Skip to content

Commit 2d28532

Browse files
committed
Add TLS client verify example.
1 parent 4cee4b0 commit 2d28532

File tree

6 files changed

+130
-0
lines changed

6 files changed

+130
-0
lines changed
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDOzCCAiOgAwIBAgIUNkkoR2RJT6RNHQxWFU+tuf4POYQwDQYJKoZIhvcNAQEL
3+
BQAwRTELMAkGA1UEBhMCWFgxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
4+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yNTAxMjUwOTA2NThaGA8yMTI1
5+
MDEwMTA5MDY1OFowRTELMAkGA1UEBhMCWFgxEzARBgNVBAgMClNvbWUtU3RhdGUx
6+
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcN
7+
AQEBBQADggEPADCCAQoCggEBALVUuOfHvOlsu14KLPQmqgaj6Tuarg8fxTdRfBF8
8+
PUzjVP3LUXQ9q6xTCQioRiIvCSgsKW8Zk56i+dUGRbC+V3DBsEvERdb+OrznDtHT
9+
Ylk0UffG2w5WKVsbPJSnF7QzxTnVWlCy3xTZvy0Mp8Aamj4av74TV55Be/U0fR8k
10+
diyOKLUw7dLWEbF5eL88A3IxiDm1hUD1BFd6GnNdl7pvO9g+67MXGGxnzF+mHL6f
11+
YJUNSNqt/UKa0qsyFiqYT7wzvf6hNJgA3ejLyuc0rehtahGPeguSAFQYqy4GAluY
12+
wY2Kfuk+oAFtmU+qOMJcKUjqkUHoZ5Znki9deFxHP4tWo4cCAwEAAaMhMB8wHQYD
13+
VR0OBBYEFEEnRMxBq0uZp2ZhWIwVrlsnc1FqMA0GCSqGSIb3DQEBCwUAA4IBAQCN
14+
Yn8qqIhECUkM/iDLN57ZUGtsFub9urQ2a7vs+PNTcaeZ4wursalsKnBF9i7jwBd0
15+
/lAXEMS/61H1nYN+oIDDh/JxwwPUHmfGPseCautlhIWuewD/Zr5eyYWlWRWu8ihP
16+
8NCwIntkdTFE4yQRDH7M9fsFqVZZct06B4bRp51t5yUN8XnkP3bYNGX0jb/Jjt4r
17+
RZlJAamRv6mDLETJpCFvyq4jBaXK17lBUEnJWUwE7IYPdb0xaKJYzeCwTTjZcGl/
18+
Y5VNXpdGtyPmAWIJGl6pjkXREAgcNRrWi7L51F6/2IhCjoaENSvFurvvJqTtx8/2
19+
vGcG97Rv9pIRHN1WBHWj
20+
-----END CERTIFICATE-----
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE REQUEST-----
2+
MIICijCCAXICAQAwRTELMAkGA1UEBhMCWFgxEzARBgNVBAgMClNvbWUtU3RhdGUx
3+
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcN
4+
AQEBBQADggEPADCCAQoCggEBALVUuOfHvOlsu14KLPQmqgaj6Tuarg8fxTdRfBF8
5+
PUzjVP3LUXQ9q6xTCQioRiIvCSgsKW8Zk56i+dUGRbC+V3DBsEvERdb+OrznDtHT
6+
Ylk0UffG2w5WKVsbPJSnF7QzxTnVWlCy3xTZvy0Mp8Aamj4av74TV55Be/U0fR8k
7+
diyOKLUw7dLWEbF5eL88A3IxiDm1hUD1BFd6GnNdl7pvO9g+67MXGGxnzF+mHL6f
8+
YJUNSNqt/UKa0qsyFiqYT7wzvf6hNJgA3ejLyuc0rehtahGPeguSAFQYqy4GAluY
9+
wY2Kfuk+oAFtmU+qOMJcKUjqkUHoZ5Znki9deFxHP4tWo4cCAwEAAaAAMA0GCSqG
10+
SIb3DQEBCwUAA4IBAQCU596o58DYq416m4rb81hkF3CGOYf5gZF3vlCAqZHqjO8R
11+
jDfgYxDTIgOaBQXUnndb414e/tyhEeDXahXhRxRDltp5wGxcTA7vv6y0vCpIyiH9
12+
BbcC3D6eDf35iKSzabgimyWU2/USxNlS7trO4ZdaZLyHeKadygaRx7udFSVZOUjQ
13+
yKW6Z2rEXFsuFqEmIEFt5HOQZ9BUkcIdnJVkSEFgVyEUWWirTJkdXvHA1iHjnDEv
14+
ClswgGelVeXi6YJXCVuaMMmzUZQN6flzMhcwAKuDjf7zv1o6Jv4yuMI+Xdf8fEsK
15+
e990KFz6HTx2GRkUhE7tUlPRxGikXEKkwGmjK9vM
16+
-----END CERTIFICATE REQUEST-----
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC1VLjnx7zpbLte
3+
Ciz0JqoGo+k7mq4PH8U3UXwRfD1M41T9y1F0PausUwkIqEYiLwkoLClvGZOeovnV
4+
BkWwvldwwbBLxEXW/jq85w7R02JZNFH3xtsOVilbGzyUpxe0M8U51VpQst8U2b8t
5+
DKfAGpo+Gr++E1eeQXv1NH0fJHYsjii1MO3S1hGxeXi/PANyMYg5tYVA9QRXehpz
6+
XZe6bzvYPuuzFxhsZ8xfphy+n2CVDUjarf1CmtKrMhYqmE+8M73+oTSYAN3oy8rn
7+
NK3obWoRj3oLkgBUGKsuBgJbmMGNin7pPqABbZlPqjjCXClI6pFB6GeWZ5IvXXhc
8+
Rz+LVqOHAgMBAAECgf9HL3tngoInIQhtYpFDR+p3sOFfBNpQFajWjqamNp/aD2TO
9+
PYM8nvlGLVLekzD1OoHdw3iApQnOvSxW9J9nQ1IQcflDxUmlnShyAENRHCr/2gpT
10+
uz1D449YtNiTgwVLOQe0LI3IIHBzPwhOJymzwL3Mo7OiavV6qzp+iJyWHTpHQt5X
11+
otrlZYNs3TK2tZX2yAlt/7rpkkGkgyf2K0LKrpeIyS/V8sObX+marYHz/EbEKMiP
12+
qDYutW0JoswZATNUPCC/sCudBEd/1+giUqZGz00npyI8uV9+rbuoT7JG8JTFQj0R
13+
aNqZXrsN3SnR3HIs5uttuYwZiRv6s1yLT4yG6jkCgYEA4oLAqp3hlGodUc1pZitY
14+
vtIeucbtDUNdBHWmWu7RASdTZDGA2TTYoXzNe+7eJ5IWW8n1ossklrVso5Hq2DI5
15+
qulypUfOxFwuu3W6W372jV904nMQmSl6Z28Wy9m5KxdcPWn9cKLbNsCjFtC0ubVn
16+
XYlXBuUjJ4RqX1buXlkVgc8CgYEAzPAyoBmRYHBtqzRJkqVvErzUy7PZrzXRLkGp
17+
7zQzimD+EgWzSUPxMAjTP66ocGkEzzXOlXZkIJYXYXGzE1h4RhHUVoFkC3+QkCMz
18+
jL7mvjfzpeK8+5+pJZiczJIVcP2X8bMYoLNVrytxkEgy273t8exrOu4wx5rgZha9
19+
QmfWyMkCgYEAuitvgYv8QUiqSnbDP0c3TLdUq6q1YWZRiH3OOgT5YbJZ1wrc9Sl7
20+
N9dk6IzeqLVojQ7ERoYiz3/UB+jBlepJ/ZCcOv53EmsVudu8TMFgkbe4UPrz1H8D
21+
7QmgOfH8QE+V76AyvyYLeMgCA5mMQOq5R2a/UZp5N1ydNTk09/TOOX8CgYAc/0ua
22+
faOlSqMp208hscjClPdjD0KY2PuNGPtrfi5gwRKSCD5y+msRCd6iHxt0NFfa3dkq
23+
KsNGHRaX0hetgBIcj/9EcjButBEHZAOyQXyyo4YVDb0BuXicejiNdYoVH7y1FUtB
24+
yb4w9+usp5qSnxAg7/vILdW3GIHxz/vdfoXUiQKBgQDMNlAzZku3Ot9XErSJURXD
25+
VNSfBgpa8FLXqQ85J46NBdTtms3KDwRsEKyBm5yTb/64FxyiSpG7Bgwetk8UpVop
26+
bst522h35wTayA4oaXdV0dDuoIRDC1fz5hmBbI3akP6hsWOiupqh8TAME35KaqWT
27+
2Lj7ymEWe/1LtONYTYt3Og==
28+
-----END PRIVATE KEY-----
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# frozen_string_literal: true
2+
3+
run do |env|
4+
[200, {}, ["Hello World! #{Time.now}"]]
5+
end
Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/usr/bin/env falcon-host
2+
# frozen_string_literal: true
3+
4+
# Released under the MIT License.
5+
# Copyright, 2019-2024, by Samuel Williams.
6+
7+
require "falcon/environment/self_signed_tls"
8+
require "falcon/environment/rack"
9+
require "falcon/environment/supervisor"
10+
11+
service "hello.localhost" do
12+
include Falcon::Environment::SelfSignedTLS
13+
include Falcon::Environment::Rack
14+
15+
scheme "https"
16+
protocol {Async::HTTP::Protocol::HTTPS}
17+
18+
ssl_context do
19+
super().tap do |context|
20+
context.verify_mode = OpenSSL::SSL::VERIFY_PEER
21+
22+
context.verify_callback = proc do |verified, store_context|
23+
Console.warn(self, "Verified: #{verified}, error: #{store_context.error_string}")
24+
25+
true
26+
end
27+
end
28+
end
29+
30+
endpoint do
31+
Async::HTTP::Endpoint.for(scheme, "localhost", port: 9292, protocol: protocol, ssl_context: ssl_context)
32+
end
33+
end
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# TLS Client Verify
2+
3+
It is possible to verify inbound client requests using TLS client certificates. This is useful for ensuring that only authorized clients can access your service. In order to do this, you need to configure Falcon to use a TLS context with additional client verification options.
4+
5+
```ruby
6+
ssl_context do
7+
super().tap do |context|
8+
context.verify_mode = OpenSSL::SSL::VERIFY_PEER
9+
10+
context.verify_callback = proc do |verified, store_context|
11+
# Add your custom verification logic here.
12+
true
13+
end
14+
end
15+
end
16+
```
17+
18+
## Server
19+
20+
``` bash
21+
$ bundle exec falcon host
22+
```
23+
24+
### Client
25+
26+
``` bash
27+
$ openssl s_client -connect localhost:9292 -cert client.crt -key client.key
28+
```

0 commit comments

Comments
 (0)