From: Daniel Danopia <danopia@...>
Date: 2009-10-20T06:00:10+09:00
Subject: Certificate hashes using Base64, DER, ASN.1, PkiPath...

I'm trying to write a server for a communications system
(*cough*google wave*cough*) but I'm having some problems with signing
the data payloads. After a while I managed to find this code to sign
the data:

> require 'base64'
> require 'openssl'
> include OpenSSL
> include PKey
> include Digest
>
> private_key = RSA.new(File.open("/Users/andy/tmp/private.pem").read)
> signature  = private_key.sign(OpenSSL::Digest::SHA1.new, "Some text to sign")
> puts Base64.encode64(signature)

A few tweaks (I hate includes) and I can sign data. Now, however, the
protocol wants me to include a hash of the certificate. After a solid
hour of googling it looks like it wants a Base64 encoding (I got that
part) of a PkiPath of a DER-encoded cert chain. I can't figure out how
to generate the last two in Ruby. I do have reference code in Java but
it just calls some methods in the framework, so it doesn't help much.

      CertificateFactory certFactory = CertificateFactory.getInstance
(X509);
      CertPath path = certFactory.generateCertPath(certs);
      byte[] encodedCertPath = path.getEncoded(PKI_PATH_ENCODING);
      MessageDigest digest = MessageDigest.getInstance(
          AlgorithmUtil.getJceName(getHashAlgorithm()));
      return digest.digest(encodedCertPath);

Any tips for generating this in Ruby?