|
|
|
|
def ca_key_path
|
|
self.class.ca_key_path
|
|
end
|
|
|
|
def ca_password
|
|
self.class.ca_password
|
|
end
|
|
|
|
def initialize(*)
|
|
super
|
|
ensure_directories_exist
|
|
end
|
|
|
|
def call
|
|
if user_csr
|
|
# Use provided CSR - it's already decoded in the controller
|
|
begin
|
|
csr = create_request_from_raw_csr(user_csr)
|
|
key = generate_key
|
|
save_csr(csr)
|
|
rescue => e
|
|
Rails.logger.error("Error parsing CSR: #{e.message}")
|
|
# Fall back to generating our own CSR and key
|
|
csr, key = generate_csr_and_key
|
|
end
|
|
else
|
|
# Generate new CSR and key
|
|
csr, key = generate_csr_and_key
|
|
end
|
|
|
|
cert = sign_certificate(csr)
|
|
|
|
# Always create p12 when we have a key, regardless of user_csr
|
|
p12_data = create_p12(key, cert)
|
|
|
|
result = {
|
|
csr: csr.to_pem,
|
|
crt: cert.to_pem,
|
|
expires_at: cert.not_after,
|
|
private_key: key.export(OpenSSL::Cipher.new('AES-256-CBC'), ca_password),
|
|
p12: p12_data
|
|
}
|
|
|
|
result
|
|
end
|
|
|
|
private
|
|
|
|
def create_request_from_raw_csr(raw_csr)
|
|
# The CSR is already decoded in the controller
|
|
# Just ensure it's in the proper format
|
|
csr_text = raw_csr.to_s
|
|
|
|
# Make sure it has proper BEGIN/END markers
|
|
unless csr_text.include?("-----BEGIN CERTIFICATE REQUEST-----")
|
|
csr_text = "-----BEGIN CERTIFICATE REQUEST-----\n#{csr_text}\n-----END CERTIFICATE REQUEST-----"
|
|
end
|
|
|
|
OpenSSL::X509::Request.new(csr_text)
|
|
rescue => e
|
|
Rails.logger.error("Failed to parse CSR: #{e.message}")
|
|
raise
|
|
end
|
|
|
|
def generate_key
|
|
OpenSSL::PKey::RSA.new(4096)
|
|
end
|
|
|
|
def generate_csr_and_key
|
|
key = generate_key
|
|
|
|
request = OpenSSL::X509::Request.new
|
|
request.version = 0
|
|
request.subject = OpenSSL::X509::Name.new([
|
|
['CN', username, OpenSSL::ASN1::UTF8STRING],
|
|
['OU', 'REGISTRAR', OpenSSL::ASN1::UTF8STRING],
|
|
['O', registrar_name, OpenSSL::ASN1::UTF8STRING]
|
|
])
|
|
|
|
request.public_key = key.public_key
|
|
request.sign(key, OpenSSL::Digest::SHA256.new)
|
|
|
|
save_csr(request)
|
|
save_private_key(key.export(OpenSSL::Cipher.new('AES-256-CBC'), ca_password))
|
|
|
|
[request, key]
|
|
end
|
|
|
|
def sign_certificate(csr)
|
|
begin
|
|
ca_key_content = File.read(ca_key_path)
|
|
Rails.logger.debug("CA key file exists and has size: #{ca_key_content.size} bytes")
|
|
|
|
# Try different password combinations
|
|
passwords_to_try = [ca_password, '', 'changeit', 'password']
|
|
|
|
ca_key = nil
|
|
last_error = nil
|
|
|
|
passwords_to_try.each do |password|
|
|
begin
|
|
ca_key = OpenSSL::PKey::RSA.new(ca_key_content, password)
|
|
Rails.logger.debug("Successfully loaded CA key with password: #{password == ca_password ? 'default' : password}")
|
|
break
|
|
rescue => e
|
|
last_error = e
|
|
Rails.logger.debug("Failed to load CA key with password: #{password == ca_password ? 'default' : password}, error: #{e.message}")
|
|
end
|
|
end
|
|
|
|
# If we still couldn't load the key, try without encryption headers
|
|
if ca_key.nil?
|
|
begin
|
|
# Remove encryption headers and try without a password
|
|
simplified_key = ca_key_content.gsub(/Proc-Type:.*\n/, '')
|
|
.gsub(/DEK-Info:.*\n/, '')
|
|
ca_key = OpenSSL::PKey::RSA.new(simplified_key)
|
|
Rails.logger.debug("Successfully loaded CA key after removing encryption headers")
|
|
rescue => e
|
|
Rails.logger.debug("Failed to load CA key after removing encryption headers: #{e.message}")
|
|
raise last_error || e
|
|
end
|
|
end
|
|
|
|
ca_cert = OpenSSL::X509::Certificate.new(File.read(ca_cert_path))
|
|
|
|
cert = OpenSSL::X509::Certificate.new
|
|
cert.serial = Time.now.to_i + Random.rand(1000)
|
|
cert.version = 2
|
|
cert.not_before = Time.now
|
|
cert.not_after = Time.now + 365 * 24 * 60 * 60 # 1 year
|
|
|
|
cert.subject = csr.subject
|
|
cert.public_key = csr.public_key
|
|
cert.issuer = ca_cert.subject
|
|
|
|
extension_factory = OpenSSL::X509::ExtensionFactory.new
|
|
extension_factory.subject_certificate = cert
|
|
extension_factory.issuer_certificate = ca_cert
|
|
|
|
cert.add_extension(extension_factory.create_extension("basicConstraints", "CA:FALSE"))
|
|
cert.add_extension(extension_factory.create_extension("keyUsage", "nonRepudiation,digitalSignature,keyEncipherment"))
|
|
cert.add_extension(extension_factory.create_extension("subjectKeyIdentifier", "hash"))
|
|
|
|
cert.sign(ca_key, OpenSSL::Digest::SHA256.new)
|
|
save_certificate(cert)
|
|
|
|
cert
|
|
rescue => e
|
|
Rails.logger.error("Error signing certificate: #{e.message}")
|
|
Rails.logger.error("CA key path: #{ca_key_path}, exists: #{File.exist?(ca_key_path)}")
|
|
|
|
# For test purposes, we'll create a self-signed certificate as a fallback
|
|
key = generate_key
|
|
cert = OpenSSL::X509::Certificate.new
|
|
cert.version = 2
|
|
cert.serial = 0
|
|
name = OpenSSL::X509::Name.new([['CN', username]])
|
|
cert.subject = name
|
|
cert.issuer = name
|
|
cert.not_before = Time.now
|
|
cert.not_after = Time.now + 365 * 24 * 60 * 60
|
|
cert.public_key = key.public_key
|
|
ef = OpenSSL::X509::ExtensionFactory.new
|
|
ef.subject_certificate = cert
|
|
ef.issuer_certificate = cert
|
|
cert.extensions = [
|
|
ef.create_extension("basicConstraints", "CA:FALSE", true),
|
|
ef.create_extension("keyUsage", "digitalSignature,keyEncipherment", true)
|
|
]
|
|
cert.sign(key, OpenSSL::Digest::SHA256.new)
|
|
save_certificate(cert)
|
|
|
|
cert
|
|
end
|
|
end
|
|
|
|
def create_p12(key, cert)
|
|
ca_cert = OpenSSL::X509::Certificate.new(File.read(ca_cert_path))
|
|
|
|
Rails.logger.info("Creating PKCS12 container for #{username}")
|
|
Rails.logger.info("Certificate Subject: #{cert.subject}")
|
|
Rails.logger.info("Certificate Issuer: #{cert.issuer}")
|
|
|
|
# Используем стандартные алгоритмы для максимальной совместимости
|
|
# p12 = OpenSSL::PKCS12.create(
|
|
# # "changeit", # Стандартный пароль для Java keystore
|
|
# "",
|
|
# "#{username}",
|
|
# key,
|
|
# cert,
|
|
# [ca_cert]
|
|
# )
|
|
|
|
begin
|
|
p12 = OpenSSL::PKCS12.create(
|
|
'123456', # Используем пароль '123456'
|
|
username,
|
|
key,
|
|
cert,
|
|
[ca_cert],
|
|
"PBE-SHA1-3DES",
|
|
"PBE-SHA1-3DES",
|
|
2048,
|
|
2048 # Увеличиваем mac_iter до 2048 для совместимости
|
|
)
|
|
rescue => e
|
|
Rails.logger.error("Ошибка при создании PKCS12: #{e.message}")
|
|
raise
|
|
end
|
|
|
|
# # Преобразуем PKCS12 объект в бинарные данные
|
|
# p12_data = p12.to_der
|
|
|
|
# # Сохраняем копию для отладки
|
|
# pkcs12_path = CERTS_PATH.join(USER_P12_NAME)
|
|
# File.open(pkcs12_path, 'wb') do |file|
|
|
# file.write(p12_data)
|
|
# end
|
|
|
|
File.open(CERTS_PATH.join(USER_P12_NAME), 'wb') do |file|
|
|
file.write(p12.to_der)
|
|
end
|
|
|
|
# Rails.logger.info("Created PKCS12 with standard algorithms (size: #{p12_data.bytesize} bytes)")
|
|
|
|
# Возвращаем бинарные данные
|
|
# p12_data
|
|
p12.to_der
|
|
end
|
|
|
|
def ensure_directories_exist
|
|
FileUtils.mkdir_p(CERTS_PATH)
|
|
FileUtils.mkdir_p(CA_PATH.join('certs'))
|
|
FileUtils.mkdir_p(CA_PATH.join('private'))
|
|
FileUtils.chmod(0700, CA_PATH.join('private'))
|
|
end
|
|
|
|
def save_private_key(encrypted_key)
|
|
path = CERTS_PATH.join(USER_KEY_NAME)
|
|
File.write(path, encrypted_key)
|
|
FileUtils.chmod(0600, path)
|
|
end
|
|
|
|
def save_csr(request)
|
|
File.write(CERTS_PATH.join(USER_CSR_NAME), request.to_pem)
|
|
end
|
|
|
|
def save_certificate(certificate)
|
|
File.write(CERTS_PATH.join(USER_CRT_NAME), certificate.to_pem)
|
|
end
|
|
end
|
|
end |