Class: Ronin::CLI::Commands::CertGen Private

Inherits:
Ronin::CLI::Command show all
Includes:
Core::CLI::Logging
Defined in:
lib/ronin/cli/commands/cert_gen.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

Generates a new X509 certificate.

Usage

ronin cert-gen [options]

Options

    --version NUM                The certificate version number (Default: 2)
    --serial NUM                 The certificate serial number (Default: 0)
    --not-before TIME            When the certificate becomes valid. Defaults to the current time.
    --not-after TIME             When the certificate becomes no longer valid. Defaults to one year from now.
-c, --common-name DOMAIN         The Common Name (CN) for the certificate
-A, --subject-alt-name HOST|IP   Adds HOST or IP to subjectAltName
-O, --organization NAME          The Organization (O) for the certificate
-U, --organizational-unit NAME   The Organizational Unit (OU)
-L, --locality NAME              The locality for the certificate
-S, --state XX                   The two-letter State (ST) code for the certificate
-C, --country XX                 The two-letter Country (C) code for the certificate
-t, --key-type rsa|dsa|ec        The signing key type
    --generate-key PATH          Generates and saves a random key (Default: key.pem)
-k, --key-file FILE              Loads the signing key from the FILE
-H sha256|sha1|md5,              The hash algorithm to use for signing (Default: sha256)
    --signing-hash
    --ca-key FILE                The Certificate Authority (CA) key
    --ca-cert FILE               The Certificate Authority (CA) certificate
    --ca                         Generates a CA certificate
-o, --output FILE                The output file (Default: cert.crt)
-h, --help                       Print help information

Examples

ronin cert_gen -c test.com -O "Test Co" -U "Test Dept" -L "Test City" -S NY -C US
ronin cert_gen -c test.com -O "Test Co" -U "Test Dept" -L "Test City" -S NY -C US --key-file private.key
ronin cert_gen -c test.com -A www.test.com -O "Test Co" -U "Test Dept" -L "Test City" -S NY -C US
ronin cert_gen --ca -c "Test CA" -O "Test Co" -U "Test Dept" -L "Test City" -S NY -C US
ronin cert_gen -c test.com -O "Test Co" -U "Test Dept" -L "Test City" -S NY -C US --ca-key ca.key --ca-cert ca.crt

Since:

  • 2.0.0

Constant Summary collapse

IP_REGEXP =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0

Support::Text::Patterns::IP

Instance Method Summary collapse

Constructor Details

#initialize(**kwargs) ⇒ CertGen

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Initializes the ronin cert-gen command.

Parameters:

  • kwargs (Hash{Symbol => Object}) —

    Additional keyword arguments.

Since:

  • 2.0.0



221
222
223
224
225
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 221

def initialize(**kwargs)
  super(**kwargs)

  @subject_alt_names = []
end

Instance Method Details

#ca_cert ⇒ Ronin::Support::Crypto::Cert?

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Loads the --ca-cert certificate file.

Returns:

  • (Ronin::Support::Crypto::Cert, nil)

Since:

  • 2.0.0



344
345
346
347
348
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 344

def ca_cert
  if options[:ca_cert]
    Support::Crypto::Cert.load_file(options[:ca_cert])
  end
end

#ca_key ⇒ Ronin::Support::Key::RSA?

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Loads the --ca-key key file.

Returns:

  • (Ronin::Support::Key::RSA, nil)

Since:

  • 2.0.0



333
334
335
336
337
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 333

def ca_key
  if options[:ca_key]
    Support::Crypto::Key::RSA.load_file(options[:ca_key])
  end
end

#extensions ⇒ Hash{String => Object}?

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Builds the extensions.

Returns:

  • (Hash{String => Object}, nil)

Since:

  • 2.0.0



355
356
357
358
359
360
361
362
363
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 355

def extensions
  exts = {}

  if (ext = subject_alt_name_ext)
    exts['subjectAltName'] = ext
  end

  exts unless exts.empty?
end

#key_class ⇒ Class<Ronin::Support::Key::RSA>, ...

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

The --key-type key class.

Returns:

  • (Class<Ronin::Support::Key::RSA>, Class<Ronin::Support::Key::DSA>, Class<Ronin::Support::Key::EC>, nil)

Since:

  • 2.0.0



298
299
300
301
302
303
304
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 298

def key_class
  case options[:key_type]
  when :rsa then Support::Crypto::Key::RSA
  when :dsa then Support::Crypto::Key::DSA
  when :ec  then Support::Crypto::Key::EC
  end
end

#not_after ⇒ Time

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

The parsed --not-after time or one year from now.

Returns:

  • (Time)

Since:

  • 2.0.0



283
284
285
286
287
288
289
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 283

def not_after
  @not_after ||= if options[:not_after]
                   Time.parse(options[:not_after])
                 else
                   not_before + Support::Crypto::Cert::ONE_YEAR
                 end
end

#not_before ⇒ Time

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

The parsed --not-before time or now.

Returns:

  • (Time)

Since:

  • 2.0.0



270
271
272
273
274
275
276
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 270

def not_before
  @not_before ||= if options[:not_before]
                    Time.parse(options[:not_before])
                  else
                    Time.now
                  end
end

#run ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Runs the ronin cert-gen command.

Since:

  • 2.0.0



230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 230

def run
  if options[:generate_key]
    log_info "Generating new #{options.fetch(:key_type,:rsa).upcase} key ..."
  end

  key  = signing_key
  cert = Ronin::Support::Crypto::Cert.generate(
    version:    options[:version],
    serial:     options[:serial],
    not_before: not_before,
    not_after:  not_after,
    key:        key,
    ca_key:     ca_key,
    ca_cert:    ca_cert,
    subject: {
      common_name:         options[:common_name],
      organization:        options[:organization],
      organizational_unit: options[:organizational_unit],
      locality:            options[:locality],
      state:               options[:state],
      country:             options[:country]
    },
    ca:         options[:ca],
    extensions: extensions
  )

  if options[:generate_key]
    log_info "Saving key to #{options[:generate_key]} ..."
    key.save(options[:generate_key])
  end

  log_info "Saving certificate to #{options[:output]} ..."
  cert.save(options[:output])
end

#signing_key ⇒ Ronin::Support::Key::RSA, ...

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Loads the --key-file key file or generates a new signing key.

Returns:

  • (Ronin::Support::Key::RSA, Ronin::Support::Key::EC, nil)

Since:

  • 2.0.0



311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 311

def signing_key
  if options[:key_file]
    if options[:key_type]
      key_class.load_file(options[:key_file])
    else
      begin
        Support::Crypto::Key.load_file(options[:key_file])
      rescue ArgumentError => error
        print_error(error.message)
        exit(-1)
      end
    end
  else
    (key_class || Support::Crypto::Key::RSA).random
  end
end

#subject_alt_name_ext ⇒ String?

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Builds the subjectAltName extension.

Returns:

  • (String, nil)

Since:

  • 2.0.0



372
373
374
375
376
377
378
379
380
381
382
 
# File 'lib/ronin/cli/commands/cert_gen.rb', line 372

def subject_alt_name_ext
  unless @subject_alt_names.empty?
    @subject_alt_names.map { |name|
      if name =~ IP_REGEXP
        "IP: #{name}"
      else
        "DNS: #{name}"
      end
    }.join(', ')
  end
end