[Ruby] OpenSSL verify certificate from own CA

Question

Hello all and thanks for your time reading this.

I need to verify certificates issued by my own CA, for which I have a certificate. How can I do the equivalent to openssl's

openssl verify -CAfile

in Ruby code? The RDoc for OpenSSL is not very helpful in this regard. I've tried:

require 'openssl'

ca = OpenSSL::X509::Certificate.new(File.read('ca-cert.pem'))

lic = OpenSSL::X509::Certificate.new(File.read('cert.pem'))

puts lic.verify( ca )

but I get:

test.rb:7:in `verify': wrong argument (OpenSSL::X509::Certificate)!
(Expected kind of OpenSSL::PKey::PKey) (TypeError)
  from test.rb:7

I can't even find "verify" in the OpenSSL Rdoc at http://www.ruby-doc.org/stdlib/libdoc/openssl/rdoc/index.html.

Any help is appreciated. Thanks again!

Answer 1

You need to validate with

lic.verify(ca.public_key)

in addition before that you can verify certificate issuer with

lic.issuer.to_s == ca.subject.to_s

I used one Japanese help page to get the list of available methods :)

Answer 2

I've tried your suggestion, and it still fails to verify:

require 'openssl'

ca = OpenSSL::X509::Certificate.new(File.read('ca.pem'))

lic = OpenSSL::X509::Certificate.new(File.read('lic.pem'))

puts lic.verify( ca.public_key )
puts lic.issuer.to_s == ca.subject.to_s

The output is

false
false

The same files with " openssl verify -CAfile ca.pem lic.pem" :

lic.pem: OK

Any other suggestions?

Answer 3

lic.verify() only verify the key from the certificate that signed lic. Ccommercial root CAs do not sign end user certificates directly. Usually there is one or 2 intermediate signing certificates involved.

So if CA -> signer -> user cert then

lic.verify( signer.public_key) and signer.verify( CA.public_key) will return true but lic.verify( CA.public_key ) will return false.