# class CertificateRevocationList

Manage the CRL.

### Public Class Methods

from_s(string) click to toggle source

Convert a string into an instance.

Calls superclass method Puppet::SSL::Base.from_s

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 14
    def self.from_s(string)
      super(string, 'foo') # The name doesn't matter
    end

new(fakename) click to toggle source

The name doesn’t actually matter; there’s only one CRL. We just need the name so our Indirector stuff all works more easily.

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 38
    def initialize(fakename)
      @name = "crl"
    end

supported_formats() click to toggle source

Because of how the format handler class is included, this can’t be in the base class.

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 20
    def self.supported_formats
      [:s]
    end

### Public Instance Methods

generate(cert, cakey) click to toggle source

Knows how to create a CRL with our system defaults.

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 25
    def generate(cert, cakey)
      Puppet.info "Creating a new certificate revocation list"

      create_crl_issued_by(cert)
      start_at_initial_crl_number
      update_valid_time_range_to_start_at(Time.now)
      sign_with(cakey)

      @content
    end

revoke(serial, cakey, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE) click to toggle source

Revoke the certificate with serial number SERIAL issued by this CA, then write the CRL back to disk. The REASON must be one of the OpenSSL::OCSP::REVOKED_* reasons

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 45
    def revoke(serial, cakey, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
      Puppet.notice "Revoked certificate with serial #{serial}"
      time = Time.now

      add_certitificate_revocation_for(serial, reason, time)
      update_to_next_crl_number
      update_valid_time_range_to_start_at(time)
      sign_with(cakey)

      Puppet::SSL::CertificateRevocationList.indirection.save(self)
    end

### Private Instance Methods

add_certitificate_revocation_for(serial, reason, time) click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 69
    def add_certitificate_revocation_for(serial, reason, time)
      revoked = OpenSSL::X509::Revoked.new
      revoked.serial = serial
      revoked.time = time
      enum = OpenSSL::ASN1::Enumerated(reason)
      ext = OpenSSL::X509::Extension.new("CRLReason", enum)
      revoked.add_extension(ext)
      @content.add_revoked(revoked)
    end

create_crl_issued_by(cert) click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 59
    def create_crl_issued_by(cert)
      @content = wrapped_class.new
      @content.issuer = cert.subject
      @content.version = 1
    end

crl_number_of(number) click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 98
    def crl_number_of(number)
      OpenSSL::X509::Extension.new('crlNumber', OpenSSL::ASN1::Integer(number))
    end

sign_with(cakey) click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 102
    def sign_with(cakey)
      @content.sign(cakey, OpenSSL::Digest::SHA1.new)
    end

start_at_initial_crl_number() click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 65
    def start_at_initial_crl_number
      @content.extensions = [crl_number_of(0)]
    end

update_to_next_crl_number() click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 86
    def update_to_next_crl_number
      @content.extensions = with_next_crl_number_from(@content.extensions)
    end

update_valid_time_range_to_start_at(time) click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 79
    def update_valid_time_range_to_start_at(time)
      # The CRL is not valid if the time of checking == the time of last_update.
      # So to have it valid right now we need to say that it was updated one second ago.
      @content.last_update = time - 1
      @content.next_update = time + FIVE_YEARS
    end

with_next_crl_number_from(existing_extensions) click to toggle source

    # File lib/puppet/ssl/certificate_revocation_list.rb, line 90
    def with_next_crl_number_from(existing_extensions)
      existing_crl_num = existing_extensions.find { |e| e.oid == 'crlNumber' }
      new_crl_num = existing_crl_num ? existing_crl_num.value.to_i + 1 : 0

      extensions_without_crl_num = existing_extensions.reject { |e| e.oid == 'crlNumber' }
      extensions_without_crl_num + [crl_number_of(new_crl_num)]
    end