Class: OpenSSL::X509::Store (Ruby 2.2.2)
Description: Class : OpenSSL::X509::Store - Ruby 2.2.2

- Home
- Core 2.2.2
- Std-lib 2.2.2
- Downloads

Support for the Ruby 2.2 series has ended. See here for reference.

### Home Classes Methods

### In Files

- openssl/ossl_ssl_session.c

### Parent

Object

### Methods

- ::new
- #add_cert
- #add_crl
- #add_file
- #add_path
- #flags=
- #purpose=
- #set_default_paths
- #time=
- #trust=
- #verify
- #verify_callback=

### Class/Module Index

Quicksearch

- Integer
- OpenSSL::ASN1
- OpenSSL::ASN1::ASN1Data
- OpenSSL::ASN1::ASN1Error
- OpenSSL::ASN1::Constructive
- OpenSSL::ASN1::ObjectId
- OpenSSL::ASN1::Primitive
- OpenSSL::BN
- OpenSSL::BNError
- OpenSSL::Buffering
- OpenSSL::Cipher
- OpenSSL::Cipher::Cipher
- OpenSSL::Cipher::CipherError
- OpenSSL::Config
- OpenSSL::ConfigError
- OpenSSL::Digest
- OpenSSL::Digest::DigestError
- OpenSSL::Engine
- OpenSSL::Engine::EngineError
- OpenSSL::HMAC
- OpenSSL::HMACError
- OpenSSL::Netscape
- OpenSSL::Netscape::SPKI
- OpenSSL::Netscape::SPKIError
- OpenSSL::OCSP
- OpenSSL::OCSP::BasicResponse
- OpenSSL::OCSP::CertificateId
- OpenSSL::OCSP::OCSPError
- OpenSSL::OCSP::Request
- OpenSSL::OCSP::Response
- OpenSSL::OpenSSLError
- OpenSSL::PKCS12
- OpenSSL::PKCS12::PKCS12Error
- OpenSSL::PKCS5
- OpenSSL::PKCS5::PKCS5Error
- OpenSSL::PKCS7
- OpenSSL::PKCS7::PKCS7Error
- OpenSSL::PKCS7::RecipientInfo
- OpenSSL::PKCS7::SignerInfo
- OpenSSL::PKey
- OpenSSL::PKey::DH
- OpenSSL::PKey::DHError
- OpenSSL::PKey::DSA
- OpenSSL::PKey::DSAError
- OpenSSL::PKey::EC
- OpenSSL::PKey::EC::Group
- OpenSSL::PKey::EC::Group::Error
- OpenSSL::PKey::EC::Point
- OpenSSL::PKey::EC::Point::Error
- OpenSSL::PKey::ECError
- OpenSSL::PKey::PKey
- OpenSSL::PKey::PKeyError
- OpenSSL::PKey::RSA
- OpenSSL::PKey::RSAError
- OpenSSL::Random
- OpenSSL::Random::RandomError
- OpenSSL::SSL
- OpenSSL::SSL::Nonblock
- OpenSSL::SSL::SSLContext
- OpenSSL::SSL::SSLError
- OpenSSL::SSL::SSLErrorWaitReadable
- OpenSSL::SSL::SSLErrorWaitWritable
- OpenSSL::SSL::SSLServer
- OpenSSL::SSL::SSLSocket
- OpenSSL::SSL::Session
- OpenSSL::SSL::Session::SessionError
- OpenSSL::SSL::SocketForwarder
- OpenSSL::X509
- OpenSSL::X509::Attribute
- OpenSSL::X509::AttributeError
- OpenSSL::X509::CRL
- OpenSSL::X509::CRLError
- OpenSSL::X509::Certificate
- OpenSSL::X509::CertificateError
- OpenSSL::X509::Extension
- OpenSSL::X509::ExtensionError
- OpenSSL::X509::ExtensionFactory
- OpenSSL::X509::Name
- OpenSSL::X509::Name::RFC2253DN
- OpenSSL::X509::NameError
- OpenSSL::X509::Request
- OpenSSL::X509::RequestError
- OpenSSL::X509::Revoked
- OpenSSL::X509::RevokedError
- OpenSSL::X509::Store
- OpenSSL::X509::StoreContext
- OpenSSL::X509::StoreError
- unknown

No matching classes.

# OpenSSL::X509::Store

The X509 certificate store holds trusted CA certificates used to verify peer certificates.

The easiest way to create a useful certificate store is:

    cert_store = OpenSSL::X509::Store.new
    cert_store.set_default_paths

This will use your system's built-in certificates.

If your system does not have a default set of certificates you can obtain a set from Mozilla here: curl.haxx.se/docs/caextract.html (Note that this set does not have an HTTPS download option so you may wish to use the firefox-db2pem.sh script to extract the certificates from a local install to avoid man-in-the-middle attacks.)

After downloading or generating a cacert.pem from the above link you can create a certificate store from the pem file like this:

    cert_store = OpenSSL::X509::Store.new
    cert_store.add_file 'cacert.pem'

The certificate store can be used with an SSLSocket like this:

    ssl_context = OpenSSL::SSL::SSLContext.new
    ssl_context.cert_store = cert_store

    tcp_socket = TCPSocket.open 'example.com', 443

    ssl_socket = OpenSSL::SSL::SSLSocket.new tcp_socket, ssl_context

### Attributes

chain[R]
error[R]
error_string[R]
verify_callback[R]

### Public Class Methods

X509::Store.new => store click to toggle source

                   static VALUE
    ossl_x509store_initialize(int argc, VALUE *argv, VALUE self)
    {
        X509_STORE *store;

    /* BUG: This method takes any number of arguments but appears to ignore them. */
        GetX509Store(self, store);
        store->ex_data.sk = NULL;
        X509_STORE_set_verify_cb_func(store, ossl_verify_cb);
        ossl_x509store_set_vfy_cb(self, Qnil);

    #if (OPENSSL_VERSION_NUMBER < 0x00907000L)
        rb_iv_set(self, "@flags", INT2FIX(0));
        rb_iv_set(self, "@purpose", INT2FIX(0));
        rb_iv_set(self, "@trust", INT2FIX(0));
    #endif

        /* last verification status */
        rb_iv_set(self, "@error", Qnil);
        rb_iv_set(self, "@error_string", Qnil);
        rb_iv_set(self, "@chain", Qnil);
        rb_iv_set(self, "@time", Qnil);

        return self;
    }

### Public Instance Methods

add_cert(cert) click to toggle source

Adds the OpenSSL::X509::Certificate `cert` to the certificate store.

                   static VALUE
    ossl_x509store_add_cert(VALUE self, VALUE arg)
    {
        X509_STORE *store;
        X509 *cert;

        cert = GetX509CertPtr(arg); /* NO NEED TO DUP */
        GetX509Store(self, store);
        if (X509_STORE_add_cert(store, cert) != 1){
            ossl_raise(eX509StoreError, NULL);
        }

        return self;
    }

add_crl(p1) click to toggle source

                   static VALUE
    ossl_x509store_add_crl(VALUE self, VALUE arg)
    {
        X509_STORE *store;
        X509_CRL *crl;

        crl = GetX509CRLPtr(arg); /* NO NEED TO DUP */
        GetX509Store(self, store);
        if (X509_STORE_add_crl(store, crl) != 1){
            ossl_raise(eX509StoreError, NULL);
        }

        return self;
    }

add_file(file) → store click to toggle source

Adds the certificates in `file` to the certificate store. The `file` can contain multiple PEM-encoded certificates.

                   static VALUE
    ossl_x509store_add_file(VALUE self, VALUE file)
    {
        X509_STORE *store;
        X509_LOOKUP *lookup;
        char *path = NULL;

        if(file != Qnil){
            SafeStringValue(file);
            path = RSTRING_PTR(file);
        }
        GetX509Store(self, store);
        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
        if(lookup == NULL) ossl_raise(eX509StoreError, NULL);
        if(X509_LOOKUP_load_file(lookup, path, X509_FILETYPE_PEM) != 1){
            ossl_raise(eX509StoreError, NULL);
        }

        return self;
    }

add_path(p1) click to toggle source

                   static VALUE
    ossl_x509store_add_path(VALUE self, VALUE dir)
    {
        X509_STORE *store;
        X509_LOOKUP *lookup;
        char *path = NULL;

        if(dir != Qnil){
            SafeStringValue(dir);
            path = RSTRING_PTR(dir);
        }
        GetX509Store(self, store);
        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
        if(lookup == NULL) ossl_raise(eX509StoreError, NULL);
        if(X509_LOOKUP_add_dir(lookup, path, X509_FILETYPE_PEM) != 1){
            ossl_raise(eX509StoreError, NULL);
        }

        return self;
    }

flags=(p1) click to toggle source

                   static VALUE
    ossl_x509store_set_flags(VALUE self, VALUE flags)
    {
    #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
        X509_STORE *store;
        long f = NUM2LONG(flags);

        GetX509Store(self, store);
        X509_STORE_set_flags(store, f);
    #else
        rb_iv_set(self, "@flags", flags);
    #endif

        return flags;
    }

purpose=(p1) click to toggle source

                   static VALUE
    ossl_x509store_set_purpose(VALUE self, VALUE purpose)
    {
    #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
        X509_STORE *store;
        int p = NUM2INT(purpose);

        GetX509Store(self, store);
        X509_STORE_set_purpose(store, p);
    #else
        rb_iv_set(self, "@purpose", purpose);
    #endif

        return purpose;
    }

set_default_paths click to toggle source

Adds the default certificates to the certificate store. These certificates are loaded from the default configuration directory which can usually be determined by:

    File.dirname OpenSSL::Config::DEFAULT_CONFIG_FILE

                   static VALUE
    ossl_x509store_set_default_paths(VALUE self)
    {
        X509_STORE *store;

        GetX509Store(self, store);
        if (X509_STORE_set_default_paths(store) != 1){
            ossl_raise(eX509StoreError, NULL);
        }

        return Qnil;
    }

time=(p1) click to toggle source

                   static VALUE
    ossl_x509store_set_time(VALUE self, VALUE time)
    {
        rb_iv_set(self, "@time", time);
        return time;
    }

trust=(p1) click to toggle source

                   static VALUE
    ossl_x509store_set_trust(VALUE self, VALUE trust)
    {
    #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
        X509_STORE *store;
        int t = NUM2INT(trust);

        GetX509Store(self, store);
        X509_STORE_set_trust(store, t);
    #else
        rb_iv_set(self, "@trust", trust);
    #endif

        return trust;
    }

verify(p1, p2 = v2) click to toggle source

                   static VALUE
    ossl_x509store_verify(int argc, VALUE *argv, VALUE self)
    {
        VALUE cert, chain;
        VALUE ctx, proc, result;

        rb_scan_args(argc, argv, "11", &cert, &chain);
        ctx = rb_funcall(cX509StoreContext, rb_intern("new"), 3, self, cert, chain);
        proc = rb_block_given_p() ?  rb_block_proc() :
               rb_iv_get(self, "@verify_callback");
        rb_iv_set(ctx, "@verify_callback", proc);
        result = rb_funcall(ctx, rb_intern("verify"), 0);

        rb_iv_set(self, "@error", ossl_x509stctx_get_err(ctx));
        rb_iv_set(self, "@error_string", ossl_x509stctx_get_err_string(ctx));
        rb_iv_set(self, "@chain", ossl_x509stctx_get_chain(ctx));

        return result;
    }

verify_callback=(p1) click to toggle source

General callback for OpenSSL verify

                   static VALUE
    ossl_x509store_set_vfy_cb(VALUE self, VALUE cb)
    {
        X509_STORE *store;

        GetX509Store(self, store);
        X509_STORE_set_ex_data(store, ossl_verify_cb_idx, (void*)cb);
        rb_iv_set(self, "@verify_callback", cb);

        return cb;
    }