mirror of
https://github.com/certd/certd.git
synced 2026-04-24 04:17:25 +08:00
build: add node-acme-client copy
This commit is contained in:
xiaojunnuo
@@ -0,0 +1,250 @@
|
||||
/**
|
||||
* ACME API client
|
||||
*/
|
||||
|
||||
const util = require('./util');
|
||||
|
||||
|
||||
/**
|
||||
* AcmeApi
|
||||
*
|
||||
* @class
|
||||
* @param {HttpClient} httpClient
|
||||
*/
|
||||
|
||||
class AcmeApi {
|
||||
constructor(httpClient, accountUrl = null) {
|
||||
this.http = httpClient;
|
||||
this.accountUrl = accountUrl;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get account URL
|
||||
*
|
||||
* @private
|
||||
* @returns {string} Account URL
|
||||
*/
|
||||
|
||||
getAccountUrl() {
|
||||
if (!this.accountUrl) {
|
||||
throw new Error('No account URL found, register account first');
|
||||
}
|
||||
|
||||
return this.accountUrl;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* ACME API request
|
||||
*
|
||||
* @private
|
||||
* @param {string} url Request URL
|
||||
* @param {object} [payload] Request payload, default: `null`
|
||||
* @param {array} [validStatusCodes] Array of valid HTTP response status codes, default: `[]`
|
||||
* @param {object} [opts]
|
||||
* @param {boolean} [opts.includeJwsKid] Include KID instead of JWK in JWS header, default: `true`
|
||||
* @param {boolean} [opts.includeExternalAccountBinding] Include EAB in request, default: `false`
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
async apiRequest(url, payload = null, validStatusCodes = [], { includeJwsKid = true, includeExternalAccountBinding = false } = {}) {
|
||||
const kid = includeJwsKid ? this.getAccountUrl() : null;
|
||||
const resp = await this.http.signedRequest(url, payload, { kid, includeExternalAccountBinding });
|
||||
|
||||
if (validStatusCodes.length && (validStatusCodes.indexOf(resp.status) === -1)) {
|
||||
throw new Error(util.formatResponseError(resp));
|
||||
}
|
||||
|
||||
return resp;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* ACME API request by resource name helper
|
||||
*
|
||||
* @private
|
||||
* @param {string} resource Request resource name
|
||||
* @param {object} [payload] Request payload, default: `null`
|
||||
* @param {array} [validStatusCodes] Array of valid HTTP response status codes, default: `[]`
|
||||
* @param {object} [opts]
|
||||
* @param {boolean} [opts.includeJwsKid] Include KID instead of JWK in JWS header, default: `true`
|
||||
* @param {boolean} [opts.includeExternalAccountBinding] Include EAB in request, default: `false`
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
async apiResourceRequest(resource, payload = null, validStatusCodes = [], { includeJwsKid = true, includeExternalAccountBinding = false } = {}) {
|
||||
const resourceUrl = await this.http.getResourceUrl(resource);
|
||||
return this.apiRequest(resourceUrl, payload, validStatusCodes, { includeJwsKid, includeExternalAccountBinding });
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get Terms of Service URL if available
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.1.1
|
||||
*
|
||||
* @returns {Promise<string|null>} ToS URL
|
||||
*/
|
||||
|
||||
async getTermsOfServiceUrl() {
|
||||
return this.http.getMetaField('termsOfService');
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create new account
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.3
|
||||
*
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
async createAccount(data) {
|
||||
const resp = await this.apiResourceRequest('newAccount', data, [200, 201], {
|
||||
includeJwsKid: false,
|
||||
includeExternalAccountBinding: (data.onlyReturnExisting !== true)
|
||||
});
|
||||
|
||||
/* Set account URL */
|
||||
if (resp.headers.location) {
|
||||
this.accountUrl = resp.headers.location;
|
||||
}
|
||||
|
||||
return resp;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Update account
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.3.2
|
||||
*
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
updateAccount(data) {
|
||||
return this.apiRequest(this.getAccountUrl(), data, [200, 202]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Update account key
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.3.5
|
||||
*
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
updateAccountKey(data) {
|
||||
return this.apiResourceRequest('keyChange', data, [200]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create new order
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.4
|
||||
*
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
createOrder(data) {
|
||||
return this.apiResourceRequest('newOrder', data, [201]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get order
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.4
|
||||
*
|
||||
* @param {string} url Order URL
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
getOrder(url) {
|
||||
return this.apiRequest(url, null, [200]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Finalize order
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.4
|
||||
*
|
||||
* @param {string} url Finalization URL
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
finalizeOrder(url, data) {
|
||||
return this.apiRequest(url, data, [200]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get identifier authorization
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.5
|
||||
*
|
||||
* @param {string} url Authorization URL
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
getAuthorization(url) {
|
||||
return this.apiRequest(url, null, [200]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Update identifier authorization
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.5.2
|
||||
*
|
||||
* @param {string} url Authorization URL
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
updateAuthorization(url, data) {
|
||||
return this.apiRequest(url, data, [200]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Complete challenge
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.5.1
|
||||
*
|
||||
* @param {string} url Challenge URL
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
completeChallenge(url, data) {
|
||||
return this.apiRequest(url, data, [200]);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Revoke certificate
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.6
|
||||
*
|
||||
* @param {object} data Request payload
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
revokeCert(data) {
|
||||
return this.apiResourceRequest('revokeCert', data, [200]);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/* Export API */
|
||||
module.exports = AcmeApi;
|
||||
@@ -0,0 +1,193 @@
|
||||
/**
|
||||
* ACME auto helper
|
||||
*/
|
||||
|
||||
const { readCsrDomains } = require('./crypto');
|
||||
const { log } = require('./logger');
|
||||
|
||||
const defaultOpts = {
|
||||
csr: null,
|
||||
email: null,
|
||||
preferredChain: null,
|
||||
termsOfServiceAgreed: false,
|
||||
skipChallengeVerification: false,
|
||||
challengePriority: ['http-01', 'dns-01'],
|
||||
challengeCreateFn: async () => { throw new Error('Missing challengeCreateFn()'); },
|
||||
challengeRemoveFn: async () => { throw new Error('Missing challengeRemoveFn()'); }
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* ACME client auto mode
|
||||
*
|
||||
* @param {AcmeClient} client ACME client
|
||||
* @param {object} userOpts Options
|
||||
* @returns {Promise<buffer>} Certificate
|
||||
*/
|
||||
|
||||
module.exports = async function(client, userOpts) {
|
||||
const opts = Object.assign({}, defaultOpts, userOpts);
|
||||
const accountPayload = { termsOfServiceAgreed: opts.termsOfServiceAgreed };
|
||||
|
||||
if (!Buffer.isBuffer(opts.csr)) {
|
||||
opts.csr = Buffer.from(opts.csr);
|
||||
}
|
||||
|
||||
if (opts.email) {
|
||||
accountPayload.contact = [`mailto:${opts.email}`];
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Register account
|
||||
*/
|
||||
|
||||
log('[auto] Checking account');
|
||||
|
||||
try {
|
||||
client.getAccountUrl();
|
||||
log('[auto] Account URL already exists, skipping account registration');
|
||||
}
|
||||
catch (e) {
|
||||
log('[auto] Registering account');
|
||||
await client.createAccount(accountPayload);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Parse domains from CSR
|
||||
*/
|
||||
|
||||
log('[auto] Parsing domains from Certificate Signing Request');
|
||||
const csrDomains = readCsrDomains(opts.csr);
|
||||
const domains = [csrDomains.commonName].concat(csrDomains.altNames);
|
||||
const uniqueDomains = Array.from(new Set(domains));
|
||||
|
||||
log(`[auto] Resolved ${uniqueDomains.length} unique domains from parsing the Certificate Signing Request`);
|
||||
|
||||
|
||||
/**
|
||||
* Place order
|
||||
*/
|
||||
|
||||
log('[auto] Placing new certificate order with ACME provider');
|
||||
const orderPayload = { identifiers: uniqueDomains.map((d) => ({ type: 'dns', value: d })) };
|
||||
const order = await client.createOrder(orderPayload);
|
||||
const authorizations = await client.getAuthorizations(order);
|
||||
|
||||
log(`[auto] Placed certificate order successfully, received ${authorizations.length} identity authorizations`);
|
||||
|
||||
|
||||
/**
|
||||
* Resolve and satisfy challenges
|
||||
*/
|
||||
|
||||
log('[auto] Resolving and satisfying authorization challenges');
|
||||
|
||||
const challengeFunc = async (authz) => {
|
||||
const d = authz.identifier.value;
|
||||
let challengeCompleted = false;
|
||||
|
||||
/* Skip authz that already has valid status */
|
||||
if (authz.status === 'valid') {
|
||||
log(`[auto] [${d}] Authorization already has valid status, no need to complete challenges`);
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
/* Select challenge based on priority */
|
||||
const challenge = authz.challenges.sort((a, b) => {
|
||||
const aidx = opts.challengePriority.indexOf(a.type);
|
||||
const bidx = opts.challengePriority.indexOf(b.type);
|
||||
|
||||
if (aidx === -1) return 1;
|
||||
if (bidx === -1) return -1;
|
||||
return aidx - bidx;
|
||||
}).slice(0, 1)[0];
|
||||
|
||||
if (!challenge) {
|
||||
throw new Error(`Unable to select challenge for ${d}, no challenge found`);
|
||||
}
|
||||
|
||||
log(`[auto] [${d}] Found ${authz.challenges.length} challenges, selected type: ${challenge.type}`);
|
||||
|
||||
/* Trigger challengeCreateFn() */
|
||||
log(`[auto] [${d}] Trigger challengeCreateFn()`);
|
||||
const keyAuthorization = await client.getChallengeKeyAuthorization(challenge);
|
||||
|
||||
try {
|
||||
await opts.challengeCreateFn(authz, challenge, keyAuthorization);
|
||||
|
||||
/* Challenge verification */
|
||||
if (opts.skipChallengeVerification === true) {
|
||||
log(`[auto] [${d}] Skipping challenge verification since skipChallengeVerification=true`);
|
||||
}
|
||||
else {
|
||||
log(`[auto] [${d}] Running challenge verification`);
|
||||
await client.verifyChallenge(authz, challenge);
|
||||
}
|
||||
|
||||
/* Complete challenge and wait for valid status */
|
||||
log(`[auto] [${d}] Completing challenge with ACME provider and waiting for valid status`);
|
||||
await client.completeChallenge(challenge);
|
||||
challengeCompleted = true;
|
||||
|
||||
await client.waitForValidStatus(challenge);
|
||||
}
|
||||
finally {
|
||||
/* Trigger challengeRemoveFn(), suppress errors */
|
||||
log(`[auto] [${d}] Trigger challengeRemoveFn()`);
|
||||
|
||||
try {
|
||||
await opts.challengeRemoveFn(authz, challenge, keyAuthorization);
|
||||
}
|
||||
catch (e) {
|
||||
log(`[auto] [${d}] challengeRemoveFn threw error: ${e.message}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (e) {
|
||||
/* Deactivate pending authz when unable to complete challenge */
|
||||
if (!challengeCompleted) {
|
||||
log(`[auto] [${d}] Unable to complete challenge: ${e.message}`);
|
||||
|
||||
try {
|
||||
log(`[auto] [${d}] Deactivating failed authorization`);
|
||||
await client.deactivateAuthorization(authz);
|
||||
}
|
||||
catch (f) {
|
||||
/* Suppress deactivateAuthorization() errors */
|
||||
log(`[auto] [${d}] Authorization deactivation threw error: ${f.message}`);
|
||||
}
|
||||
}
|
||||
|
||||
throw e;
|
||||
}
|
||||
};
|
||||
|
||||
const challengePromises = authorizations.map((authz) => async () => {
|
||||
await challengeFunc(authz);
|
||||
});
|
||||
|
||||
log('[auto] Waiting for challenge valid status');
|
||||
// await Promise.all(challengePromises);
|
||||
|
||||
log('开始challenge');
|
||||
let promise = Promise.resolve();
|
||||
function runPromisesSerially(tasks) {
|
||||
tasks.forEach((task) => {
|
||||
promise = promise.then(task);
|
||||
});
|
||||
return promise;
|
||||
}
|
||||
|
||||
await runPromisesSerially(challengePromises);
|
||||
log('challenge结束');
|
||||
/**
|
||||
* Finalize order and download certificate
|
||||
*/
|
||||
|
||||
log('[auto] Finalizing order and downloading certificate');
|
||||
const finalized = await client.finalizeOrder(order, opts.csr);
|
||||
return client.getCertificate(finalized, opts.preferredChain);
|
||||
};
|
||||
@@ -0,0 +1,40 @@
|
||||
/**
|
||||
* Axios instance
|
||||
*/
|
||||
|
||||
const axios = require('axios');
|
||||
const adapter = require('axios/lib/adapters/http');
|
||||
const pkg = require('./../package.json');
|
||||
|
||||
|
||||
/**
|
||||
* Instance
|
||||
*/
|
||||
|
||||
const instance = axios.create();
|
||||
|
||||
/* Default User-Agent */
|
||||
instance.defaults.headers.common['User-Agent'] = `node-${pkg.name}/${pkg.version}`;
|
||||
|
||||
/* Default ACME settings */
|
||||
instance.defaults.acmeSettings = {
|
||||
httpChallengePort: 80,
|
||||
bypassCustomDnsResolver: false
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Explicitly set Node as default HTTP adapter
|
||||
*
|
||||
* https://github.com/axios/axios/issues/1180
|
||||
* https://stackoverflow.com/questions/42677387
|
||||
*/
|
||||
|
||||
instance.defaults.adapter = adapter;
|
||||
|
||||
|
||||
/**
|
||||
* Export instance
|
||||
*/
|
||||
|
||||
module.exports = instance;
|
||||
@@ -0,0 +1,735 @@
|
||||
/**
|
||||
* ACME client
|
||||
*
|
||||
* @namespace Client
|
||||
*/
|
||||
|
||||
const { createHash } = require('crypto');
|
||||
const { getPemBodyAsB64u } = require('./crypto');
|
||||
const { log } = require('./logger');
|
||||
const HttpClient = require('./http');
|
||||
const AcmeApi = require('./api');
|
||||
const verify = require('./verify');
|
||||
const util = require('./util');
|
||||
const auto = require('./auto');
|
||||
|
||||
|
||||
/**
|
||||
* ACME states
|
||||
*
|
||||
* @private
|
||||
*/
|
||||
|
||||
const validStates = ['ready', 'valid'];
|
||||
const pendingStates = ['pending', 'processing'];
|
||||
const invalidStates = ['invalid'];
|
||||
|
||||
|
||||
/**
|
||||
* Default options
|
||||
*
|
||||
* @private
|
||||
*/
|
||||
|
||||
const defaultOpts = {
|
||||
directoryUrl: undefined,
|
||||
accountKey: undefined,
|
||||
accountUrl: null,
|
||||
externalAccountBinding: {},
|
||||
backoffAttempts: 10,
|
||||
backoffMin: 5000,
|
||||
backoffMax: 30000
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* AcmeClient
|
||||
*
|
||||
* @class
|
||||
* @param {object} opts
|
||||
* @param {string} opts.directoryUrl ACME directory URL
|
||||
* @param {buffer|string} opts.accountKey PEM encoded account private key
|
||||
* @param {string} [opts.accountUrl] Account URL, default: `null`
|
||||
* @param {object} [opts.externalAccountBinding]
|
||||
* @param {string} [opts.externalAccountBinding.kid] External account binding KID
|
||||
* @param {string} [opts.externalAccountBinding.hmacKey] External account binding HMAC key
|
||||
* @param {number} [opts.backoffAttempts] Maximum number of backoff attempts, default: `10`
|
||||
* @param {number} [opts.backoffMin] Minimum backoff attempt delay in milliseconds, default: `5000`
|
||||
* @param {number} [opts.backoffMax] Maximum backoff attempt delay in milliseconds, default: `30000`
|
||||
*
|
||||
* @example Create ACME client instance
|
||||
* ```js
|
||||
* const client = new acme.Client({
|
||||
* directoryUrl: acme.directory.letsencrypt.staging,
|
||||
* accountKey: 'Private key goes here'
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Create ACME client instance
|
||||
* ```js
|
||||
* const client = new acme.Client({
|
||||
* directoryUrl: acme.directory.letsencrypt.staging,
|
||||
* accountKey: 'Private key goes here',
|
||||
* accountUrl: 'Optional account URL goes here',
|
||||
* backoffAttempts: 10,
|
||||
* backoffMin: 5000,
|
||||
* backoffMax: 30000
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Create ACME client with external account binding
|
||||
* ```js
|
||||
* const client = new acme.Client({
|
||||
* directoryUrl: 'https://acme-provider.example.com/directory-url',
|
||||
* accountKey: 'Private key goes here',
|
||||
* externalAccountBinding: {
|
||||
* kid: 'YOUR-EAB-KID',
|
||||
* hmacKey: 'YOUR-EAB-HMAC-KEY'
|
||||
* }
|
||||
* });
|
||||
* ```
|
||||
*/
|
||||
|
||||
class AcmeClient {
|
||||
constructor(opts) {
|
||||
if (!Buffer.isBuffer(opts.accountKey)) {
|
||||
opts.accountKey = Buffer.from(opts.accountKey);
|
||||
}
|
||||
|
||||
this.opts = Object.assign({}, defaultOpts, opts);
|
||||
|
||||
this.backoffOpts = {
|
||||
attempts: this.opts.backoffAttempts,
|
||||
min: this.opts.backoffMin,
|
||||
max: this.opts.backoffMax
|
||||
};
|
||||
|
||||
this.http = new HttpClient(this.opts.directoryUrl, this.opts.accountKey, this.opts.externalAccountBinding);
|
||||
this.api = new AcmeApi(this.http, this.opts.accountUrl);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get Terms of Service URL if available
|
||||
*
|
||||
* @returns {Promise<string|null>} ToS URL
|
||||
*
|
||||
* @example Get Terms of Service URL
|
||||
* ```js
|
||||
* const termsOfService = client.getTermsOfServiceUrl();
|
||||
*
|
||||
* if (!termsOfService) {
|
||||
* // CA did not provide Terms of Service
|
||||
* }
|
||||
* ```
|
||||
*/
|
||||
|
||||
getTermsOfServiceUrl() {
|
||||
return this.api.getTermsOfServiceUrl();
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get current account URL
|
||||
*
|
||||
* @returns {string} Account URL
|
||||
* @throws {Error} No account URL found
|
||||
*
|
||||
* @example Get current account URL
|
||||
* ```js
|
||||
* try {
|
||||
* const accountUrl = client.getAccountUrl();
|
||||
* }
|
||||
* catch (e) {
|
||||
* // No account URL exists, need to create account first
|
||||
* }
|
||||
* ```
|
||||
*/
|
||||
|
||||
getAccountUrl() {
|
||||
return this.api.getAccountUrl();
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create a new account
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.3
|
||||
*
|
||||
* @param {object} [data] Request data
|
||||
* @returns {Promise<object>} Account
|
||||
*
|
||||
* @example Create a new account
|
||||
* ```js
|
||||
* const account = await client.createAccount({
|
||||
* termsOfServiceAgreed: true
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Create a new account with contact info
|
||||
* ```js
|
||||
* const account = await client.createAccount({
|
||||
* termsOfServiceAgreed: true,
|
||||
* contact: ['mailto:test@example.com']
|
||||
* });
|
||||
* ```
|
||||
*/
|
||||
|
||||
async createAccount(data = {}) {
|
||||
try {
|
||||
this.getAccountUrl();
|
||||
|
||||
/* Account URL exists */
|
||||
log('Account URL exists, returning updateAccount()');
|
||||
return this.updateAccount(data);
|
||||
}
|
||||
catch (e) {
|
||||
const resp = await this.api.createAccount(data);
|
||||
|
||||
/* HTTP 200: Account exists */
|
||||
if (resp.status === 200) {
|
||||
log('Account already exists (HTTP 200), returning updateAccount()');
|
||||
return this.updateAccount(data);
|
||||
}
|
||||
|
||||
return resp.data;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Update existing account
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.3.2
|
||||
*
|
||||
* @param {object} [data] Request data
|
||||
* @returns {Promise<object>} Account
|
||||
*
|
||||
* @example Update existing account
|
||||
* ```js
|
||||
* const account = await client.updateAccount({
|
||||
* contact: ['mailto:foo@example.com']
|
||||
* });
|
||||
* ```
|
||||
*/
|
||||
|
||||
async updateAccount(data = {}) {
|
||||
try {
|
||||
this.api.getAccountUrl();
|
||||
}
|
||||
catch (e) {
|
||||
log('No account URL found, returning createAccount()');
|
||||
return this.createAccount(data);
|
||||
}
|
||||
|
||||
/* Remove data only applicable to createAccount() */
|
||||
if ('onlyReturnExisting' in data) {
|
||||
delete data.onlyReturnExisting;
|
||||
}
|
||||
|
||||
/* POST-as-GET */
|
||||
if (Object.keys(data).length === 0) {
|
||||
data = null;
|
||||
}
|
||||
|
||||
const resp = await this.api.updateAccount(data);
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Update account private key
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.3.5
|
||||
*
|
||||
* @param {buffer|string} newAccountKey New PEM encoded private key
|
||||
* @param {object} [data] Additional request data
|
||||
* @returns {Promise<object>} Account
|
||||
*
|
||||
* @example Update account private key
|
||||
* ```js
|
||||
* const newAccountKey = 'New private key goes here';
|
||||
* const result = await client.updateAccountKey(newAccountKey);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async updateAccountKey(newAccountKey, data = {}) {
|
||||
if (!Buffer.isBuffer(newAccountKey)) {
|
||||
newAccountKey = Buffer.from(newAccountKey);
|
||||
}
|
||||
|
||||
const accountUrl = this.api.getAccountUrl();
|
||||
|
||||
/* Create new HTTP and API clients using new key */
|
||||
const newHttpClient = new HttpClient(this.opts.directoryUrl, newAccountKey);
|
||||
const newApiClient = new AcmeApi(newHttpClient, accountUrl);
|
||||
|
||||
/* Get old JWK */
|
||||
data.account = accountUrl;
|
||||
data.oldKey = this.http.getJwk();
|
||||
|
||||
/* Get signed request body from new client */
|
||||
const url = await newHttpClient.getResourceUrl('keyChange');
|
||||
const body = newHttpClient.createSignedBody(url, data);
|
||||
|
||||
/* Change key using old client */
|
||||
const resp = await this.api.updateAccountKey(body);
|
||||
|
||||
/* Replace existing HTTP and API client */
|
||||
this.http = newHttpClient;
|
||||
this.api = newApiClient;
|
||||
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create a new order
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.4
|
||||
*
|
||||
* @param {object} data Request data
|
||||
* @returns {Promise<object>} Order
|
||||
*
|
||||
* @example Create a new order
|
||||
* ```js
|
||||
* const order = await client.createOrder({
|
||||
* identifiers: [
|
||||
* { type: 'dns', value: 'example.com' },
|
||||
* { type: 'dns', value: 'test.example.com' }
|
||||
* ]
|
||||
* });
|
||||
* ```
|
||||
*/
|
||||
|
||||
async createOrder(data) {
|
||||
const resp = await this.api.createOrder(data);
|
||||
|
||||
if (!resp.headers.location) {
|
||||
throw new Error('Creating a new order did not return an order link');
|
||||
}
|
||||
|
||||
/* Add URL to response */
|
||||
resp.data.url = resp.headers.location;
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Refresh order object from CA
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.4
|
||||
*
|
||||
* @param {object} order Order object
|
||||
* @returns {Promise<object>} Order
|
||||
*
|
||||
* @example
|
||||
* ```js
|
||||
* const order = { ... }; // Previously created order object
|
||||
* const result = await client.getOrder(order);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async getOrder(order) {
|
||||
if (!order.url) {
|
||||
throw new Error('Unable to get order, URL not found');
|
||||
}
|
||||
|
||||
const resp = await this.api.getOrder(order.url);
|
||||
|
||||
/* Add URL to response */
|
||||
resp.data.url = order.url;
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
/**
|
||||
* Finalize order
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.4
|
||||
*
|
||||
* @param {object} order Order object
|
||||
* @param {buffer|string} csr PEM encoded Certificate Signing Request
|
||||
* @returns {Promise<object>} Order
|
||||
*
|
||||
* @example Finalize order
|
||||
* ```js
|
||||
* const order = { ... }; // Previously created order object
|
||||
* const csr = { ... }; // Previously created Certificate Signing Request
|
||||
* const result = await client.finalizeOrder(order, csr);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async finalizeOrder(order, csr) {
|
||||
if (!order.finalize) {
|
||||
throw new Error('Unable to finalize order, URL not found');
|
||||
}
|
||||
|
||||
if (!Buffer.isBuffer(csr)) {
|
||||
csr = Buffer.from(csr);
|
||||
}
|
||||
|
||||
const data = { csr: getPemBodyAsB64u(csr) };
|
||||
const resp = await this.api.finalizeOrder(order.finalize, data);
|
||||
|
||||
/* Add URL to response */
|
||||
resp.data.url = order.url;
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get identifier authorizations from order
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.5
|
||||
*
|
||||
* @param {object} order Order
|
||||
* @returns {Promise<object[]>} Authorizations
|
||||
*
|
||||
* @example Get identifier authorizations
|
||||
* ```js
|
||||
* const order = { ... }; // Previously created order object
|
||||
* const authorizations = await client.getAuthorizations(order);
|
||||
*
|
||||
* authorizations.forEach((authz) => {
|
||||
* const { challenges } = authz;
|
||||
* });
|
||||
* ```
|
||||
*/
|
||||
|
||||
async getAuthorizations(order) {
|
||||
return Promise.all((order.authorizations || []).map(async (url) => {
|
||||
const resp = await this.api.getAuthorization(url);
|
||||
|
||||
/* Add URL to response */
|
||||
resp.data.url = url;
|
||||
return resp.data;
|
||||
}));
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Deactivate identifier authorization
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.5.2
|
||||
*
|
||||
* @param {object} authz Identifier authorization
|
||||
* @returns {Promise<object>} Authorization
|
||||
*
|
||||
* @example Deactivate identifier authorization
|
||||
* ```js
|
||||
* const authz = { ... }; // Identifier authorization resolved from previously created order
|
||||
* const result = await client.deactivateAuthorization(authz);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async deactivateAuthorization(authz) {
|
||||
if (!authz.url) {
|
||||
throw new Error('Unable to deactivate identifier authorization, URL not found');
|
||||
}
|
||||
|
||||
const data = {
|
||||
status: 'deactivated'
|
||||
};
|
||||
|
||||
const resp = await this.api.updateAuthorization(authz.url, data);
|
||||
|
||||
/* Add URL to response */
|
||||
resp.data.url = authz.url;
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get key authorization for ACME challenge
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-8.1
|
||||
*
|
||||
* @param {object} challenge Challenge object returned by API
|
||||
* @returns {Promise<string>} Key authorization
|
||||
*
|
||||
* @example Get challenge key authorization
|
||||
* ```js
|
||||
* const challenge = { ... }; // Challenge from previously resolved identifier authorization
|
||||
* const key = await client.getChallengeKeyAuthorization(challenge);
|
||||
*
|
||||
* // Write key somewhere to satisfy challenge
|
||||
* ```
|
||||
*/
|
||||
|
||||
async getChallengeKeyAuthorization(challenge) {
|
||||
const jwk = this.http.getJwk();
|
||||
const keysum = createHash('sha256').update(JSON.stringify(jwk));
|
||||
const thumbprint = keysum.digest('base64url');
|
||||
const result = `${challenge.token}.${thumbprint}`;
|
||||
|
||||
/**
|
||||
* https://tools.ietf.org/html/rfc8555#section-8.3
|
||||
*/
|
||||
|
||||
if (challenge.type === 'http-01') {
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* https://tools.ietf.org/html/rfc8555#section-8.4
|
||||
* https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-01
|
||||
*/
|
||||
|
||||
if ((challenge.type === 'dns-01') || (challenge.type === 'tls-alpn-01')) {
|
||||
const shasum = createHash('sha256').update(result);
|
||||
return shasum.digest('base64url');
|
||||
}
|
||||
|
||||
throw new Error(`Unable to produce key authorization, unknown challenge type: ${challenge.type}`);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Verify that ACME challenge is satisfied
|
||||
*
|
||||
* @param {object} authz Identifier authorization
|
||||
* @param {object} challenge Authorization challenge
|
||||
* @returns {Promise}
|
||||
*
|
||||
* @example Verify satisfied ACME challenge
|
||||
* ```js
|
||||
* const authz = { ... }; // Identifier authorization
|
||||
* const challenge = { ... }; // Satisfied challenge
|
||||
* await client.verifyChallenge(authz, challenge);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async verifyChallenge(authz, challenge) {
|
||||
if (!authz.url || !challenge.url) {
|
||||
throw new Error('Unable to verify ACME challenge, URL not found');
|
||||
}
|
||||
|
||||
if (typeof verify[challenge.type] === 'undefined') {
|
||||
throw new Error(`Unable to verify ACME challenge, unknown type: ${challenge.type}`);
|
||||
}
|
||||
|
||||
const keyAuthorization = await this.getChallengeKeyAuthorization(challenge);
|
||||
|
||||
const verifyFn = async () => {
|
||||
await verify[challenge.type](authz, challenge, keyAuthorization);
|
||||
};
|
||||
|
||||
log('Waiting for ACME challenge verification', this.backoffOpts);
|
||||
return util.retry(verifyFn, this.backoffOpts);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Notify CA that challenge has been completed
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.5.1
|
||||
*
|
||||
* @param {object} challenge Challenge object returned by API
|
||||
* @returns {Promise<object>} Challenge
|
||||
*
|
||||
* @example Notify CA that challenge has been completed
|
||||
* ```js
|
||||
* const challenge = { ... }; // Satisfied challenge
|
||||
* const result = await client.completeChallenge(challenge);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async completeChallenge(challenge) {
|
||||
const resp = await this.api.completeChallenge(challenge.url, {});
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Wait for ACME provider to verify status on a order, authorization or challenge
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.5.1
|
||||
*
|
||||
* @param {object} item An order, authorization or challenge object
|
||||
* @returns {Promise<object>} Valid order, authorization or challenge
|
||||
*
|
||||
* @example Wait for valid challenge status
|
||||
* ```js
|
||||
* const challenge = { ... };
|
||||
* await client.waitForValidStatus(challenge);
|
||||
* ```
|
||||
*
|
||||
* @example Wait for valid authoriation status
|
||||
* ```js
|
||||
* const authz = { ... };
|
||||
* await client.waitForValidStatus(authz);
|
||||
* ```
|
||||
*
|
||||
* @example Wait for valid order status
|
||||
* ```js
|
||||
* const order = { ... };
|
||||
* await client.waitForValidStatus(order);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async waitForValidStatus(item) {
|
||||
if (!item.url) {
|
||||
throw new Error('Unable to verify status of item, URL not found');
|
||||
}
|
||||
|
||||
const verifyFn = async (abort) => {
|
||||
const resp = await this.api.apiRequest(item.url, null, [200]);
|
||||
|
||||
/* Verify status */
|
||||
log(`Item has status: ${resp.data.status}`);
|
||||
|
||||
if (invalidStates.includes(resp.data.status)) {
|
||||
abort();
|
||||
throw new Error(util.formatResponseError(resp));
|
||||
}
|
||||
else if (pendingStates.includes(resp.data.status)) {
|
||||
throw new Error('Operation is pending or processing');
|
||||
}
|
||||
else if (validStates.includes(resp.data.status)) {
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
throw new Error(`Unexpected item status: ${resp.data.status}`);
|
||||
};
|
||||
|
||||
log(`Waiting for valid status from: ${item.url}`, this.backoffOpts);
|
||||
return util.retry(verifyFn, this.backoffOpts);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get certificate from ACME order
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.4.2
|
||||
*
|
||||
* @param {object} order Order object
|
||||
* @param {string} [preferredChain] Indicate which certificate chain is preferred if a CA offers multiple, by exact issuer common name, default: `null`
|
||||
* @returns {Promise<string>} Certificate
|
||||
*
|
||||
* @example Get certificate
|
||||
* ```js
|
||||
* const order = { ... }; // Previously created order
|
||||
* const certificate = await client.getCertificate(order);
|
||||
* ```
|
||||
*
|
||||
* @example Get certificate with preferred chain
|
||||
* ```js
|
||||
* const order = { ... }; // Previously created order
|
||||
* const certificate = await client.getCertificate(order, 'DST Root CA X3');
|
||||
* ```
|
||||
*/
|
||||
|
||||
async getCertificate(order, preferredChain = null) {
|
||||
if (!validStates.includes(order.status)) {
|
||||
order = await this.waitForValidStatus(order);
|
||||
}
|
||||
|
||||
if (!order.certificate) {
|
||||
throw new Error('Unable to download certificate, URL not found');
|
||||
}
|
||||
|
||||
const resp = await this.api.apiRequest(order.certificate, null, [200]);
|
||||
|
||||
/* Handle alternate certificate chains */
|
||||
if (preferredChain && resp.headers.link) {
|
||||
const alternateLinks = util.parseLinkHeader(resp.headers.link);
|
||||
const alternates = await Promise.all(alternateLinks.map(async (link) => this.api.apiRequest(link, null, [200])));
|
||||
const certificates = [resp].concat(alternates).map((c) => c.data);
|
||||
|
||||
return util.findCertificateChainForIssuer(certificates, preferredChain);
|
||||
}
|
||||
|
||||
/* Return default certificate chain */
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Revoke certificate
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.6
|
||||
*
|
||||
* @param {buffer|string} cert PEM encoded certificate
|
||||
* @param {object} [data] Additional request data
|
||||
* @returns {Promise}
|
||||
*
|
||||
* @example Revoke certificate
|
||||
* ```js
|
||||
* const certificate = { ... }; // Previously created certificate
|
||||
* const result = await client.revokeCertificate(certificate);
|
||||
* ```
|
||||
*
|
||||
* @example Revoke certificate with reason
|
||||
* ```js
|
||||
* const certificate = { ... }; // Previously created certificate
|
||||
* const result = await client.revokeCertificate(certificate, {
|
||||
* reason: 4
|
||||
* });
|
||||
* ```
|
||||
*/
|
||||
|
||||
async revokeCertificate(cert, data = {}) {
|
||||
data.certificate = getPemBodyAsB64u(cert);
|
||||
const resp = await this.api.revokeCert(data);
|
||||
return resp.data;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Auto mode
|
||||
*
|
||||
* @param {object} opts
|
||||
* @param {buffer|string} opts.csr Certificate Signing Request
|
||||
* @param {function} opts.challengeCreateFn Function returning Promise triggered before completing ACME challenge
|
||||
* @param {function} opts.challengeRemoveFn Function returning Promise triggered after completing ACME challenge
|
||||
* @param {string} [opts.email] Account email address
|
||||
* @param {boolean} [opts.termsOfServiceAgreed] Agree to Terms of Service, default: `false`
|
||||
* @param {boolean} [opts.skipChallengeVerification] Skip internal challenge verification before notifying ACME provider, default: `false`
|
||||
* @param {string[]} [opts.challengePriority] Array defining challenge type priority, default: `['http-01', 'dns-01']`
|
||||
* @param {string} [opts.preferredChain] Indicate which certificate chain is preferred if a CA offers multiple, by exact issuer common name, default: `null`
|
||||
* @returns {Promise<string>} Certificate
|
||||
*
|
||||
* @example Order a certificate using auto mode
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
|
||||
* commonName: 'test.example.com'
|
||||
* });
|
||||
*
|
||||
* const certificate = await client.auto({
|
||||
* csr: certificateRequest,
|
||||
* email: 'test@example.com',
|
||||
* termsOfServiceAgreed: true,
|
||||
* challengeCreateFn: async (authz, challenge, keyAuthorization) => {
|
||||
* // Satisfy challenge here
|
||||
* },
|
||||
* challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
|
||||
* // Clean up challenge here
|
||||
* }
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Order a certificate using auto mode with preferred chain
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
|
||||
* commonName: 'test.example.com'
|
||||
* });
|
||||
*
|
||||
* const certificate = await client.auto({
|
||||
* csr: certificateRequest,
|
||||
* email: 'test@example.com',
|
||||
* termsOfServiceAgreed: true,
|
||||
* preferredChain: 'DST Root CA X3',
|
||||
* challengeCreateFn: async () => {},
|
||||
* challengeRemoveFn: async () => {}
|
||||
* });
|
||||
* ```
|
||||
*/
|
||||
|
||||
auto(opts) {
|
||||
return auto(this, opts);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/* Export client */
|
||||
module.exports = AcmeClient;
|
||||
@@ -0,0 +1,456 @@
|
||||
/**
|
||||
* Legacy node-forge crypto interface
|
||||
*
|
||||
* DEPRECATION WARNING: This crypto interface is deprecated and will be removed from acme-client in a future
|
||||
* major release. Please migrate to the new `acme.crypto` interface at your earliest convenience.
|
||||
*
|
||||
* @namespace forge
|
||||
*/
|
||||
|
||||
const net = require('net');
|
||||
const { promisify } = require('util');
|
||||
const forge = require('node-forge');
|
||||
|
||||
const generateKeyPair = promisify(forge.pki.rsa.generateKeyPair);
|
||||
|
||||
|
||||
/**
|
||||
* Attempt to parse forge object from PEM encoded string
|
||||
*
|
||||
* @private
|
||||
* @param {string} input PEM string
|
||||
* @return {object}
|
||||
*/
|
||||
|
||||
function forgeObjectFromPem(input) {
|
||||
const msg = forge.pem.decode(input)[0];
|
||||
let result;
|
||||
|
||||
switch (msg.type) {
|
||||
case 'PRIVATE KEY':
|
||||
case 'RSA PRIVATE KEY':
|
||||
result = forge.pki.privateKeyFromPem(input);
|
||||
break;
|
||||
|
||||
case 'PUBLIC KEY':
|
||||
case 'RSA PUBLIC KEY':
|
||||
result = forge.pki.publicKeyFromPem(input);
|
||||
break;
|
||||
|
||||
case 'CERTIFICATE':
|
||||
case 'X509 CERTIFICATE':
|
||||
case 'TRUSTED CERTIFICATE':
|
||||
result = forge.pki.certificateFromPem(input).publicKey;
|
||||
break;
|
||||
|
||||
case 'CERTIFICATE REQUEST':
|
||||
result = forge.pki.certificationRequestFromPem(input).publicKey;
|
||||
break;
|
||||
|
||||
default:
|
||||
throw new Error('Unable to detect forge message type');
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Parse domain names from a certificate or CSR
|
||||
*
|
||||
* @private
|
||||
* @param {object} obj Forge certificate or CSR
|
||||
* @returns {object} {commonName, altNames}
|
||||
*/
|
||||
|
||||
function parseDomains(obj) {
|
||||
let commonName = null;
|
||||
let altNames = [];
|
||||
let altNamesDict = [];
|
||||
|
||||
const commonNameObject = (obj.subject.attributes || []).find((a) => a.name === 'commonName');
|
||||
const rootAltNames = (obj.extensions || []).find((e) => 'altNames' in e);
|
||||
const rootExtensions = (obj.attributes || []).find((a) => 'extensions' in a);
|
||||
|
||||
if (rootAltNames && rootAltNames.altNames && rootAltNames.altNames.length) {
|
||||
altNamesDict = rootAltNames.altNames;
|
||||
} else if (rootExtensions && rootExtensions.extensions && rootExtensions.extensions.length) {
|
||||
const extAltNames = rootExtensions.extensions.find((e) => 'altNames' in e);
|
||||
|
||||
if (extAltNames && extAltNames.altNames && extAltNames.altNames.length) {
|
||||
altNamesDict = extAltNames.altNames;
|
||||
}
|
||||
}
|
||||
|
||||
if (commonNameObject) {
|
||||
commonName = commonNameObject.value;
|
||||
}
|
||||
|
||||
if (altNamesDict) {
|
||||
altNames = altNamesDict.map((a) => a.value);
|
||||
}
|
||||
|
||||
return {
|
||||
commonName,
|
||||
altNames
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Generate a private RSA key
|
||||
*
|
||||
* @param {number} [size] Size of the key, default: `2048`
|
||||
* @returns {Promise<buffer>} PEM encoded private RSA key
|
||||
*
|
||||
* @example Generate private RSA key
|
||||
* ```js
|
||||
* const privateKey = await acme.forge.createPrivateKey();
|
||||
* ```
|
||||
*
|
||||
* @example Private RSA key with defined size
|
||||
* ```js
|
||||
* const privateKey = await acme.forge.createPrivateKey(4096);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async function createPrivateKey(size = 2048) {
|
||||
const keyPair = await generateKeyPair({bits: size});
|
||||
// const privateKey = forge.pki.privateKeyToPem(keyPair.privateKey);
|
||||
|
||||
// convert a Forge private key to an ASN.1 RSAPrivateKey
|
||||
var rsaPrivateKey = forge.pki.privateKeyToAsn1(keyPair.privateKey);
|
||||
|
||||
// wrap an RSAPrivateKey ASN.1 object in a PKCS#8 ASN.1 PrivateKeyInfo
|
||||
var privateKeyInfo = forge.pki.wrapRsaPrivateKey(rsaPrivateKey);
|
||||
|
||||
// convert a PKCS#8 ASN.1 PrivateKeyInfo to PEM
|
||||
var pemKey = forge.pki.privateKeyInfoToPem(privateKeyInfo);
|
||||
return Buffer.from(pemKey);
|
||||
}
|
||||
|
||||
|
||||
exports.createPrivateKey = createPrivateKey;
|
||||
|
||||
|
||||
/**
|
||||
* Create public key from a private RSA key
|
||||
*
|
||||
* @param {buffer|string} key PEM encoded private RSA key
|
||||
* @returns {Promise<buffer>} PEM encoded public RSA key
|
||||
*
|
||||
* @example Create public key
|
||||
* ```js
|
||||
* const publicKey = await acme.forge.createPublicKey(privateKey);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.createPublicKey = async function (key) {
|
||||
const privateKey = forge.pki.privateKeyFromPem(key);
|
||||
const publicKey = forge.pki.rsa.setPublicKey(privateKey.n, privateKey.e);
|
||||
const pemKey = forge.pki.publicKeyToPem(publicKey);
|
||||
return Buffer.from(pemKey);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Parse body of PEM encoded object from buffer or string
|
||||
* If multiple objects are chained, the first body will be returned
|
||||
*
|
||||
* @param {buffer|string} str PEM encoded buffer or string
|
||||
* @returns {string} PEM body
|
||||
*/
|
||||
|
||||
exports.getPemBody = (str) => {
|
||||
const msg = forge.pem.decode(str)[0];
|
||||
return forge.util.encode64(msg.body);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Split chain of PEM encoded objects from buffer or string into array
|
||||
*
|
||||
* @param {buffer|string} str PEM encoded buffer or string
|
||||
* @returns {string[]} Array of PEM bodies
|
||||
*/
|
||||
|
||||
exports.splitPemChain = (str) => forge.pem.decode(str).map(forge.pem.encode);
|
||||
|
||||
|
||||
/**
|
||||
* Get modulus
|
||||
*
|
||||
* @param {buffer|string} input PEM encoded private key, certificate or CSR
|
||||
* @returns {Promise<buffer>} Modulus
|
||||
*
|
||||
* @example Get modulus
|
||||
* ```js
|
||||
* const m1 = await acme.forge.getModulus(privateKey);
|
||||
* const m2 = await acme.forge.getModulus(certificate);
|
||||
* const m3 = await acme.forge.getModulus(certificateRequest);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.getModulus = async function (input) {
|
||||
if (!Buffer.isBuffer(input)) {
|
||||
input = Buffer.from(input);
|
||||
}
|
||||
|
||||
const obj = forgeObjectFromPem(input);
|
||||
return Buffer.from(forge.util.hexToBytes(obj.n.toString(16)), 'binary');
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Get public exponent
|
||||
*
|
||||
* @param {buffer|string} input PEM encoded private key, certificate or CSR
|
||||
* @returns {Promise<buffer>} Exponent
|
||||
*
|
||||
* @example Get public exponent
|
||||
* ```js
|
||||
* const e1 = await acme.forge.getPublicExponent(privateKey);
|
||||
* const e2 = await acme.forge.getPublicExponent(certificate);
|
||||
* const e3 = await acme.forge.getPublicExponent(certificateRequest);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.getPublicExponent = async function (input) {
|
||||
if (!Buffer.isBuffer(input)) {
|
||||
input = Buffer.from(input);
|
||||
}
|
||||
|
||||
const obj = forgeObjectFromPem(input);
|
||||
return Buffer.from(forge.util.hexToBytes(obj.e.toString(16)), 'binary');
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Read domains from a Certificate Signing Request
|
||||
*
|
||||
* @param {buffer|string} csr PEM encoded Certificate Signing Request
|
||||
* @returns {Promise<object>} {commonName, altNames}
|
||||
*
|
||||
* @example Read Certificate Signing Request domains
|
||||
* ```js
|
||||
* const { commonName, altNames } = await acme.forge.readCsrDomains(certificateRequest);
|
||||
*
|
||||
* console.log(`Common name: ${commonName}`);
|
||||
* console.log(`Alt names: ${altNames.join(', ')}`);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.readCsrDomains = async function (csr) {
|
||||
if (!Buffer.isBuffer(csr)) {
|
||||
csr = Buffer.from(csr);
|
||||
}
|
||||
|
||||
const obj = forge.pki.certificationRequestFromPem(csr);
|
||||
return parseDomains(obj);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Read information from a certificate
|
||||
*
|
||||
* @param {buffer|string} cert PEM encoded certificate
|
||||
* @returns {Promise<object>} Certificate info
|
||||
*
|
||||
* @example Read certificate information
|
||||
* ```js
|
||||
* const info = await acme.forge.readCertificateInfo(certificate);
|
||||
* const { commonName, altNames } = info.domains;
|
||||
*
|
||||
* console.log(`Not after: ${info.notAfter}`);
|
||||
* console.log(`Not before: ${info.notBefore}`);
|
||||
*
|
||||
* console.log(`Common name: ${commonName}`);
|
||||
* console.log(`Alt names: ${altNames.join(', ')}`);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.readCertificateInfo = async function (cert) {
|
||||
if (!Buffer.isBuffer(cert)) {
|
||||
cert = Buffer.from(cert);
|
||||
}
|
||||
|
||||
const obj = forge.pki.certificateFromPem(cert);
|
||||
const issuerCn = (obj.issuer.attributes || []).find((a) => a.name === 'commonName');
|
||||
|
||||
return {
|
||||
issuer: {
|
||||
commonName: issuerCn ? issuerCn.value : null
|
||||
},
|
||||
domains: parseDomains(obj),
|
||||
notAfter: obj.validity.notAfter,
|
||||
notBefore: obj.validity.notBefore
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Determine ASN.1 type for CSR subject short name
|
||||
* Note: https://tools.ietf.org/html/rfc5280
|
||||
*
|
||||
* @private
|
||||
* @param {string} shortName CSR subject short name
|
||||
* @returns {forge.asn1.Type} ASN.1 type
|
||||
*/
|
||||
|
||||
function getCsrValueTagClass(shortName) {
|
||||
switch (shortName) {
|
||||
case 'C':
|
||||
return forge.asn1.Type.PRINTABLESTRING;
|
||||
case 'E':
|
||||
return forge.asn1.Type.IA5STRING;
|
||||
default:
|
||||
return forge.asn1.Type.UTF8;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create array of short names and values for Certificate Signing Request subjects
|
||||
*
|
||||
* @private
|
||||
* @param {object} subjectObj Key-value of short names and values
|
||||
* @returns {object[]} Certificate Signing Request subject array
|
||||
*/
|
||||
|
||||
function createCsrSubject(subjectObj) {
|
||||
return Object.entries(subjectObj).reduce((result, [shortName, value]) => {
|
||||
if (value) {
|
||||
const valueTagClass = getCsrValueTagClass(shortName);
|
||||
result.push({shortName, value, valueTagClass});
|
||||
}
|
||||
|
||||
return result;
|
||||
}, []);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create array of alt names for Certificate Signing Requests
|
||||
* Note: https://github.com/digitalbazaar/forge/blob/dfdde475677a8a25c851e33e8f81dca60d90cfb9/lib/x509.js#L1444-L1454
|
||||
*
|
||||
* @private
|
||||
* @param {string[]} altNames Alt names
|
||||
* @returns {object[]} Certificate Signing Request alt names array
|
||||
*/
|
||||
|
||||
function formatCsrAltNames(altNames) {
|
||||
return altNames.map((value) => {
|
||||
const type = net.isIP(value) ? 7 : 2;
|
||||
return {type, value};
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create a Certificate Signing Request
|
||||
*
|
||||
* @param {object} data
|
||||
* @param {number} [data.keySize] Size of newly created private key, default: `2048`
|
||||
* @param {string} [data.commonName]
|
||||
* @param {array} [data.altNames] default: `[]`
|
||||
* @param {string} [data.country]
|
||||
* @param {string} [data.state]
|
||||
* @param {string} [data.locality]
|
||||
* @param {string} [data.organization]
|
||||
* @param {string} [data.organizationUnit]
|
||||
* @param {string} [data.emailAddress]
|
||||
* @param {buffer|string} [key] CSR private key
|
||||
* @returns {Promise<buffer[]>} [privateKey, certificateSigningRequest]
|
||||
*
|
||||
* @example Create a Certificate Signing Request
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.forge.createCsr({
|
||||
* commonName: 'test.example.com'
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Certificate Signing Request with both common and alternative names
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.forge.createCsr({
|
||||
* keySize: 4096,
|
||||
* commonName: 'test.example.com',
|
||||
* altNames: ['foo.example.com', 'bar.example.com']
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Certificate Signing Request with additional information
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.forge.createCsr({
|
||||
* commonName: 'test.example.com',
|
||||
* country: 'US',
|
||||
* state: 'California',
|
||||
* locality: 'Los Angeles',
|
||||
* organization: 'The Company Inc.',
|
||||
* organizationUnit: 'IT Department',
|
||||
* emailAddress: 'contact@example.com'
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Certificate Signing Request with predefined private key
|
||||
* ```js
|
||||
* const certificateKey = await acme.forge.createPrivateKey();
|
||||
*
|
||||
* const [, certificateRequest] = await acme.forge.createCsr({
|
||||
* commonName: 'test.example.com'
|
||||
* }, certificateKey);
|
||||
*/
|
||||
|
||||
exports.createCsr = async function (data, key = null) {
|
||||
if (!key) {
|
||||
key = await createPrivateKey(data.keySize);
|
||||
} else if (!Buffer.isBuffer(key)) {
|
||||
key = Buffer.from(key);
|
||||
}
|
||||
|
||||
if (typeof data.altNames === 'undefined') {
|
||||
data.altNames = [];
|
||||
}
|
||||
|
||||
const csr = forge.pki.createCertificationRequest();
|
||||
|
||||
/* Public key */
|
||||
const privateKey = forge.pki.privateKeyFromPem(key);
|
||||
const publicKey = forge.pki.rsa.setPublicKey(privateKey.n, privateKey.e);
|
||||
csr.publicKey = publicKey;
|
||||
|
||||
/* Ensure subject common name is present in SAN - https://cabforum.org/wp-content/uploads/BRv1.2.3.pdf */
|
||||
if (data.commonName && !data.altNames.includes(data.commonName)) {
|
||||
data.altNames.unshift(data.commonName);
|
||||
}
|
||||
|
||||
/* Subject */
|
||||
const subject = createCsrSubject({
|
||||
CN: data.commonName,
|
||||
C: data.country,
|
||||
ST: data.state,
|
||||
L: data.locality,
|
||||
O: data.organization,
|
||||
OU: data.organizationUnit,
|
||||
E: data.emailAddress
|
||||
});
|
||||
|
||||
csr.setSubject(subject);
|
||||
|
||||
/* SAN extension */
|
||||
if (data.altNames.length) {
|
||||
csr.setAttributes([{
|
||||
name: 'extensionRequest',
|
||||
extensions: [{
|
||||
name: 'subjectAltName',
|
||||
altNames: formatCsrAltNames(data.altNames)
|
||||
}]
|
||||
}]);
|
||||
}
|
||||
|
||||
/* Sign CSR using SHA-256 */
|
||||
csr.sign(privateKey, forge.md.sha256.create());
|
||||
|
||||
/* Done */
|
||||
const pemCsr = forge.pki.certificationRequestToPem(csr);
|
||||
return [key, Buffer.from(pemCsr)];
|
||||
};
|
||||
@@ -0,0 +1,526 @@
|
||||
/**
|
||||
* Native Node.js crypto interface
|
||||
*
|
||||
* @namespace crypto
|
||||
*/
|
||||
|
||||
const net = require('net');
|
||||
const { promisify } = require('util');
|
||||
const crypto = require('crypto');
|
||||
const jsrsasign = require('jsrsasign');
|
||||
|
||||
const generateKeyPair = promisify(crypto.generateKeyPair);
|
||||
|
||||
|
||||
/**
|
||||
* Determine key type and info by attempting to derive public key
|
||||
*
|
||||
* @private
|
||||
* @param {buffer|string} keyPem PEM encoded private or public key
|
||||
* @returns {object}
|
||||
*/
|
||||
|
||||
function getKeyInfo(keyPem) {
|
||||
const result = {
|
||||
isRSA: false,
|
||||
isECDSA: false,
|
||||
signatureAlgorithm: null,
|
||||
publicKey: crypto.createPublicKey(keyPem)
|
||||
};
|
||||
|
||||
if (result.publicKey.asymmetricKeyType === 'rsa') {
|
||||
result.isRSA = true;
|
||||
result.signatureAlgorithm = 'SHA256withRSA';
|
||||
}
|
||||
else if (result.publicKey.asymmetricKeyType === 'ec') {
|
||||
result.isECDSA = true;
|
||||
result.signatureAlgorithm = 'SHA256withECDSA';
|
||||
}
|
||||
else {
|
||||
throw new Error('Unable to parse key information, unknown format');
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Generate a private RSA key
|
||||
*
|
||||
* @param {number} [modulusLength] Size of the keys modulus in bits, default: `2048`
|
||||
* @returns {Promise<buffer>} PEM encoded private RSA key
|
||||
*
|
||||
* @example Generate private RSA key
|
||||
* ```js
|
||||
* const privateKey = await acme.crypto.createPrivateRsaKey();
|
||||
* ```
|
||||
*
|
||||
* @example Private RSA key with modulus size 4096
|
||||
* ```js
|
||||
* const privateKey = await acme.crypto.createPrivateRsaKey(4096);
|
||||
* ```
|
||||
*/
|
||||
|
||||
async function createPrivateRsaKey(modulusLength = 2048) {
|
||||
const pair = await generateKeyPair('rsa', {
|
||||
modulusLength,
|
||||
privateKeyEncoding: {
|
||||
type: 'pkcs8',
|
||||
format: 'pem'
|
||||
}
|
||||
});
|
||||
|
||||
return Buffer.from(pair.privateKey);
|
||||
}
|
||||
|
||||
exports.createPrivateRsaKey = createPrivateRsaKey;
|
||||
|
||||
|
||||
/**
|
||||
* Alias of `createPrivateRsaKey()`
|
||||
*
|
||||
* @function
|
||||
*/
|
||||
|
||||
exports.createPrivateKey = createPrivateRsaKey;
|
||||
|
||||
|
||||
/**
|
||||
* Generate a private ECDSA key
|
||||
*
|
||||
* @param {string} [namedCurve] ECDSA curve name (P-256, P-384 or P-521), default `P-256`
|
||||
* @returns {Promise<buffer>} PEM encoded private ECDSA key
|
||||
*
|
||||
* @example Generate private ECDSA key
|
||||
* ```js
|
||||
* const privateKey = await acme.crypto.createPrivateEcdsaKey();
|
||||
* ```
|
||||
*
|
||||
* @example Private ECDSA key using P-384 curve
|
||||
* ```js
|
||||
* const privateKey = await acme.crypto.createPrivateEcdsaKey('P-384');
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.createPrivateEcdsaKey = async (namedCurve = 'P-256') => {
|
||||
const pair = await generateKeyPair('ec', {
|
||||
namedCurve,
|
||||
privateKeyEncoding: {
|
||||
type: 'pkcs8',
|
||||
format: 'pem'
|
||||
}
|
||||
});
|
||||
|
||||
return Buffer.from(pair.privateKey);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Get a public key derived from a RSA or ECDSA key
|
||||
*
|
||||
* @param {buffer|string} keyPem PEM encoded private or public key
|
||||
* @returns {buffer} PEM encoded public key
|
||||
*
|
||||
* @example Get public key
|
||||
* ```js
|
||||
* const publicKey = acme.crypto.getPublicKey(privateKey);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.getPublicKey = (keyPem) => {
|
||||
const info = getKeyInfo(keyPem);
|
||||
|
||||
const publicKey = info.publicKey.export({
|
||||
type: info.isECDSA ? 'spki' : 'pkcs1',
|
||||
format: 'pem'
|
||||
});
|
||||
|
||||
return Buffer.from(publicKey);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Get a JSON Web Key derived from a RSA or ECDSA key
|
||||
*
|
||||
* https://datatracker.ietf.org/doc/html/rfc7517
|
||||
*
|
||||
* @param {buffer|string} keyPem PEM encoded private or public key
|
||||
* @returns {object} JSON Web Key
|
||||
*
|
||||
* @example Get JWK
|
||||
* ```js
|
||||
* const jwk = acme.crypto.getJwk(privateKey);
|
||||
* ```
|
||||
*/
|
||||
|
||||
function getJwk(keyPem) {
|
||||
const jwk = crypto.createPublicKey(keyPem).export({
|
||||
format: 'jwk'
|
||||
});
|
||||
|
||||
/* Sort keys */
|
||||
return Object.keys(jwk).sort().reduce((result, k) => {
|
||||
result[k] = jwk[k];
|
||||
return result;
|
||||
}, {});
|
||||
}
|
||||
|
||||
exports.getJwk = getJwk;
|
||||
|
||||
|
||||
/**
|
||||
* Fix missing support for NIST curve names in jsrsasign
|
||||
*
|
||||
* @private
|
||||
* @param {string} crv NIST curve name
|
||||
* @returns {string} SECG curve name
|
||||
*/
|
||||
|
||||
function convertNistCurveNameToSecg(nistName) {
|
||||
switch (nistName) {
|
||||
case 'P-256':
|
||||
return 'secp256r1';
|
||||
case 'P-384':
|
||||
return 'secp384r1';
|
||||
case 'P-521':
|
||||
return 'secp521r1';
|
||||
default:
|
||||
return nistName;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Split chain of PEM encoded objects from string into array
|
||||
*
|
||||
* @param {buffer|string} chainPem PEM encoded object chain
|
||||
* @returns {array} Array of PEM objects including headers
|
||||
*/
|
||||
|
||||
function splitPemChain(chainPem) {
|
||||
if (Buffer.isBuffer(chainPem)) {
|
||||
chainPem = chainPem.toString();
|
||||
}
|
||||
|
||||
return chainPem
|
||||
/* Split chain into chunks, starting at every header */
|
||||
.split(/\s*(?=-----BEGIN [A-Z0-9- ]+-----\r?\n?)/g)
|
||||
/* Match header, PEM body and footer */
|
||||
.map((pem) => pem.match(/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\S\s]+)\r?\n?-----END \1-----/))
|
||||
/* Filter out non-matches or empty bodies */
|
||||
.filter((pem) => pem && pem[2] && pem[2].replace(/[\r\n]+/g, '').trim())
|
||||
/* Decode to hex, and back to PEM for formatting etc */
|
||||
.map(([pem, header]) => jsrsasign.hextopem(jsrsasign.pemtohex(pem, header), header));
|
||||
}
|
||||
|
||||
exports.splitPemChain = splitPemChain;
|
||||
|
||||
|
||||
/**
|
||||
* Parse body of PEM encoded object and return a Base64URL string
|
||||
* If multiple objects are chained, the first body will be returned
|
||||
*
|
||||
* @param {buffer|string} pem PEM encoded chain or object
|
||||
* @returns {string} Base64URL-encoded body
|
||||
*/
|
||||
|
||||
exports.getPemBodyAsB64u = (pem) => {
|
||||
const chain = splitPemChain(pem);
|
||||
|
||||
if (!chain.length) {
|
||||
throw new Error('Unable to parse PEM body from string');
|
||||
}
|
||||
|
||||
/* First object, hex and back to b64 without new lines */
|
||||
return jsrsasign.hextob64u(jsrsasign.pemtohex(chain[0]));
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Parse common name from a subject object
|
||||
*
|
||||
* @private
|
||||
* @param {object} subj Subject returned from jsrsasign
|
||||
* @returns {string} Common name value
|
||||
*/
|
||||
|
||||
function parseCommonName(subj) {
|
||||
const subjectArr = (subj && subj.array) ? subj.array : [];
|
||||
const cnArr = subjectArr.find((s) => (s[0] && s[0].type && s[0].value && (s[0].type === 'CN')));
|
||||
return (cnArr && cnArr.length && cnArr[0].value) ? cnArr[0].value : null;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Parse domains from a certificate or CSR
|
||||
*
|
||||
* @private
|
||||
* @param {object} params Certificate or CSR params returned from jsrsasign
|
||||
* @returns {object} {commonName, altNames}
|
||||
*/
|
||||
|
||||
function parseDomains(params) {
|
||||
const commonName = parseCommonName(params.subject);
|
||||
const extensionArr = (params.ext || params.extreq || []);
|
||||
let altNames = [];
|
||||
|
||||
if (extensionArr && extensionArr.length) {
|
||||
const altNameExt = extensionArr.find((e) => (e.extname && (e.extname === 'subjectAltName')));
|
||||
const altNameArr = (altNameExt && altNameExt.array && altNameExt.array.length) ? altNameExt.array : [];
|
||||
altNames = altNameArr.map((a) => Object.values(a)[0] || null).filter((a) => a);
|
||||
}
|
||||
|
||||
return {
|
||||
commonName,
|
||||
altNames
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Read domains from a Certificate Signing Request
|
||||
*
|
||||
* @param {buffer|string} csrPem PEM encoded Certificate Signing Request
|
||||
* @returns {object} {commonName, altNames}
|
||||
*
|
||||
* @example Read Certificate Signing Request domains
|
||||
* ```js
|
||||
* const { commonName, altNames } = acme.crypto.readCsrDomains(certificateRequest);
|
||||
*
|
||||
* console.log(`Common name: ${commonName}`);
|
||||
* console.log(`Alt names: ${altNames.join(', ')}`);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.readCsrDomains = (csrPem) => {
|
||||
if (Buffer.isBuffer(csrPem)) {
|
||||
csrPem = csrPem.toString();
|
||||
}
|
||||
|
||||
/* Parse CSR */
|
||||
const params = jsrsasign.KJUR.asn1.csr.CSRUtil.getParam(csrPem);
|
||||
return parseDomains(params);
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Read information from a certificate
|
||||
* If multiple certificates are chained, the first will be read
|
||||
*
|
||||
* @param {buffer|string} certPem PEM encoded certificate or chain
|
||||
* @returns {object} Certificate info
|
||||
*
|
||||
* @example Read certificate information
|
||||
* ```js
|
||||
* const info = acme.crypto.readCertificateInfo(certificate);
|
||||
* const { commonName, altNames } = info.domains;
|
||||
*
|
||||
* console.log(`Not after: ${info.notAfter}`);
|
||||
* console.log(`Not before: ${info.notBefore}`);
|
||||
*
|
||||
* console.log(`Common name: ${commonName}`);
|
||||
* console.log(`Alt names: ${altNames.join(', ')}`);
|
||||
* ```
|
||||
*/
|
||||
|
||||
exports.readCertificateInfo = (certPem) => {
|
||||
const chain = splitPemChain(certPem);
|
||||
|
||||
if (!chain.length) {
|
||||
throw new Error('Unable to parse PEM body from string');
|
||||
}
|
||||
|
||||
/* Parse certificate */
|
||||
const obj = new jsrsasign.X509();
|
||||
obj.readCertPEM(chain[0]);
|
||||
const params = obj.getParam();
|
||||
|
||||
return {
|
||||
issuer: {
|
||||
commonName: parseCommonName(params.issuer)
|
||||
},
|
||||
domains: parseDomains(params),
|
||||
notBefore: jsrsasign.zulutodate(params.notbefore),
|
||||
notAfter: jsrsasign.zulutodate(params.notafter)
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Determine ASN.1 character string type for CSR subject field
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc5280
|
||||
* https://github.com/kjur/jsrsasign/blob/2613c64559768b91dde9793dfa318feacb7c3b8a/src/x509-1.1.js#L2404-L2412
|
||||
* https://github.com/kjur/jsrsasign/blob/2613c64559768b91dde9793dfa318feacb7c3b8a/src/asn1x509-1.0.js#L3526-L3535
|
||||
*
|
||||
* @private
|
||||
* @param {string} field CSR subject field
|
||||
* @returns {string} ASN.1 jsrsasign character string type
|
||||
*/
|
||||
|
||||
function getCsrAsn1CharStringType(field) {
|
||||
switch (field) {
|
||||
case 'C':
|
||||
return 'prn';
|
||||
case 'E':
|
||||
return 'ia5';
|
||||
default:
|
||||
return 'utf8';
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create array of subject fields for a Certificate Signing Request
|
||||
*
|
||||
* @private
|
||||
* @param {object} input Key-value of subject fields
|
||||
* @returns {object[]} Certificate Signing Request subject array
|
||||
*/
|
||||
|
||||
function createCsrSubject(input) {
|
||||
return Object.entries(input).reduce((result, [type, value]) => {
|
||||
if (value) {
|
||||
const ds = getCsrAsn1CharStringType(type);
|
||||
result.push([{ type, value, ds }]);
|
||||
}
|
||||
|
||||
return result;
|
||||
}, []);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create array of alt names for Certificate Signing Requests
|
||||
*
|
||||
* https://github.com/kjur/jsrsasign/blob/3edc0070846922daea98d9588978e91d855577ec/src/x509-1.1.js#L1355-L1410
|
||||
*
|
||||
* @private
|
||||
* @param {string[]} altNames Array of alt names
|
||||
* @returns {object[]} Certificate Signing Request alt names array
|
||||
*/
|
||||
|
||||
function formatCsrAltNames(altNames) {
|
||||
return altNames.map((value) => {
|
||||
const key = net.isIP(value) ? 'ip' : 'dns';
|
||||
return { [key]: value };
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create a Certificate Signing Request
|
||||
*
|
||||
* @param {object} data
|
||||
* @param {number} [data.keySize] Size of newly created RSA private key modulus in bits, default: `2048`
|
||||
* @param {string} [data.commonName] FQDN of your server
|
||||
* @param {array} [data.altNames] SAN (Subject Alternative Names), default: `[]`
|
||||
* @param {string} [data.country] 2 letter country code
|
||||
* @param {string} [data.state] State or province
|
||||
* @param {string} [data.locality] City
|
||||
* @param {string} [data.organization] Organization name
|
||||
* @param {string} [data.organizationUnit] Organizational unit name
|
||||
* @param {string} [data.emailAddress] Email address
|
||||
* @param {string} [keyPem] PEM encoded CSR private key
|
||||
* @returns {Promise<buffer[]>} [privateKey, certificateSigningRequest]
|
||||
*
|
||||
* @example Create a Certificate Signing Request
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
|
||||
* commonName: 'test.example.com'
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Certificate Signing Request with both common and alternative names
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
|
||||
* keySize: 4096,
|
||||
* commonName: 'test.example.com',
|
||||
* altNames: ['foo.example.com', 'bar.example.com']
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Certificate Signing Request with additional information
|
||||
* ```js
|
||||
* const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
|
||||
* commonName: 'test.example.com',
|
||||
* country: 'US',
|
||||
* state: 'California',
|
||||
* locality: 'Los Angeles',
|
||||
* organization: 'The Company Inc.',
|
||||
* organizationUnit: 'IT Department',
|
||||
* emailAddress: 'contact@example.com'
|
||||
* });
|
||||
* ```
|
||||
*
|
||||
* @example Certificate Signing Request with ECDSA private key
|
||||
* ```js
|
||||
* const certificateKey = await acme.crypto.createPrivateEcdsaKey();
|
||||
*
|
||||
* const [, certificateRequest] = await acme.crypto.createCsr({
|
||||
* commonName: 'test.example.com'
|
||||
* }, certificateKey);
|
||||
*/
|
||||
|
||||
exports.createCsr = async (data, keyPem = null) => {
|
||||
if (!keyPem) {
|
||||
keyPem = await createPrivateRsaKey(data.keySize);
|
||||
}
|
||||
else if (!Buffer.isBuffer(keyPem)) {
|
||||
keyPem = Buffer.from(keyPem);
|
||||
}
|
||||
|
||||
if (typeof data.altNames === 'undefined') {
|
||||
data.altNames = [];
|
||||
}
|
||||
|
||||
/* Get key info and JWK */
|
||||
const info = getKeyInfo(keyPem);
|
||||
const jwk = getJwk(keyPem);
|
||||
const extensionRequests = [];
|
||||
|
||||
/* Missing support for NIST curve names in jsrsasign - https://github.com/kjur/jsrsasign/blob/master/src/asn1x509-1.0.js#L4388-L4393 */
|
||||
if (jwk.crv && (jwk.kty === 'EC')) {
|
||||
jwk.crv = convertNistCurveNameToSecg(jwk.crv);
|
||||
}
|
||||
|
||||
/* Ensure subject common name is present in SAN - https://cabforum.org/wp-content/uploads/BRv1.2.3.pdf */
|
||||
if (data.commonName && !data.altNames.includes(data.commonName)) {
|
||||
data.altNames.unshift(data.commonName);
|
||||
}
|
||||
|
||||
/* Subject */
|
||||
const subject = createCsrSubject({
|
||||
CN: data.commonName,
|
||||
C: data.country,
|
||||
ST: data.state,
|
||||
L: data.locality,
|
||||
O: data.organization,
|
||||
OU: data.organizationUnit,
|
||||
E: data.emailAddress
|
||||
});
|
||||
|
||||
/* SAN extension */
|
||||
if (data.altNames.length) {
|
||||
extensionRequests.push({
|
||||
extname: 'subjectAltName',
|
||||
array: formatCsrAltNames(data.altNames)
|
||||
});
|
||||
}
|
||||
|
||||
/* Create CSR */
|
||||
const csr = new jsrsasign.KJUR.asn1.csr.CertificationRequest({
|
||||
subject: { array: subject },
|
||||
sigalg: info.signatureAlgorithm,
|
||||
sbjprvkey: keyPem.toString(),
|
||||
sbjpubkey: jwk,
|
||||
extreq: extensionRequests
|
||||
});
|
||||
|
||||
/* Sign CSR, get PEM */
|
||||
csr.sign();
|
||||
const pem = csr.getPEM();
|
||||
|
||||
/* Done */
|
||||
return [keyPem, Buffer.from(pem)];
|
||||
};
|
||||
@@ -0,0 +1,318 @@
|
||||
/**
|
||||
* ACME HTTP client
|
||||
*/
|
||||
|
||||
const { createHmac, createSign, constants: { RSA_PKCS1_PADDING } } = require('crypto');
|
||||
const { getJwk } = require('./crypto');
|
||||
const { log } = require('./logger');
|
||||
const axios = require('./axios');
|
||||
|
||||
|
||||
/**
|
||||
* ACME HTTP client
|
||||
*
|
||||
* @class
|
||||
* @param {string} directoryUrl ACME directory URL
|
||||
* @param {buffer} accountKey PEM encoded account private key
|
||||
* @param {object} [opts.externalAccountBinding]
|
||||
* @param {string} [opts.externalAccountBinding.kid] External account binding KID
|
||||
* @param {string} [opts.externalAccountBinding.hmacKey] External account binding HMAC key
|
||||
*/
|
||||
|
||||
class HttpClient {
|
||||
constructor(directoryUrl, accountKey, externalAccountBinding = {}) {
|
||||
this.directoryUrl = directoryUrl;
|
||||
this.accountKey = accountKey;
|
||||
this.externalAccountBinding = externalAccountBinding;
|
||||
|
||||
this.maxBadNonceRetries = 5;
|
||||
this.directory = null;
|
||||
this.jwk = null;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* HTTP request
|
||||
*
|
||||
* @param {string} url HTTP URL
|
||||
* @param {string} method HTTP method
|
||||
* @param {object} [opts] Request options
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
async request(url, method, opts = {}) {
|
||||
opts.url = url;
|
||||
opts.method = method;
|
||||
opts.validateStatus = null;
|
||||
|
||||
/* Headers */
|
||||
if (typeof opts.headers === 'undefined') {
|
||||
opts.headers = {};
|
||||
}
|
||||
|
||||
opts.headers['Content-Type'] = 'application/jose+json';
|
||||
|
||||
/* Request */
|
||||
log(`HTTP request: ${method} ${url}`);
|
||||
const resp = await axios.request(opts);
|
||||
|
||||
log(`RESP ${resp.status} ${method} ${url}`);
|
||||
return resp;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Ensure provider directory exists
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.1.1
|
||||
*
|
||||
* @returns {Promise}
|
||||
*/
|
||||
|
||||
async getDirectory() {
|
||||
if (!this.directory) {
|
||||
const resp = await this.request(this.directoryUrl, 'get');
|
||||
|
||||
if (resp.status >= 400) {
|
||||
throw new Error(`Attempting to read ACME directory returned error ${resp.status}: ${this.directoryUrl}`);
|
||||
}
|
||||
|
||||
if (!resp.data) {
|
||||
throw new Error('Attempting to read ACME directory returned no data');
|
||||
}
|
||||
|
||||
this.directory = resp.data;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get JSON Web Key
|
||||
*
|
||||
* @returns {object} JSON Web Key
|
||||
*/
|
||||
|
||||
getJwk() {
|
||||
if (!this.jwk) {
|
||||
this.jwk = getJwk(this.accountKey);
|
||||
}
|
||||
|
||||
return this.jwk;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get nonce from directory API endpoint
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-7.2
|
||||
*
|
||||
* @returns {Promise<string>} nonce
|
||||
*/
|
||||
|
||||
async getNonce() {
|
||||
const url = await this.getResourceUrl('newNonce');
|
||||
const resp = await this.request(url, 'head');
|
||||
|
||||
if (!resp.headers['replay-nonce']) {
|
||||
throw new Error('Failed to get nonce from ACME provider');
|
||||
}
|
||||
|
||||
return resp.headers['replay-nonce'];
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get URL for a directory resource
|
||||
*
|
||||
* @param {string} resource API resource name
|
||||
* @returns {Promise<string>} URL
|
||||
*/
|
||||
|
||||
async getResourceUrl(resource) {
|
||||
await this.getDirectory();
|
||||
|
||||
if (!this.directory[resource]) {
|
||||
throw new Error(`Unable to locate API resource URL in ACME directory: "${resource}"`);
|
||||
}
|
||||
|
||||
return this.directory[resource];
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get directory meta field
|
||||
*
|
||||
* @param {string} field Meta field name
|
||||
* @returns {Promise<string|null>} Meta field value
|
||||
*/
|
||||
|
||||
async getMetaField(field) {
|
||||
await this.getDirectory();
|
||||
|
||||
if (('meta' in this.directory) && (field in this.directory.meta)) {
|
||||
return this.directory.meta[field];
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Prepare HTTP request body for signature
|
||||
*
|
||||
* @param {string} alg JWS algorithm
|
||||
* @param {string} url Request URL
|
||||
* @param {object} [payload] Request payload
|
||||
* @param {object} [opts]
|
||||
* @param {string} [opts.nonce] JWS anti-replay nonce
|
||||
* @param {string} [opts.kid] JWS KID
|
||||
* @returns {object} Signed HTTP request body
|
||||
*/
|
||||
|
||||
prepareSignedBody(alg, url, payload = null, { nonce = null, kid = null } = {}) {
|
||||
const header = { alg, url };
|
||||
|
||||
/* Nonce */
|
||||
if (nonce) {
|
||||
log(`Using nonce: ${nonce}`);
|
||||
header.nonce = nonce;
|
||||
}
|
||||
|
||||
/* KID or JWK */
|
||||
if (kid) {
|
||||
header.kid = kid;
|
||||
}
|
||||
else {
|
||||
header.jwk = this.getJwk();
|
||||
}
|
||||
|
||||
/* Body */
|
||||
return {
|
||||
payload: payload ? Buffer.from(JSON.stringify(payload)).toString('base64url') : '',
|
||||
protected: Buffer.from(JSON.stringify(header)).toString('base64url')
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create JWS HTTP request body using HMAC
|
||||
*
|
||||
* @param {string} hmacKey HMAC key
|
||||
* @param {string} url Request URL
|
||||
* @param {object} [payload] Request payload
|
||||
* @param {object} [opts]
|
||||
* @param {string} [opts.nonce] JWS anti-replay nonce
|
||||
* @param {string} [opts.kid] JWS KID
|
||||
* @returns {object} Signed HMAC request body
|
||||
*/
|
||||
|
||||
createSignedHmacBody(hmacKey, url, payload = null, { nonce = null, kid = null } = {}) {
|
||||
const result = this.prepareSignedBody('HS256', url, payload, { nonce, kid });
|
||||
|
||||
/* Signature */
|
||||
const signer = createHmac('SHA256', Buffer.from(hmacKey, 'base64')).update(`${result.protected}.${result.payload}`, 'utf8');
|
||||
result.signature = signer.digest().toString('base64url');
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Create JWS HTTP request body using RSA or ECC
|
||||
*
|
||||
* https://datatracker.ietf.org/doc/html/rfc7515
|
||||
*
|
||||
* @param {string} url Request URL
|
||||
* @param {object} [payload] Request payload
|
||||
* @param {object} [opts]
|
||||
* @param {string} [opts.nonce] JWS nonce
|
||||
* @param {string} [opts.kid] JWS KID
|
||||
* @returns {object} JWS request body
|
||||
*/
|
||||
|
||||
createSignedBody(url, payload = null, { nonce = null, kid = null } = {}) {
|
||||
const jwk = this.getJwk();
|
||||
let headerAlg = 'RS256';
|
||||
let signerAlg = 'SHA256';
|
||||
|
||||
/* https://datatracker.ietf.org/doc/html/rfc7518#section-3.1 */
|
||||
if (jwk.crv && (jwk.kty === 'EC')) {
|
||||
headerAlg = 'ES256';
|
||||
|
||||
if (jwk.crv === 'P-384') {
|
||||
headerAlg = 'ES384';
|
||||
signerAlg = 'SHA384';
|
||||
}
|
||||
else if (jwk.crv === 'P-521') {
|
||||
headerAlg = 'ES512';
|
||||
signerAlg = 'SHA512';
|
||||
}
|
||||
}
|
||||
|
||||
/* Prepare body and signer */
|
||||
const result = this.prepareSignedBody(headerAlg, url, payload, { nonce, kid });
|
||||
const signer = createSign(signerAlg).update(`${result.protected}.${result.payload}`, 'utf8');
|
||||
|
||||
/* Signature - https://stackoverflow.com/questions/39554165 */
|
||||
result.signature = signer.sign({
|
||||
key: this.accountKey,
|
||||
padding: RSA_PKCS1_PADDING,
|
||||
dsaEncoding: 'ieee-p1363'
|
||||
}, 'base64url');
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Signed HTTP request
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-6.2
|
||||
*
|
||||
* @param {string} url Request URL
|
||||
* @param {object} payload Request payload
|
||||
* @param {object} [opts]
|
||||
* @param {string} [opts.kid] JWS KID
|
||||
* @param {string} [opts.nonce] JWS anti-replay nonce
|
||||
* @param {boolean} [opts.includeExternalAccountBinding] Include EAB in request
|
||||
* @param {number} [attempts] Request attempt counter
|
||||
* @returns {Promise<object>} HTTP response
|
||||
*/
|
||||
|
||||
async signedRequest(url, payload, { kid = null, nonce = null, includeExternalAccountBinding = false } = {}, attempts = 0) {
|
||||
if (!nonce) {
|
||||
nonce = await this.getNonce();
|
||||
}
|
||||
|
||||
/* External account binding */
|
||||
if (includeExternalAccountBinding && this.externalAccountBinding) {
|
||||
if (this.externalAccountBinding.kid && this.externalAccountBinding.hmacKey) {
|
||||
const jwk = this.getJwk();
|
||||
const eabKid = this.externalAccountBinding.kid;
|
||||
const eabHmacKey = this.externalAccountBinding.hmacKey;
|
||||
|
||||
payload.externalAccountBinding = this.createSignedHmacBody(eabHmacKey, url, jwk, { kid: eabKid });
|
||||
}
|
||||
}
|
||||
|
||||
/* Sign body and send request */
|
||||
const data = this.createSignedBody(url, payload, { nonce, kid });
|
||||
const resp = await this.request(url, 'post', { data });
|
||||
|
||||
/* Retry on bad nonce - https://tools.ietf.org/html/draft-ietf-acme-acme-10#section-6.4 */
|
||||
if (resp.data && resp.data.type && (resp.status === 400) && (resp.data.type === 'urn:ietf:params:acme:error:badNonce') && (attempts < this.maxBadNonceRetries)) {
|
||||
nonce = resp.headers['replay-nonce'] || null;
|
||||
attempts += 1;
|
||||
|
||||
log(`Caught invalid nonce error, retrying (${attempts}/${this.maxBadNonceRetries}) signed request to: ${url}`);
|
||||
return this.signedRequest(url, payload, { kid, nonce, includeExternalAccountBinding }, attempts);
|
||||
}
|
||||
|
||||
/* Return response */
|
||||
return resp;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/* Export client */
|
||||
module.exports = HttpClient;
|
||||
@@ -0,0 +1,46 @@
|
||||
/**
|
||||
* acme-client
|
||||
*/
|
||||
|
||||
exports.Client = require('./client');
|
||||
|
||||
|
||||
/**
|
||||
* Directory URLs
|
||||
*/
|
||||
|
||||
exports.directory = {
|
||||
buypass: {
|
||||
staging: 'https://api.test4.buypass.no/acme/directory',
|
||||
production: 'https://api.buypass.com/acme/directory'
|
||||
},
|
||||
letsencrypt: {
|
||||
staging: 'https://acme-staging-v02.api.letsencrypt.org/directory',
|
||||
production: 'https://acme-v02.api.letsencrypt.org/directory'
|
||||
},
|
||||
zerossl: {
|
||||
production: 'https://acme.zerossl.com/v2/DV90'
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Crypto
|
||||
*/
|
||||
|
||||
exports.crypto = require('./crypto');
|
||||
exports.forge = require('./crypto/forge');
|
||||
|
||||
|
||||
/**
|
||||
* Axios
|
||||
*/
|
||||
|
||||
exports.axios = require('./axios');
|
||||
|
||||
|
||||
/**
|
||||
* Logger
|
||||
*/
|
||||
|
||||
exports.setLogger = require('./logger').setLogger;
|
||||
@@ -0,0 +1,30 @@
|
||||
/**
|
||||
* ACME logger
|
||||
*/
|
||||
|
||||
const debug = require('debug')('acme-client');
|
||||
|
||||
let logger = () => {};
|
||||
|
||||
|
||||
/**
|
||||
* Set logger function
|
||||
*
|
||||
* @param {function} fn Logger function
|
||||
*/
|
||||
|
||||
exports.setLogger = (fn) => {
|
||||
logger = fn;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* Log message
|
||||
*
|
||||
* @param {string} Message
|
||||
*/
|
||||
|
||||
exports.log = (msg) => {
|
||||
debug(msg);
|
||||
logger(msg);
|
||||
};
|
||||
@@ -0,0 +1,258 @@
|
||||
/**
|
||||
* Utility methods
|
||||
*/
|
||||
|
||||
const dns = require('dns').promises;
|
||||
const { readCertificateInfo, splitPemChain } = require('./crypto');
|
||||
const { log } = require('./logger');
|
||||
|
||||
|
||||
/**
|
||||
* Exponential backoff
|
||||
*
|
||||
* https://github.com/mokesmokes/backo
|
||||
*
|
||||
* @class
|
||||
* @param {object} [opts]
|
||||
* @param {number} [opts.min] Minimum backoff duration in ms
|
||||
* @param {number} [opts.max] Maximum backoff duration in ms
|
||||
*/
|
||||
|
||||
class Backoff {
|
||||
constructor({ min = 100, max = 10000 } = {}) {
|
||||
this.min = min;
|
||||
this.max = max;
|
||||
this.attempts = 0;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get backoff duration
|
||||
*
|
||||
* @returns {number} Backoff duration in ms
|
||||
*/
|
||||
|
||||
duration() {
|
||||
const ms = this.min * (2 ** this.attempts);
|
||||
this.attempts += 1;
|
||||
return Math.min(ms, this.max);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Retry promise
|
||||
*
|
||||
* @param {function} fn Function returning promise that should be retried
|
||||
* @param {number} attempts Maximum number of attempts
|
||||
* @param {Backoff} backoff Backoff instance
|
||||
* @returns {Promise}
|
||||
*/
|
||||
|
||||
async function retryPromise(fn, attempts, backoff) {
|
||||
let aborted = false;
|
||||
|
||||
try {
|
||||
const data = await fn(() => { aborted = true; });
|
||||
return data;
|
||||
}
|
||||
catch (e) {
|
||||
if (aborted || ((backoff.attempts + 1) >= attempts)) {
|
||||
throw e;
|
||||
}
|
||||
|
||||
const duration = backoff.duration();
|
||||
log(`Promise rejected attempt #${backoff.attempts}, retrying in ${duration}ms: ${e.message}`);
|
||||
|
||||
await new Promise((resolve) => { setTimeout(resolve, duration); });
|
||||
return retryPromise(fn, attempts, backoff);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Retry promise
|
||||
*
|
||||
* @param {function} fn Function returning promise that should be retried
|
||||
* @param {object} [backoffOpts] Backoff options
|
||||
* @param {number} [backoffOpts.attempts] Maximum number of attempts, default: `5`
|
||||
* @param {number} [backoffOpts.min] Minimum attempt delay in milliseconds, default: `5000`
|
||||
* @param {number} [backoffOpts.max] Maximum attempt delay in milliseconds, default: `30000`
|
||||
* @returns {Promise}
|
||||
*/
|
||||
|
||||
function retry(fn, { attempts = 5, min = 5000, max = 30000 } = {}) {
|
||||
const backoff = new Backoff({ min, max });
|
||||
return retryPromise(fn, attempts, backoff);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Parse URLs from link header
|
||||
*
|
||||
* @param {string} header Link header contents
|
||||
* @param {string} rel Link relation, default: `alternate`
|
||||
* @returns {array} Array of URLs
|
||||
*/
|
||||
|
||||
function parseLinkHeader(header, rel = 'alternate') {
|
||||
const relRe = new RegExp(`\\s*rel\\s*=\\s*"?${rel}"?`, 'i');
|
||||
|
||||
const results = (header || '').split(/,\s*</).map((link) => {
|
||||
const [, linkUrl, linkParts] = link.match(/<?([^>]*)>;(.*)/) || [];
|
||||
return (linkUrl && linkParts && linkParts.match(relRe)) ? linkUrl : null;
|
||||
});
|
||||
|
||||
return results.filter((r) => r);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Find certificate chain with preferred issuer common name
|
||||
* - If issuer is found in multiple chains, the closest to root wins
|
||||
* - If issuer can not be located, the first chain will be returned
|
||||
*
|
||||
* @param {array} certificates Array of PEM encoded certificate chains
|
||||
* @param {string} issuer Preferred certificate issuer
|
||||
* @returns {string} PEM encoded certificate chain
|
||||
*/
|
||||
|
||||
function findCertificateChainForIssuer(chains, issuer) {
|
||||
log(`Attempting to find match for issuer="${issuer}" in ${chains.length} certificate chains`);
|
||||
let bestMatch = null;
|
||||
let bestDistance = null;
|
||||
|
||||
chains.forEach((chain) => {
|
||||
/* Look up all issuers */
|
||||
const certs = splitPemChain(chain);
|
||||
const infoCollection = certs.map((c) => readCertificateInfo(c));
|
||||
const issuerCollection = infoCollection.map((i) => i.issuer.commonName);
|
||||
|
||||
/* Found issuer match, get distance from root - lower is better */
|
||||
if (issuerCollection.includes(issuer)) {
|
||||
const distance = (issuerCollection.length - issuerCollection.indexOf(issuer));
|
||||
log(`Found matching chain for preferred issuer="${issuer}" distance=${distance} issuers=${JSON.stringify(issuerCollection)}`);
|
||||
|
||||
/* Chain wins, use it */
|
||||
if (!bestDistance || (distance < bestDistance)) {
|
||||
log(`Issuer is closer to root than previous match, using it (${distance} < ${bestDistance || 'undefined'})`);
|
||||
bestMatch = chain;
|
||||
bestDistance = distance;
|
||||
}
|
||||
}
|
||||
else {
|
||||
/* No match */
|
||||
log(`Unable to match certificate for preferred issuer="${issuer}", issuers=${JSON.stringify(issuerCollection)}`);
|
||||
}
|
||||
});
|
||||
|
||||
/* Return found match */
|
||||
if (bestMatch) {
|
||||
return bestMatch;
|
||||
}
|
||||
|
||||
/* No chains matched, return default */
|
||||
log(`Found no match in ${chains.length} certificate chains for preferred issuer="${issuer}", returning default certificate chain`);
|
||||
return chains[0];
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Find and format error in response object
|
||||
*
|
||||
* @param {object} resp HTTP response
|
||||
* @returns {string} Error message
|
||||
*/
|
||||
|
||||
function formatResponseError(resp) {
|
||||
let result;
|
||||
|
||||
if (resp.data.error) {
|
||||
result = resp.data.error.detail || resp.data.error;
|
||||
}
|
||||
else {
|
||||
result = resp.data.detail || JSON.stringify(resp.data);
|
||||
}
|
||||
|
||||
return result.replace(/\n/g, '');
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Resolve root domain name by looking for SOA record
|
||||
*
|
||||
* @param {string} recordName DNS record name
|
||||
* @returns {Promise<string>} Root domain name
|
||||
*/
|
||||
|
||||
async function resolveDomainBySoaRecord(recordName) {
|
||||
try {
|
||||
await dns.resolveSoa(recordName);
|
||||
log(`Found SOA record, considering domain to be: ${recordName}`);
|
||||
return recordName;
|
||||
}
|
||||
catch (e) {
|
||||
log(`Unable to locate SOA record for name: ${recordName}`);
|
||||
const parentRecordName = recordName.split('.').slice(1).join('.');
|
||||
|
||||
if (!parentRecordName.includes('.')) {
|
||||
throw new Error('Unable to resolve domain by SOA record');
|
||||
}
|
||||
|
||||
return resolveDomainBySoaRecord(parentRecordName);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Get DNS resolver using domains authoritative NS records
|
||||
*
|
||||
* @param {string} recordName DNS record name
|
||||
* @returns {Promise<dns.Resolver>} DNS resolver
|
||||
*/
|
||||
|
||||
async function getAuthoritativeDnsResolver(recordName) {
|
||||
log(`Locating authoritative NS records for name: ${recordName}`);
|
||||
const resolver = new dns.Resolver();
|
||||
|
||||
try {
|
||||
/* Resolve root domain by SOA */
|
||||
const domain = await resolveDomainBySoaRecord(recordName);
|
||||
|
||||
/* Resolve authoritative NS addresses */
|
||||
log(`Looking up authoritative NS records for domain: ${domain}`);
|
||||
const nsRecords = await dns.resolveNs(domain);
|
||||
const nsAddrArray = await Promise.all(nsRecords.map(async (r) => dns.resolve4(r)));
|
||||
const nsAddresses = [].concat(...nsAddrArray).filter((a) => a);
|
||||
|
||||
if (!nsAddresses.length) {
|
||||
throw new Error(`Unable to locate any valid authoritative NS addresses for domain: ${domain}`);
|
||||
}
|
||||
|
||||
/* Authoritative NS success */
|
||||
log(`Found ${nsAddresses.length} authoritative NS addresses for domain: ${domain}`);
|
||||
resolver.setServers(nsAddresses);
|
||||
}
|
||||
catch (e) {
|
||||
log(`Authoritative NS lookup error: ${e.message}`);
|
||||
}
|
||||
|
||||
/* Return resolver */
|
||||
const addresses = resolver.getServers();
|
||||
log(`DNS resolver addresses: ${addresses.join(', ')}`);
|
||||
|
||||
return resolver;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Export utils
|
||||
*/
|
||||
|
||||
module.exports = {
|
||||
retry,
|
||||
parseLinkHeader,
|
||||
findCertificateChainForIssuer,
|
||||
formatResponseError,
|
||||
getAuthoritativeDnsResolver
|
||||
};
|
||||
@@ -0,0 +1,127 @@
|
||||
/**
|
||||
* ACME challenge verification
|
||||
*/
|
||||
|
||||
const dns = require('dns').promises;
|
||||
const { log } = require('./logger');
|
||||
const axios = require('./axios');
|
||||
const util = require('./util');
|
||||
|
||||
|
||||
/**
|
||||
* Verify ACME HTTP challenge
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-8.3
|
||||
*
|
||||
* @param {object} authz Identifier authorization
|
||||
* @param {object} challenge Authorization challenge
|
||||
* @param {string} keyAuthorization Challenge key authorization
|
||||
* @param {string} [suffix] URL suffix
|
||||
* @returns {Promise<boolean>}
|
||||
*/
|
||||
|
||||
async function verifyHttpChallenge(authz, challenge, keyAuthorization, suffix = `/.well-known/acme-challenge/${challenge.token}`) {
|
||||
const httpPort = axios.defaults.acmeSettings.httpChallengePort || 80;
|
||||
const challengeUrl = `http://${authz.identifier.value}:${httpPort}${suffix}`;
|
||||
|
||||
log(`Sending HTTP query to ${authz.identifier.value}, suffix: ${suffix}, port: ${httpPort}`);
|
||||
const resp = await axios.get(challengeUrl);
|
||||
const data = (resp.data || '').replace(/\s+$/, '');
|
||||
|
||||
log(`Query successful, HTTP status code: ${resp.status}`);
|
||||
|
||||
if (!data || (data !== keyAuthorization)) {
|
||||
throw new Error(`Authorization not found in HTTP response from ${authz.identifier.value}`);
|
||||
}
|
||||
|
||||
log(`Key authorization match for ${challenge.type}/${authz.identifier.value}, ACME challenge verified`);
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Walk DNS until TXT records are found
|
||||
*/
|
||||
|
||||
async function walkDnsChallengeRecord(recordName, resolver = dns) {
|
||||
/* Resolve CNAME record first */
|
||||
try {
|
||||
log(`Checking name for CNAME records: ${recordName}`);
|
||||
const cnameRecords = await resolver.resolveCname(recordName);
|
||||
|
||||
if (cnameRecords.length) {
|
||||
log(`CNAME record found at ${recordName}, new challenge record name: ${cnameRecords[0]}`);
|
||||
return walkDnsChallengeRecord(cnameRecords[0]);
|
||||
}
|
||||
}
|
||||
catch (e) {
|
||||
log(`No CNAME records found for name: ${recordName}`);
|
||||
}
|
||||
|
||||
/* Resolve TXT records */
|
||||
try {
|
||||
log(`Checking name for TXT records: ${recordName}`);
|
||||
const txtRecords = await resolver.resolveTxt(recordName);
|
||||
|
||||
if (txtRecords.length) {
|
||||
log(`Found ${txtRecords.length} TXT records at ${recordName}`);
|
||||
return [].concat(...txtRecords);
|
||||
}
|
||||
}
|
||||
catch (e) {
|
||||
log(`No TXT records found for name: ${recordName}`);
|
||||
}
|
||||
|
||||
/* Found nothing */
|
||||
throw new Error(`No TXT records found for name: ${recordName}`);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Verify ACME DNS challenge
|
||||
*
|
||||
* https://tools.ietf.org/html/rfc8555#section-8.4
|
||||
*
|
||||
* @param {object} authz Identifier authorization
|
||||
* @param {object} challenge Authorization challenge
|
||||
* @param {string} keyAuthorization Challenge key authorization
|
||||
* @param {string} [prefix] DNS prefix
|
||||
* @returns {Promise<boolean>}
|
||||
*/
|
||||
|
||||
async function verifyDnsChallenge(authz, challenge, keyAuthorization, prefix = '_acme-challenge.') {
|
||||
let recordValues = [];
|
||||
const recordName = `${prefix}${authz.identifier.value}`;
|
||||
log(`Resolving DNS TXT from record: ${recordName}`);
|
||||
|
||||
try {
|
||||
/* Default DNS resolver first */
|
||||
log('Attempting to resolve TXT with default DNS resolver first');
|
||||
recordValues = await walkDnsChallengeRecord(recordName);
|
||||
}
|
||||
catch (e) {
|
||||
/* Authoritative DNS resolver */
|
||||
log(`Error using default resolver, attempting to resolve TXT with authoritative NS: ${e.message}`);
|
||||
const authoritativeResolver = await util.getAuthoritativeDnsResolver(recordName);
|
||||
recordValues = await walkDnsChallengeRecord(recordName, authoritativeResolver);
|
||||
}
|
||||
|
||||
log(`DNS query finished successfully, found ${recordValues.length} TXT records`);
|
||||
|
||||
if (!recordValues.length || !recordValues.includes(keyAuthorization)) {
|
||||
throw new Error(`Authorization not found in DNS TXT record: ${recordName}`);
|
||||
}
|
||||
|
||||
log(`Key authorization match for ${challenge.type}/${recordName}, ACME challenge verified`);
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Export API
|
||||
*/
|
||||
|
||||
module.exports = {
|
||||
'http-01': verifyHttpChallenge,
|
||||
'dns-01': verifyDnsChallenge
|
||||
};
|
||||
Reference in New Issue
Block a user