-
-
Notifications
You must be signed in to change notification settings - Fork 6.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: use forge partially to generate certificates (#6325)
> watching The Matrix while hacking these certificates Alternative to #6173 Since sharing same certificate for all users is not the best approach I suggest to try decompose node-forge which is used internally by selfsigned package. We can just use part of the package which already gives a good result. Eventually we will deprecate this feature but would be good to have less impact on current major too. ``` du -sk dist/node ``` before: 10760 after: 9944
- Loading branch information
Showing
5 changed files
with
153 additions
and
106 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,145 @@ | ||
| // simplified fork of | ||
| // https://github.com/jfromaniello/selfsigned/blob/da38146f8d02183c35f49f91659a744a243e8707/index.js | ||
| // with inlined options and partial node-forge usage | ||
| // to achieve smaller bundle | ||
| // | ||
| // this utility create untrusted certificate which still | ||
| // allows to access page after proceeding a wall with warning | ||
| // | ||
| // should be deprecated eventually and replaced with recipes | ||
| // about generating secure trusted certificates | ||
|
|
||
| // @ts-ignore | ||
| import forge from 'node-forge/lib/forge' | ||
| // @ts-ignore | ||
| import 'node-forge/lib/pki' | ||
|
|
||
| // a hexString is considered negative if it's most significant bit is 1 | ||
| // because serial numbers use ones' complement notation | ||
| // this RFC in section 4.1.2.2 requires serial numbers to be positive | ||
| // http://www.ietf.org/rfc/rfc5280.txt | ||
| function toPositiveHex(hexString: string) { | ||
| let mostSiginficativeHexAsInt = parseInt(hexString[0], 16) | ||
| if (mostSiginficativeHexAsInt < 8) { | ||
| return hexString | ||
| } | ||
|
|
||
| mostSiginficativeHexAsInt -= 8 | ||
| return mostSiginficativeHexAsInt.toString() + hexString.substring(1) | ||
| } | ||
|
|
||
| export function createCertificate(): string { | ||
| const days = 30 | ||
| const keySize = 2048 | ||
|
|
||
| const extensions = [ | ||
| // { | ||
| // name: 'basicConstraints', | ||
| // cA: true, | ||
| // }, | ||
| { | ||
| name: 'keyUsage', | ||
| keyCertSign: true, | ||
| digitalSignature: true, | ||
| nonRepudiation: true, | ||
| keyEncipherment: true, | ||
| dataEncipherment: true | ||
| }, | ||
| { | ||
| name: 'extKeyUsage', | ||
| serverAuth: true, | ||
| clientAuth: true, | ||
| codeSigning: true, | ||
| timeStamping: true | ||
| }, | ||
| { | ||
| name: 'subjectAltName', | ||
| altNames: [ | ||
| { | ||
| // type 2 is DNS | ||
| type: 2, | ||
| value: 'localhost' | ||
| }, | ||
| { | ||
| type: 2, | ||
| value: 'localhost.localdomain' | ||
| }, | ||
| { | ||
| type: 2, | ||
| value: 'lvh.me' | ||
| }, | ||
| { | ||
| type: 2, | ||
| value: '*.lvh.me' | ||
| }, | ||
| { | ||
| type: 2, | ||
| value: '[::1]' | ||
| }, | ||
| { | ||
| // type 7 is IP | ||
| type: 7, | ||
| ip: '127.0.0.1' | ||
| }, | ||
| { | ||
| type: 7, | ||
| ip: 'fe80::1' | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
|
|
||
| const attrs = [ | ||
| { | ||
| name: 'commonName', | ||
| value: 'example.org' | ||
| }, | ||
| { | ||
| name: 'countryName', | ||
| value: 'US' | ||
| }, | ||
| { | ||
| shortName: 'ST', | ||
| value: 'Virginia' | ||
| }, | ||
| { | ||
| name: 'localityName', | ||
| value: 'Blacksburg' | ||
| }, | ||
| { | ||
| name: 'organizationName', | ||
| value: 'Test' | ||
| }, | ||
| { | ||
| shortName: 'OU', | ||
| value: 'Test' | ||
| } | ||
| ] | ||
|
|
||
| const keyPair = forge.pki.rsa.generateKeyPair(keySize) | ||
|
|
||
| const cert = forge.pki.createCertificate() | ||
|
|
||
| cert.serialNumber = toPositiveHex( | ||
| forge.util.bytesToHex(forge.random.getBytesSync(9)) | ||
| ) // the serial number can be decimal or hex (if preceded by 0x) | ||
|
|
||
| cert.validity.notBefore = new Date() | ||
| cert.validity.notAfter = new Date() | ||
| cert.validity.notAfter.setDate(cert.validity.notBefore.getDate() + days) | ||
|
|
||
| cert.setSubject(attrs) | ||
| cert.setIssuer(attrs) | ||
|
|
||
| cert.publicKey = keyPair.publicKey | ||
|
|
||
| cert.setExtensions(extensions) | ||
|
|
||
| const algorithm = forge.md.sha256.create() | ||
| cert.sign(keyPair.privateKey, algorithm) | ||
|
|
||
| const privateKeyPem = forge.pki.privateKeyToPem(keyPair.privateKey) | ||
| const certPem = forge.pki.certificateToPem(cert) | ||
|
|
||
| return privateKeyPem + certPem | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.