added ability to fingerprint x509 certs

diff --git a/lib/leap_cli.rb b/lib/leap_cli.rb
index cc9ec69001e2fa43b753bbc33de8e42b39cf9b1c..5eecf62be69c2c95d4aff6c47c017f245607ba4b 100644 (file)
--- a/lib/leap_cli.rb
+++ b/lib/leap_cli.rb
@@ -11,6 +11,7 @@ require 'leap_cli/path'
 require 'leap_cli/util'
 require 'leap_cli/util/secret'
 require 'leap_cli/util/remote_command'
+require 'leap_cli/util/x509'
 
 require 'leap_cli/log'
 require 'leap_cli/ssh_key'

diff --git a/lib/leap_cli/config/object.rb b/lib/leap_cli/config/object.rb
index 492de341dab4847e3b89fbb3b3880c3f871222ac..70834a5e7f2d3d4526158a318f0da83f2d35939c 100644 (file)
--- a/lib/leap_cli/config/object.rb
+++ b/lib/leap_cli/config/object.rb
@@ -218,6 +218,9 @@ module LeapCli
           @path = path
           @options = options
         end
+        def to_s
+          @path
+        end
       end
 
       #
@@ -258,6 +261,13 @@ module LeapCli
         @manager.secrets[name.to_s] ||= Util::Secret.generate(length)
       end
 
+      #
+      # return a fingerprint for a x509 certificate
+      #
+      def fingerprint(filename)
+        "SHA256: " + X509.fingerprint("SHA256", Path.named_path(filename))
+      end
+
       private
 
       #

diff --git a/lib/leap_cli/util/x509.rb b/lib/leap_cli/util/x509.rb
new file mode 100644 (file)
index 0000000..9ecd92d
--- /dev/null
+++ b/lib/leap_cli/util/x509.rb
@@ -0,0 +1,32 @@
+require 'openssl'
+require 'certificate_authority'
+require 'digest'
+require 'digest/md5'
+require 'digest/sha1'
+
+module LeapCli; module X509
+  extend self
+
+  #
+  # returns a fingerprint of a x509 certificate
+  #
+  def fingerprint(digest, cert_file)
+    if cert_file.is_a? String
+      cert = OpenSSL::X509::Certificate.new(Util.read_file!(cert_file))
+    elsif cert_file.is_a? OpenSSL::X509::Certificate
+      cert = cert_file
+    elsif cert_file.is_a? CertificateAuthority::Certificate
+      cert = cert_file.openssl_body
+    end
+    digester = case digest
+      when "MD5" then Digest::MD5.new
+      when "SHA1" then Digest::SHA1.new
+      when "SHA256" then Digest::SHA256.new
+      when "SHA384" then Digest::SHA384.new
+      when "SHA512" then Digest::SHA512.new
+    end
+    digester.hexdigest(cert.to_der)
+  end
+
+
+end; end