|
| 1 | +# Getting Started |
| 2 | + |
| 3 | +This guide explains how to use `localhost` for provisioning local TLS certificates for development. |
| 4 | + |
| 5 | +## Installation |
| 6 | + |
| 7 | +Add the gem to your project: |
| 8 | + |
| 9 | +~~~ bash |
| 10 | +$ bundle add localhost |
| 11 | +~~~ |
| 12 | + |
| 13 | +Then, generate an issuer certificate and install it: |
| 14 | + |
| 15 | +~~~ bash |
| 16 | +$ bundle exec bake localhost:install |
| 17 | +~~~ |
| 18 | + |
| 19 | +You may be prompted for a password to install the certificate. This is the password for your local keychain. |
| 20 | + |
| 21 | +### Purging your certificates |
| 22 | + |
| 23 | +If you have an existing installation which does not use the issuer certificate, you can remove the existing certificates and start over: |
| 24 | + |
| 25 | +~~~ bash |
| 26 | +$ bundle exec bake localhost:purge |
| 27 | +~~~ |
| 28 | + |
| 29 | +Note this will remove all certificates in the `$XDG_STATE_HOME/localhost.rb/` directory, but it won't remove the issuer certificate that was installed in your keychain. |
| 30 | + |
| 31 | +## Core Concepts |
| 32 | + |
| 33 | +`localhost` has two core concepts: |
| 34 | + |
| 35 | +- A {ruby Localhost::Issuer} instance which represents a certificate authority (CA) that can be used to sign certificates for localhost. |
| 36 | +- A {ruby Localhost::Authority} instance which represents a public and private key pair that can be used for both clients and servers. |
| 37 | + |
| 38 | +### Files |
| 39 | + |
| 40 | +The certificate and private key are stored in `$XDG_STATE_HOME/localhost.rb/` (typically `~/.local/state/localhost.rb/`). You can delete them and they will be regenerated. If you added the certificate to your computer's certificate store/keychain, you'll you'd need to update it. |
| 41 | + |
| 42 | +## Usage |
| 43 | + |
| 44 | +In general, you won't need to do anything at all. The application server you are using will automatically provision a self-signed certificate for localhost. That being said, if you want to implement your own self-signed secure server, the following example demonstrates how to use the {ruby Localhost::Authority}: |
| 45 | + |
| 46 | +``` ruby |
| 47 | +require "socket" |
| 48 | +require "thread" |
| 49 | + |
| 50 | +require "localhost/authority" |
| 51 | + |
| 52 | +# Get the self-signed authority for localhost: |
| 53 | +authority = Localhost::Authority.fetch |
| 54 | + |
| 55 | +ready = Thread::Queue.new |
| 56 | + |
| 57 | +# Start a server thread: |
| 58 | +server_thread = Thread.new do |
| 59 | + server = OpenSSL::SSL::SSLServer.new(TCPServer.new("localhost", 4050), authority.server_context) |
| 60 | + |
| 61 | + server.listen |
| 62 | + |
| 63 | + ready << true |
| 64 | + |
| 65 | + peer = server.accept |
| 66 | + |
| 67 | + peer.puts "Hello World!" |
| 68 | + peer.flush |
| 69 | + |
| 70 | + peer.close |
| 71 | +end |
| 72 | + |
| 73 | +ready.pop |
| 74 | + |
| 75 | +client = OpenSSL::SSL::SSLSocket.new(TCPSocket.new("localhost", 4050), authority.client_context) |
| 76 | + |
| 77 | +# Initialize SSL connection: |
| 78 | +client.connect |
| 79 | + |
| 80 | +# Read the encrypted message: |
| 81 | +puts client.read(12) |
| 82 | + |
| 83 | +client.close |
| 84 | +server_thread.join |
| 85 | +``` |
0 commit comments