Creates a new key pair, and signs them with the signing certificate and key generated from generate_signing_ca above.
All arguments are unused, though two arguments are accepted for compatibility.
returns an array of [public_key, private_key]
# File lib/chef/certificate.rb, line 88 def gen_keypair(common_name=nil, subject_alternative_name = nil) Chef::Log.info("Creating new key pair for #{common_name}") # generate client keypair client_keypair = OpenSSL::PKey::RSA.generate(2048) return client_keypair.public_key, client_keypair end
# File lib/chef/certificate.rb, line 98 def gen_validation_key(name=Chef::Config[:validation_client_name], key_file=Chef::Config[:validation_key], admin=false) # Create the validation key api_client = Chef::ApiClient.new api_client.name(name) api_client.admin(admin) begin # If both the couch record and file exist, don't do anything. Otherwise, # re-generate the validation key. Chef::ApiClient.cdb_load(name) # The couch document was loaded successfully if we got to here; if we # can't also load the file on the filesystem, we'll regenerate it all. File.open(key_file, "r") do |file| end rescue Chef::Exceptions::CouchDBNotFound create_validation_key(api_client, key_file) rescue if $!.class.name =~ /Errno::/ Chef::Log.error("Error opening validation key: #{$!} -- destroying and regenerating") begin api_client.cdb_destroy rescue Bunny::ServerDownError => e # create_validation_key is gonna fail anyway, so let's just bail out. Chef::Log.fatal("Could not de-index (to rabbitmq) previous validation key - rabbitmq is down! Start rabbitmq then restart chef-server to re-generate it") raise end create_validation_key(api_client, key_file) else raise end end end
Generates a new CA Certificate and Key, and writes them out to Chef::Config and Chef::Config.
# File lib/chef/certificate.rb, line 32 def generate_signing_ca ca_cert_file = Chef::Config[:signing_ca_cert] ca_keypair_file = Chef::Config[:signing_ca_key] unless File.exists?(ca_cert_file) && File.exists?(ca_keypair_file) Chef::Log.info("Creating new signing certificate") [ ca_cert_file, ca_keypair_file ].each do |f| ca_basedir = File.dirname(f) FileUtils.mkdir_p ca_basedir end keypair = OpenSSL::PKey::RSA.generate(1024) ca_cert = OpenSSL::X509::Certificate.new ca_cert.version = 3 ca_cert.serial = 1 info = [ ["C", Chef::Config[:signing_ca_country]], ["ST", Chef::Config[:signing_ca_state]], ["L", Chef::Config[:signing_ca_location]], ["O", Chef::Config[:signing_ca_org]], ["OU", "Certificate Service"], ["CN", "#{Chef::Config[:signing_ca_domain]}/emailAddress=#{Chef::Config[:signing_ca_email]}"] ] ca_cert.subject = ca_cert.issuer = OpenSSL::X509::Name.new(info) ca_cert.not_before = Time.now ca_cert.not_after = Time.now + 10 * 365 * 24 * 60 * 60 # 10 years ca_cert.public_key = keypair.public_key ef = OpenSSL::X509::ExtensionFactory.new ef.subject_certificate = ca_cert ef.issuer_certificate = ca_cert ca_cert.extensions = [ ef.create_extension("basicConstraints", "CA:TRUE", true), ef.create_extension("subjectKeyIdentifier", "hash"), ef.create_extension("keyUsage", "cRLSign,keyCertSign", true), ] ca_cert.add_extension ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") ca_cert.sign keypair, OpenSSL::Digest::SHA1.new File.open(ca_cert_file, "w") { |f| f.write ca_cert.to_pem } File.open(ca_keypair_file, File::WRONLY|File::EXCL|File::CREAT, 0600) { |f| f.write keypair.to_pem } if (Chef::Config[:signing_ca_user] && Chef::Config[:signing_ca_group]) FileUtils.chown(Chef::Config[:signing_ca_user], Chef::Config[:signing_ca_group], ca_keypair_file) end end self end
Generated with the Darkfish Rdoc Generator 2.