cert-helper 0.4.1

A helper library for managing certificates using OpenSSL, including support for generating CSRs and CRLs.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

use cert_helper::certificate::{CertBuilder, KeyType, UseesBuilderFields, X509Common};
use cert_helper::crl::{CrlReason, X509CrlBuilder, X509CrlWrapper, write_der_crl_as_pem};
use chrono::Utc;
use num_bigint::{BigUint, ToBigUint};

use std::fs;
// view crl:
//  openssl crl -in certs/crl_final.der -inform DER -text -noout
// verify crl
//  openssl crl -in certs/crl_final.der -inform DER -text -noout -CAfile  certs/crl_signer_cert.pem
fn main() {
    let ca = CertBuilder::new()
        .common_name("My Test Ca")
        .is_ca(true)
        .key_type(KeyType::P256)
        .build_and_self_sign()
        .unwrap();
    let mut builder = X509CrlBuilder::new(ca);
    builder.add_revoked_cert(12345u32.to_biguint().unwrap(), Utc::now());

    let wrapper = builder.build_and_sign().unwrap();
    let crl_der = wrapper.to_der().unwrap();
    // write result as simple der file
    std::fs::write("./certs/crl.der", &crl_der).unwrap();
    write_der_crl_as_pem(&crl_der, "./certs", "crl_first.pem")
        .expect("failed to save crl as pem file");
    let ca = CertBuilder::new()
        .common_name("My Test Ca")
        .is_ca(true)
        .key_type(KeyType::P256)
        .build_and_self_sign()
        .unwrap();
    let revocked = CertBuilder::new()
        .common_name("My Test")
        .build_and_self_sign()
        .unwrap();
    ca.save("./certs", "crl_signer").unwrap();
    let bytes = revocked.x509.serial_number().to_bn().unwrap().to_vec();

    let mut builder = if let Ok(existing) = fs::read("./certs/crl.der") {
        X509CrlBuilder::from_der(&existing, ca.clone()).expect("failed to get crl from file")
    } else {
        X509CrlBuilder::new(ca.clone())
    };
    builder.add_revoked_cert_with_reason(
        BigUint::from_bytes_be(&bytes),
        Utc::now(),
        vec![CrlReason::KeyCompromise],
    );
    builder.set_update_times(Utc::now(), Utc::now() + chrono::Duration::days(30));

    let wrapper = builder.build_and_sign().unwrap();
    let crl_der = wrapper.to_der().unwrap();
    std::fs::write("./certs/crl_final.der", &crl_der).unwrap();
    write_der_crl_as_pem(&crl_der, "./certs", "crl_final.pem")
        .expect("failed to save crl as pem file");

    println!("Test X509Wrapper");
    let wrapper = X509CrlWrapper::read_as_pem("./certs/crl_final.pem").unwrap();
    let verify = wrapper.verify_signature(ca.x509.public_key().as_ref().unwrap());
    assert!(verify.unwrap());
    let is_revoked = wrapper.revoked(revocked.x509.serial_number());
    assert!(is_revoked);
    println!("Done");
}