use supplied directoryUrl

README.md

@@ -18,10 +18,64 @@ In progress
 * Mar 20, 2018 - finalize order (submit csr)
 * Mar 20, 2018 - poll for status
 * Mar 20, 2018 - download certificate
-
 * Mar 20, 2018 - SUCCESS - got a test certificate (hard-coded)
+* Mar 21, 2018 - can now accept values (not hard coded)
+* Mar 21, 2018 - *mostly* matches le-acme-core.js API
 
 Todo
 
-* match api for acme v1 (le-acme-core.js)
+* completely match api for acme v1 (le-acme-core.js)
-* make not hard-coded
+* test http and dns challenges
+* export http and dns challenge tests
+* support ECDSA keys
+
+## API
+
+```
+var ACME = require('acme-v2.js').ACME.create({
+  RSA: require('rsa-compat').RSA
+});
+```
+
+```javascript
+// Accounts
+ACME.registerNewAccount(options, cb)        // returns "regr" registration data
+
+    { email: '<email>'                        //    valid email (server checks MX records)
+    , accountKeypair: {                       //    privateKeyPem or privateKeyJwt
+        privateKeyPem: '<ASCII PEM>'
+      }
+    , agreeToTerms: fn (tosUrl, cb) {}        //    must specify agree=tosUrl to continue (or falsey to end)
+    }
+
+// Registration
+ACME.getCertificate(options, cb)            // returns (err, pems={ privkey (key), cert, chain (ca) })
+
+    { newAuthzUrl: '<url>'                    //    specify acmeUrls.newAuthz
+    , newCertUrl: '<url>'                     //    specify acmeUrls.newCert
+
+    , domainKeypair: {
+        privateKeyPem: '<ASCII PEM>'
+      }
+    , accountKeypair: {
+        privateKeyPem: '<ASCII PEM>'
+      }
+    , domains: [ 'example.com' ]
+
+    , setChallenge: fn (hostname, key, val, cb)
+    , removeChallenge: fn (hostname, key, cb)
+    }
+
+// Discovery URLs
+ACME.getAcmeUrls(acmeDiscoveryUrl, cb)      // returns (err, acmeUrls={newReg,newAuthz,newCert,revokeCert})
+```
+
+Helpers & Stuff
+
+```javascript
+// Constants
+ACME.productionServerUrl                // https://acme-v02.api.letsencrypt.org/directory
+ACME.stagingServerUrl                   // https://acme-staging-v02.api.letsencrypt.org/directory
+ACME.acmeChallengePrefix                // /.well-known/acme-challenge/
+```
+

node.js

@@ -4,6 +4,7 @@
  * Apache-2.0 OR MIT (and hence also MPL 2.0)
  */
 'use strict';
+/* globals Promise */
 
 var defaults = {
   productionServerUrl:    'https://acme-v02.api.letsencrypt.org/directory'
@@ -52,68 +53,25 @@ function create(deps) {
     });
   }
 
+  var RSA = deps.RSA || require('rsa-compat').RSA;
   deps.request = deps.request || require('request');
   deps.promisify = deps.promisify || require('util').promisify;
 
   var directoryUrl = deps.directoryUrl || defaults.stagingServerUrl;
   var request = deps.promisify(getRequest({}));
 
-			var crypto = require('crypto');
-			RSA.signJws = RSA.generateJws = RSA.generateSignatureJws = RSA.generateSignatureJwk =
-			function (keypair, payload, nonce) {
-        var prot = {};
-        if (nonce) {
-          if ('string' === typeof nonce) {
-            prot.nonce = nonce;
-          } else {
-            prot = nonce;
-          }
-        }
-				keypair = RSA._internal.import(keypair);
-				keypair = RSA._internal.importForge(keypair);
-				keypair.publicKeyJwk = RSA.exportPublicJwk(keypair);
-
-				// Compute JWS signature
-				var protectedHeader = "";
-				if (Object.keys(prot).length) {
-					protectedHeader = JSON.stringify(prot); // { alg: prot.alg, nonce: prot.nonce, url: prot.url });
-				}
-				var protected64 = RSA.utils.toWebsafeBase64(new Buffer(protectedHeader).toString('base64'));
-				var payload64 = RSA.utils.toWebsafeBase64(payload.toString('base64'));
-				var raw = protected64 + "." + payload64;
-				var sha256Buf = crypto.createHash('sha256').update(raw).digest();
-				var sig64;
-
-				if (RSA._URSA) {
-					sig64 = RSA._ursaGenerateSig(keypair, sha256Buf);
-				} else {
-					sig64 = RSA._forgeGenerateSig(keypair, sha256Buf);
-				}
-
-				return {
-          /*
-					header: {
-						alg: "RS256"
-					, jwk: keypair.publicKeyJwk
-					}
-          */
-				  protected: protected64
-				, payload: payload64
-				, signature: sig64
-				};
-			};
-
   var acme2 = {
-    getAcmeUrls: function () {
+    getAcmeUrls: function (_directoryUrl) {
       var me = this;
-      return request({ url: directoryUrl }).then(function (resp) {
+      return request({ url: _directoryUrl || directoryUrl, json: true }).then(function (resp) {
-        me._directoryUrls = JSON.parse(resp.body);
+        me._directoryUrls = resp.body;
         me._tos = me._directoryUrls.meta.termsOfService;
         return me._directoryUrls;
       });
     }
   , getNonce: function () {
       var me = this;
+      if (me._nonce) { return new Promise(function (resolve) { resolve(me._nonce); return; }); }
       return request({ method: 'HEAD', url: me._directoryUrls.newNonce }).then(function (resp) {
         me._nonce = resp.toJSON().headers['replay-nonce'];
         return me._nonce;
@@ -142,31 +100,53 @@ function create(deps) {
   , registerNewAccount: function (options) {
       var me = this;
 
+      console.log('[acme-v2] registerNewAccount');
+
+      return me.getNonce().then(function () {
+        return new Promise(function (resolve, reject) {
+
+          function agree(err, tosUrl) {
+            if (err) { reject(err); return; }
+            if (me._tos !== tosUrl) {
+              err = new Error("You must agree to the ToS at '" + me._tos + "'");
+              err.code = "E_AGREE_TOS";
+              reject(err);
+              return;
+            }
+
+            var jwk = RSA.exportPublicJwk(options.accountKeypair);
             var body = {
-        termsOfServiceAgreed: true
+              termsOfServiceAgreed: tosUrl === me._tos
             , onlyReturnExisting: false
             , contact: [ 'mailto:' + options.email ]
-      /*
-       "externalAccountBinding": {
-         "protected": base64url({
-           "alg": "HS256",
-           "kid": /* key identifier from CA *//*,
-           "url": "https://example.com/acme/new-account"
-         }),
-         "payload": base64url(/* same as in "jwk" above *//*),
-         "signature": /* MAC using MAC key from CA *//*
-       }
-      */
             };
-			var payload = JSON.stringify(body, null, 2);
+            if (options.externalAccount) {
+              body.externalAccountBinding = RSA.signJws(
+                options.externalAccount.secret
+              , undefined
+              , { alg: "HS256"
+                , kid: options.externalAccount.id
+                , url: me._directoryUrls.newAccount
+                }
+              , new Buffer(JSON.stringify(jwk))
+              );
+            }
+            var payload = JSON.stringify(body);
             var jws = RSA.signJws(
-        options.keypair
+              options.accountKeypair
+            , undefined
+            , { nonce: me._nonce
+              , alg: 'RS256'
+              , url: me._directoryUrls.newAccount
+              , jwk: jwk
+              }
             , new Buffer(payload)
-      , { nonce: me._nonce, alg: 'RS256', url: me._directoryUrls.newAccount, jwk: RSA.exportPublicJwk(options.keypair) }
             );
 
-      console.log('jws:');
+            console.log('[acme-v2] registerNewAccount JSON body:');
+            delete jws.header;
             console.log(jws);
+            me._nonce = null;
             return request({
               method: 'POST'
             , url: me._directoryUrls.newAccount
@@ -174,11 +154,18 @@ function create(deps) {
             , json: jws
             }).then(function (resp) {
               me._nonce = resp.toJSON().headers['replay-nonce'];
-        var location = resp.toJSON().headers['location'];
+              var location = resp.toJSON().headers.location;
+              console.log('[DEBUG] new account location:'); // the account id url
               console.log(location); // the account id url
               console.log(resp.toJSON());
               me._kid = location;
               return resp.body;
+            }).then(resolve);
+          }
+
+          console.log('[acme-v2] agreeToTerms');
+          options.agreeToTerms(me._tos, agree);
+        });
       });
     }
     /*
@@ -204,46 +191,54 @@ function create(deps) {
   , _getChallenges: function (options, auth) {
       console.log('\n[DEBUG] getChallenges\n');
       return request({ method: 'GET', url: auth, json: true }).then(function (resp) {
-        console.log('Authorization:');
+        return resp.body;
-        console.log(resp.body.challenges);
-        return resp.body.challenges;
       });
     }
     // https://tools.ietf.org/html/draft-ietf-acme-acme-10#section-7.5.1
-  , _postChallenge: function (options, ch) {
+  , _postChallenge: function (options, identifier, ch) {
       var me = this;
 
       var body = { };
 
       var payload = JSON.stringify(body);
-			//var payload = JSON.stringify(body, null, 2);
-			var jws = RSA.signJws(
-        options.keypair
-      , new Buffer(payload)
-      , { nonce: me._nonce, alg: 'RS256', url: ch.url, kid: me._kid }
-			);
 
-      var thumbprint = RSA.thumbprint(options.keypair);
+      var thumbprint = RSA.thumbprint(options.accountKeypair);
       var keyAuthorization = ch.token + '.' + thumbprint;
       //   keyAuthorization = token || '.' || base64url(JWK_Thumbprint(accountKey))
       //   /.well-known/acme-challenge/:token
-      console.log('type:');
+
-      console.log(ch.type);
+      return new Promise(function (resolve, reject) {
-      console.log('ch.token:');
+        if (options.setupChallenge) {
-      console.log(ch.token);
+          options.setupChallenge(
-      console.log('thumbprint:');
+            { identifier: identifier
-      console.log(thumbprint);
+            , hostname: identifier.value
-      console.log('keyAuthorization:');
+            , type: ch.type
-      console.log(keyAuthorization);
+            , token: ch.token
-      /*
+            , thumbprint: thumbprint
-      options.setChallenge(ch.token, thumbprint, keyAuthorization, function (err) {
+            , keyAuthorization: keyAuthorization
-      });
+            , dnsAuthorization: RSA.utils.toWebsafeBase64(
-      */
+                require('crypto').createHash('sha256').update(keyAuthorization).digest('base64')
+              )
+            }
+          , testChallenge
+          );
+        } else {
+          options.setChallenge(identifier.value, ch.token, keyAuthorization, testChallenge);
+        }
+
+        function testChallenge(err) {
+          if (err) { reject(err); return; }
+
+          // TODO put check dns / http checks here?
+          // http-01: GET https://example.org/.well-known/acme-challenge/{{token}} => {{keyAuth}}
+          // dns-01: TXT _acme-challenge.example.org. => "{{urlSafeBase64(sha256(keyAuth))}}"
+
           function wait(ms) {
             return new Promise(function (resolve) {
               setTimeout(resolve, (ms || 1100));
             });
           }
+
           function pollStatus() {
             console.log('\n[DEBUG] statusChallenge\n');
             return request({ method: 'GET', url: ch.url, json: true }).then(function (resp) {
@@ -257,6 +252,19 @@ function create(deps) {
 
               if ('valid' === resp.body.status) {
                 console.log('poll: valid');
+                try {
+                  if (options.teardownChallenge) {
+                    options.teardownChallenge(
+                      { identifier: identifier
+                      , type: ch.type
+                      , token: ch.token
+                      }
+                    , function () {}
+                    );
+                  } else {
+                    options.removeChallenge(identifier.value, ch.token, function () {});
+                  }
+                } catch(e) {}
                 return resp.body;
               }
 
@@ -269,6 +277,8 @@ function create(deps) {
               else {
                 console.error("[acme-v2] (z) bad challenge state:");
               }
+
+              return Promise.reject(new Error("[acme-v2] bad challenge state"));
             });
           }
 
@@ -276,6 +286,13 @@ function create(deps) {
           //console.log('\n[DEBUG] stop to fix things\n'); return;
 
           function post() {
+            var jws = RSA.signJws(
+              options.accountKeypair
+            , undefined
+            , { nonce: me._nonce, alg: 'RS256', url: ch.url, kid: me._kid }
+            , new Buffer(payload)
+            );
+            me._nonce = null;
             return request({
               method: 'POST'
             , url: ch.url
@@ -285,17 +302,19 @@ function create(deps) {
               me._nonce = resp.toJSON().headers['replay-nonce'];
               console.log('respond to challenge: resp.body:');
               console.log(resp.body);
-          return wait().then(pollStatus);
+              return wait().then(pollStatus).then(resolve, reject);
             });
           }
 
           return wait(20 * 1000).then(post);
         }
+      });
+    }
   , _finalizeOrder: function (options, validatedDomains) {
       console.log('finalizeOrder:');
       var me = this;
 
-      var csr = RSA.generateCsrWeb64(options.certificateKeypair, validatedDomains);
+      var csr = RSA.generateCsrWeb64(options.domainKeypair, validatedDomains);
       var body = { csr: csr };
       var payload = JSON.stringify(body);
 
@@ -306,14 +325,15 @@ function create(deps) {
       }
 
       function pollCert() {
-        //var payload = JSON.stringify(body, null, 2);
         var jws = RSA.signJws(
-          options.keypair
+          options.accountKeypair
-        , new Buffer(payload)
+        , undefined
         , { nonce: me._nonce, alg: 'RS256', url: me._finalize, kid: me._kid }
+        , new Buffer(payload)
         );
 
         console.log('finalize:', me._finalize);
+        me._nonce = null;
         return request({
           method: 'POST'
         , url: me._finalize
@@ -348,7 +368,7 @@ function create(deps) {
 
       return pollCert();
     }
-  , _getCertificate: function (auth) {
+  , _getCertificate: function () {
       var me = this;
       return request({ method: 'GET', url: me._certificate, json: true }).then(function (resp) {
         console.log('Certificate:');
@@ -357,28 +377,37 @@ function create(deps) {
       });
     }
   , getCertificate: function (options, cb) {
+      console.log('[acme-v2] DEBUG get cert 1');
       var me = this;
 
+      if (!options.challengeTypes) {
+        if (!options.challengeType) {
+          cb(new Error("challenge type must be specified"));
+          return Promise.reject(new Error("challenge type must be specified"));
+        }
+        options.challengeTypes = [ options.challengeType ];
+      }
+
+      console.log('[acme-v2] getCertificate');
+      return me.getNonce().then(function () {
         var body = {
-				identifiers: [
+          identifiers: options.domains.map(function (hostname) {
-          { type: "dns" , value: "test.ppl.family" }
+            return { type: "dns" , value: hostname };
-				/*
+          })
-        , {	type: "dns" , value: "example.net" }
-				*/
-        ]
           //, "notBefore": "2016-01-01T00:00:00Z"
           //, "notAfter": "2016-01-08T00:00:00Z"
         };
 
         var payload = JSON.stringify(body);
-			//var payload = JSON.stringify(body, null, 2);
         var jws = RSA.signJws(
-        options.keypair
+          options.accountKeypair
-      , new Buffer(payload)
+        , undefined
         , { nonce: me._nonce, alg: 'RS256', url: me._directoryUrls.newOrder, kid: me._kid }
+        , new Buffer(payload)
         );
 
         console.log('\n[DEBUG] newOrder\n');
+        me._nonce = null;
         return request({
           method: 'POST'
         , url: me._directoryUrls.newOrder
@@ -386,29 +415,34 @@ function create(deps) {
         , json: jws
         }).then(function (resp) {
           me._nonce = resp.toJSON().headers['replay-nonce'];
-        var location = resp.toJSON().headers['location'];
+          var location = resp.toJSON().headers.location;
           console.log(location); // the account id url
           console.log(resp.toJSON());
-        //var body = JSON.parse(resp.body);
           me._authorizations = resp.body.authorizations;
           me._order = location;
           me._finalize = resp.body.finalize;
           //console.log('[DEBUG] finalize:', me._finalize); return;
 
           //return resp.body;
-        return Promise.all(me._authorizations.map(function (auth) {
+          return Promise.all(me._authorizations.map(function (authUrl) {
-          console.log('authz', auth);
+            return me._getChallenges(options, authUrl).then(function (results) {
-          return me._getChallenges(options, auth).then(function (challenges) {
+              // var domain = options.domains[i]; // results.identifier.value
-            var chp;
+              var chType = options.challengeTypes.filter(function (chType) {
-
+                return results.challenges.some(function (ch) {
-            challenges.forEach(function (ch) {
+                  return ch.type === chType;
-              if ('http-01' !== ch.type) {
-                return;
-              }
-              chp = me._postChallenge(options, ch);
                 });
+              })[0];
+              var challenge = results.challenges.filter(function (ch) {
+                if (chType === ch.type) {
+                  return ch;
+                }
+              })[0];
 
-            return chp;
+              if (!challenge) {
+                return Promise.reject(new Error("Server didn't offer any challenge we can handle."));
+              }
+
+              return me._postChallenge(options, results.identifier, challenge);
             });
           })).then(function () {
             var validatedDomains = body.identifiers.map(function (ident) {
@@ -417,7 +451,8 @@ function create(deps) {
 
             return me._finalizeOrder(options, validatedDomains);
           }).then(function () {
-          return me._getCertificate();
+            return me._getCertificate().then(function (result) { cb(null, result); return result; }, cb);
+          });
         });
       });
     }
@@ -425,23 +460,9 @@ function create(deps) {
   return acme2;
 }
 
-var RSA = require('rsa-compat').RSA;
+module.exports.ACME = {
-var acme2 = create();
+  create: create
-acme2.getAcmeUrls().then(function (body) {
-  console.log(body);
-  acme2.getNonce().then(function (nonce) {
-    console.log(nonce);
-
-		var options = {
-			email: 'coolaj86@gmail.com'
-		, keypair: RSA.import({ privateKeyPem: require('fs').readFileSync(__dirname + '/account.privkey.pem') })
-		, certificateKeypair: RSA.import({ privateKeyPem: require('fs').readFileSync(__dirname + '/privkey.pem') })
 };
-    acme2.registerNewAccount(options).then(function (account) {
+Object.keys(defaults).forEach(function (key) {
-      console.log(account);
+  module.exports.ACME[key] = defaults[key];
-    	acme2.getCertificate(options, function () {
-				console.log('got cert');
-      });
-    });
-  });
 });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "acme-v2",
-  "version": "0.0.2",
+  "version": "0.6.0",
   "description": "A framework for building letsencrypt clients (and other ACME v2 clients), forked from le-acme-core.js.",
   "main": "node.js",
   "scripts": {
@@ -23,6 +23,6 @@
   "license": "(MIT OR Apache-2.0)",
   "dependencies": {
     "request": "^2.85.0",
-    "rsa-compat": "^1.2.7"
+    "rsa-compat": "^1.3.0"
   }
 }

test.js

@@ -0,0 +1,56 @@
+'use strict';
+
+var RSA = require('rsa-compat').RSA;
+var acme2 = require('./').ACME.create({ RSA: RSA });
+
+acme2.getAcmeUrls(acme2.stagingServerUrl).then(function (body) {
+  console.log(body);
+
+  var options = {
+    agreeToTerms: function (tosUrl, agree) {
+      agree(null, tosUrl);
+    }
+    /*
+  , setupChallenge: function (opts) {
+      console.log('type:');
+      console.log(ch.type);
+      console.log('ch.token:');
+      console.log(ch.token);
+      console.log('thumbprint:');
+      console.log(thumbprint);
+      console.log('keyAuthorization:');
+      console.log(keyAuthorization);
+      console.log('dnsAuthorization:');
+      console.log(dnsAuthorization);
+    }
+    */
+    // teardownChallenge
+  , setChallenge: function (hostname, key, val, cb) {
+      console.log('[DEBUG] set challenge', hostname, key, val);
+      console.log("You have 20 seconds to put the string '" + val + "' into a file at '" + hostname + "/" + key + "'");
+      setTimeout(cb, 20 * 1000);
+    }
+  , removeChallenge: function (hostname, key, cb) {
+      console.log('[DEBUG] remove challenge', hostname, key);
+      setTimeout(cb, 1 * 1000);
+    }
+  , challengeType: 'http-01'
+  , email: 'coolaj86@gmail.com'
+  , accountKeypair: RSA.import({ privateKeyPem: require('fs').readFileSync(__dirname + '/account.privkey.pem') })
+  , domainKeypair: RSA.import({ privateKeyPem: require('fs').readFileSync(__dirname + '/privkey.pem') })
+  , domains: [ 'test.ppl.family' ]
+  };
+
+  acme2.registerNewAccount(options).then(function (account) {
+    console.log('account:');
+    console.log(account);
+
+    acme2.getCertificate(options, function (fullchainPem) {
+      console.log('[acme-v2] A fullchain.pem:');
+      console.log(fullchainPem);
+    }).then(function (fullchainPem) {
+      console.log('[acme-v2] B fullchain.pem:');
+      console.log(fullchainPem);
+    });
+  });
+});