AJ ONeal
5 years ago
1 changed files with 494 additions and 0 deletions
@ -0,0 +1,494 @@ |
|||||
|
(function () { |
||||
|
'use strict'; |
||||
|
|
||||
|
/*global URLSearchParams,Headers*/ |
||||
|
var VERSION = '2'; |
||||
|
// ACME recommends ECDSA P-256, but RSA 2048 is still required by some old servers (like what replicated.io uses )
|
||||
|
// ECDSA P-384, P-521, and RSA 3072, 4096 are NOT recommend standards (and not properly supported)
|
||||
|
var BROWSER_SUPPORTS_RSA; |
||||
|
var ECDSA_OPTS = { kty: 'EC', namedCurve: 'P-256' }; |
||||
|
var RSA_OPTS = { kty: 'RSA', modulusLength: 2048 }; |
||||
|
var Promise = window.Promise; |
||||
|
var Keypairs = window.Keypairs; |
||||
|
var ACME = window.ACME; |
||||
|
var CSR = window.CSR; |
||||
|
var $qs = function (s) { return window.document.querySelector(s); }; |
||||
|
var $qsa = function (s) { return window.document.querySelectorAll(s); }; |
||||
|
var acme; |
||||
|
var accountStuff; |
||||
|
var info = {}; |
||||
|
var steps = {}; |
||||
|
var i = 1; |
||||
|
var apiUrl = 'https://acme-{{env}}.api.letsencrypt.org/directory'; |
||||
|
|
||||
|
function updateApiType() { |
||||
|
console.log("type updated"); |
||||
|
/*jshint validthis: true */ |
||||
|
var input = this || Array.prototype.filter.call( |
||||
|
$qsa('.js-acme-api-type'), function ($el) { return $el.checked; } |
||||
|
)[0]; |
||||
|
console.log('ACME api type radio:', input.value); |
||||
|
$qs('.js-acme-directory-url').value = apiUrl.replace(/{{env}}/g, input.value); |
||||
|
} |
||||
|
|
||||
|
function hideForms() { |
||||
|
$qsa('.js-acme-form').forEach(function (el) { |
||||
|
el.hidden = true; |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
function updateProgress(currentStep) { |
||||
|
var progressSteps = $qs("#js-progress-bar").children; |
||||
|
var j; |
||||
|
for (j = 0; j < progressSteps.length; j += 1) { |
||||
|
if (j < currentStep) { |
||||
|
progressSteps[j].classList.add("js-progress-step-complete"); |
||||
|
progressSteps[j].classList.remove("js-progress-step-started"); |
||||
|
} else if (j === currentStep) { |
||||
|
progressSteps[j].classList.remove("js-progress-step-complete"); |
||||
|
progressSteps[j].classList.add("js-progress-step-started"); |
||||
|
} else { |
||||
|
progressSteps[j].classList.remove("js-progress-step-complete"); |
||||
|
progressSteps[j].classList.remove("js-progress-step-started"); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
function submitForm(ev) { |
||||
|
var j = i; |
||||
|
i += 1; |
||||
|
|
||||
|
return PromiseA.resolve(steps[j].submit(ev)).catch(function (err) { |
||||
|
console.error(err); |
||||
|
window.alert("Something went wrong. It's our fault not yours. Please email aj@rootprojects.org and let him know that 'step " + j + "' failed."); |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
function testEcdsaSupport() { |
||||
|
/* |
||||
|
var opts = { |
||||
|
kty: $('input[name="kty"]:checked').value |
||||
|
, namedCurve: $('input[name="ec-crv"]:checked').value |
||||
|
, modulusLength: $('input[name="rsa-len"]:checked').value |
||||
|
}; |
||||
|
*/ |
||||
|
} |
||||
|
function testRsaSupport() { |
||||
|
return Keypairs.generate(RSA_OPTS); |
||||
|
} |
||||
|
function testKeypairSupport() { |
||||
|
// fix previous browsers
|
||||
|
var isCurrent = (localStorage.getItem('version') === VERSION); |
||||
|
if (!isCurrent) { |
||||
|
localStorage.clear(); |
||||
|
localStorage.setItem('version', VERSION); |
||||
|
} |
||||
|
localStorage.setItem('version', VERSION); |
||||
|
|
||||
|
return testRsaSupport().then(function () { |
||||
|
console.info("[crypto] RSA is supported"); |
||||
|
BROWSER_SUPPORTS_RSA = true; |
||||
|
return BROWSER_SUPPORTS_RSA; |
||||
|
}).catch(function () { |
||||
|
console.warn("[crypto] RSA is NOT fully supported"); |
||||
|
BROWSER_SUPPORTS_RSA = false; |
||||
|
return BROWSER_SUPPORTS_RSA; |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
function getServerKeypair() { |
||||
|
var sortedAltnames = info.identifiers.map(function (ident) { return ident.value; }).sort().join(','); |
||||
|
var serverJwk = JSON.parse(localStorage.getItem('server:' + sortedAltnames) || 'null'); |
||||
|
if (serverJwk) { |
||||
|
return PromiseA.resolve(serverJwk); |
||||
|
} |
||||
|
|
||||
|
var keypairOpts; |
||||
|
// TODO allow for user preference
|
||||
|
if (BROWSER_SUPPORTS_RSA) { |
||||
|
keypairOpts = RSA_OPTS; |
||||
|
} else { |
||||
|
keypairOpts = ECDSA_OPTS; |
||||
|
} |
||||
|
|
||||
|
return Keypairs.generate(RSA_OPTS).catch(function (err) { |
||||
|
console.error("[Error] Keypairs.generate(" + JSON.stringify(RSA_OPTS) + "):"); |
||||
|
throw err; |
||||
|
}).then(function (pair) { |
||||
|
localStorage.setItem('server:'+sortedAltnames, JSON.stringify(pair.private)); |
||||
|
return pair.private; |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
function getAccountKeypair(email) { |
||||
|
var json = localStorage.getItem('account:'+email); |
||||
|
if (json) { |
||||
|
return Promise.resolve(JSON.parse(json)); |
||||
|
} |
||||
|
|
||||
|
return Keypairs.generate(ECDSA_OPTS).catch(function (err) { |
||||
|
console.warn("[Error] Keypairs.generate(" + JSON.stringify(ECDSA_OPTS) + "):\n", err); |
||||
|
return Keypairs.generate(RSA_OPTS).catch(function (err) { |
||||
|
console.error("[Error] Keypairs.generate(" + JSON.stringify(RSA_OPTS) + "):"); |
||||
|
throw err; |
||||
|
}); |
||||
|
}).then(function (pair) { |
||||
|
localStorage.setItem('account:'+email, JSON.stringify(pair.private)); |
||||
|
return pair.private; |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
function updateChallengeType() { |
||||
|
/*jshint validthis: true*/ |
||||
|
var input = this || Array.prototype.filter.call( |
||||
|
$qsa('.js-acme-challenge-type'), function ($el) { return $el.checked; } |
||||
|
)[0]; |
||||
|
console.log('ch type radio:', input.value); |
||||
|
$qs('.js-acme-verification-wildcard').hidden = true; |
||||
|
$qs('.js-acme-verification-http-01').hidden = true; |
||||
|
$qs('.js-acme-verification-dns-01').hidden = true; |
||||
|
if (info.challenges.wildcard) { |
||||
|
$qs('.js-acme-verification-wildcard').hidden = false; |
||||
|
} |
||||
|
if (info.challenges[input.value]) { |
||||
|
$qs('.js-acme-verification-' + input.value).hidden = false; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
function saveContact(email, domains) { |
||||
|
// to be used for good, not evil
|
||||
|
return window.fetch('https://api.rootprojects.org/api/rootprojects.org/public/community', { |
||||
|
method: 'POST' |
||||
|
, cors: true |
||||
|
, headers: new Headers({ 'Content-Type': 'application/json' }) |
||||
|
, body: JSON.stringify({ |
||||
|
address: email |
||||
|
, project: 'greenlock-domains@rootprojects.org' |
||||
|
, timezone: new Intl.DateTimeFormat().resolvedOptions().timeZone |
||||
|
, domain: domains.join(',') |
||||
|
}) |
||||
|
}).catch(function (err) { |
||||
|
console.error(err); |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
steps[1] = function () { |
||||
|
updateProgress(0); |
||||
|
hideForms(); |
||||
|
$qs('.js-acme-form-domains').hidden = false; |
||||
|
}; |
||||
|
steps[1].submit = function () { |
||||
|
info.identifiers = $qs('.js-acme-domains').value.split(/\s*,\s*/g).map(function (hostname) { |
||||
|
return { type: 'dns', value: hostname.toLowerCase().trim() }; |
||||
|
}).slice(0,1); //Disable multiple values for now. We'll just take the first and work with it.
|
||||
|
info.identifiers.sort(function (a, b) { |
||||
|
if (a === b) { return 0; } |
||||
|
if (a < b) { return 1; } |
||||
|
if (a > b) { return -1; } |
||||
|
}); |
||||
|
|
||||
|
var acmeDirectoryUrl = $qs('.js-acme-directory-url').value; |
||||
|
acme = ACME.create({ Keypairs: Keypairs, CSR: CSR }); |
||||
|
return acme.init(acmeDirectoryUrl).then(function (directory) { |
||||
|
$qs('.js-acme-tos-url').href = directory.meta.termsOfService; |
||||
|
console.log("MAGIC STEP NUMBER in 1 is:", i); |
||||
|
steps[i](); |
||||
|
}); |
||||
|
}; |
||||
|
|
||||
|
steps[2] = function () { |
||||
|
updateProgress(0); |
||||
|
hideForms(); |
||||
|
$qs('.js-acme-form-account').hidden = false; |
||||
|
}; |
||||
|
steps[2].submit = function () { |
||||
|
var email = $qs('.js-acme-account-email').value.toLowerCase().trim(); |
||||
|
|
||||
|
info.contact = [ 'mailto:' + email ]; |
||||
|
info.agree = $qs('.js-acme-account-tos').checked; |
||||
|
//info.greenlockAgree = $qs('.js-gl-tos').checked;
|
||||
|
|
||||
|
// TODO ping with version and account creation
|
||||
|
setTimeout(saveContact, 100, email, info.identifiers.map(function (ident) { return ident.value; })); |
||||
|
|
||||
|
function checkTos(tos) { |
||||
|
if (info.agree) { |
||||
|
return tos; |
||||
|
} else { |
||||
|
return ''; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return getAccountKeypair(email).then(function (jwk) { |
||||
|
// TODO save account id rather than always retrieving it?
|
||||
|
return acme.accounts.create({ |
||||
|
email: email |
||||
|
, agreeToTerms: checkTos |
||||
|
, accountKeypair: { privateKeyJwk: jwk } |
||||
|
}).then(function (account) { |
||||
|
console.log("account created result:", account); |
||||
|
accountStuff.account = account; |
||||
|
accountStuff.privateJwk = jwk; |
||||
|
accountStuff.email = email; |
||||
|
accountStuff.acme = acme; // TODO XXX remove
|
||||
|
}).catch(function (err) { |
||||
|
console.error("A bad thing happened:"); |
||||
|
console.error(err); |
||||
|
window.alert(err.message || JSON.stringify(err, null, 2)); |
||||
|
return new Promise(function () { |
||||
|
// stop the process cold
|
||||
|
console.warn('TODO: resume at ask email?'); |
||||
|
}); |
||||
|
}); |
||||
|
}).then(function () { |
||||
|
var jwk = accountStuff.privateJwk; |
||||
|
var account = accountStuff.account; |
||||
|
|
||||
|
return acme.orders.create({ |
||||
|
account: account |
||||
|
, accountKeypair: { privateKeyJwk: jwk } |
||||
|
, identifiers: info.identifiers |
||||
|
}).then(function (order) { |
||||
|
return acme.orders.create({ |
||||
|
signedOrder: signedOrder |
||||
|
}).then(function (order) { |
||||
|
accountStuff.order = order; |
||||
|
var claims = order.challenges; |
||||
|
console.log('claims:'); |
||||
|
console.log(claims); |
||||
|
|
||||
|
var obj = { 'dns-01': [], 'http-01': [], 'wildcard': [] }; |
||||
|
info.challenges = obj; |
||||
|
var map = { |
||||
|
'http-01': '.js-acme-verification-http-01' |
||||
|
, 'dns-01': '.js-acme-verification-dns-01' |
||||
|
, 'wildcard': '.js-acme-verification-wildcard' |
||||
|
}; |
||||
|
options.challengePriority = [ 'http-01', 'dns-01' ]; |
||||
|
|
||||
|
// TODO make Promise-friendly
|
||||
|
return PromiseA.all(claims.map(function (claim) { |
||||
|
var hostname = claim.identifier.value; |
||||
|
return PromiseA.all(claim.challenges.map(function (c) { |
||||
|
var keyAuth = BACME.challenges['http-01']({ |
||||
|
token: c.token |
||||
|
, thumbprint: thumbprint |
||||
|
, challengeDomain: hostname |
||||
|
}); |
||||
|
return BACME.challenges['dns-01']({ |
||||
|
keyAuth: keyAuth.value |
||||
|
, challengeDomain: hostname |
||||
|
}).then(function (dnsAuth) { |
||||
|
var data = { |
||||
|
type: c.type |
||||
|
, hostname: hostname |
||||
|
, url: c.url |
||||
|
, token: c.token |
||||
|
, keyAuthorization: keyAuth |
||||
|
, httpPath: keyAuth.path |
||||
|
, httpAuth: keyAuth.value |
||||
|
, dnsType: dnsAuth.type |
||||
|
, dnsHost: dnsAuth.host |
||||
|
, dnsAnswer: dnsAuth.answer |
||||
|
}; |
||||
|
|
||||
|
console.log(''); |
||||
|
console.log('CHALLENGE'); |
||||
|
console.log(claim); |
||||
|
console.log(c); |
||||
|
console.log(data); |
||||
|
console.log(''); |
||||
|
|
||||
|
if (claim.wildcard) { |
||||
|
obj.wildcard.push(data); |
||||
|
let verification = $qs(".js-acme-verification-wildcard"); |
||||
|
verification.querySelector(".js-acme-ver-hostname").innerHTML = data.hostname; |
||||
|
verification.querySelector(".js-acme-ver-txt-host").innerHTML = data.dnsHost; |
||||
|
verification.querySelector(".js-acme-ver-txt-value").innerHTML = data.dnsAnswer; |
||||
|
|
||||
|
} else if(obj[data.type]) { |
||||
|
|
||||
|
obj[data.type].push(data); |
||||
|
|
||||
|
if ('dns-01' === data.type) { |
||||
|
let verification = $qs(".js-acme-verification-dns-01"); |
||||
|
verification.querySelector(".js-acme-ver-hostname").innerHTML = data.hostname; |
||||
|
verification.querySelector(".js-acme-ver-txt-host").innerHTML = data.dnsHost; |
||||
|
verification.querySelector(".js-acme-ver-txt-value").innerHTML = data.dnsAnswer; |
||||
|
} else if ('http-01' === data.type) { |
||||
|
$qs(".js-acme-ver-file-location").innerHTML = data.httpPath.split("/").slice(-1); |
||||
|
$qs(".js-acme-ver-content").innerHTML = data.httpAuth; |
||||
|
$qs(".js-acme-ver-uri").innerHTML = data.httpPath; |
||||
|
$qs(".js-download-verify-link").href = |
||||
|
"data:text/octet-stream;base64," + window.btoa(data.httpAuth); |
||||
|
$qs(".js-download-verify-link").download = data.httpPath.split("/").slice(-1); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
}); |
||||
|
|
||||
|
})); |
||||
|
})).then(function () { |
||||
|
|
||||
|
// hide wildcard if no wildcard
|
||||
|
// hide http-01 and dns-01 if only wildcard
|
||||
|
if (!obj.wildcard.length) { |
||||
|
$qs('.js-acme-wildcard-challenges').hidden = true; |
||||
|
} |
||||
|
if (!obj['http-01'].length) { |
||||
|
$qs('.js-acme-challenges').hidden = true; |
||||
|
} |
||||
|
|
||||
|
updateChallengeType(); |
||||
|
|
||||
|
console.log("MAGIC STEP NUMBER in 2 is:", i); |
||||
|
steps[i](); |
||||
|
}); |
||||
|
|
||||
|
}); |
||||
|
}); |
||||
|
}).catch(function (err) { |
||||
|
console.error('Step \'\' Error:'); |
||||
|
console.error(err, err.stack); |
||||
|
window.alert("An error happened at Step " + i + ", but it's not your fault. Email aj@rootprojects.org and let him know."); |
||||
|
}); |
||||
|
}; |
||||
|
|
||||
|
steps[3] = function () { |
||||
|
updateProgress(1); |
||||
|
hideForms(); |
||||
|
$qs('.js-acme-form-challenges').hidden = false; |
||||
|
}; |
||||
|
steps[3].submit = function () { |
||||
|
options.challengeTypes = [ 'dns-01' ]; |
||||
|
if ('http-01' === $qs('.js-acme-challenge-type:checked').value) { |
||||
|
options.challengeTypes.unshift('http-01'); |
||||
|
} |
||||
|
console.log('primary challenge type is:', options.challengeTypes[0]); |
||||
|
|
||||
|
return getAccountKeypair(email).then(function (jwk) { |
||||
|
// for now just show the next page immediately (its a spinner)
|
||||
|
// TODO put a test challenge in the list
|
||||
|
// TODO warn about wait-time if DNS
|
||||
|
steps[i](); |
||||
|
return getServerKeypair().then(function () { |
||||
|
return acme.orders.finalize({ |
||||
|
account: accountStuff.account |
||||
|
, accountKeypair: { privateKeyJwk: jwk } |
||||
|
, order: accountStuff.order |
||||
|
, domainKeypair: 'TODO' |
||||
|
}); |
||||
|
}).then(function (certs) { |
||||
|
console.log('WINNING!'); |
||||
|
console.log(certs); |
||||
|
$qs('#js-fullchain').innerHTML = certs; |
||||
|
$qs("#js-download-fullchain-link").href = |
||||
|
"data:text/octet-stream;base64," + window.btoa(certs); |
||||
|
|
||||
|
var wcOpts; |
||||
|
var pemName; |
||||
|
if (/^R/.test(info.serverJwk.kty)) { |
||||
|
pemName = 'RSA'; |
||||
|
wcOpts = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } }; |
||||
|
} else { |
||||
|
pemName = 'EC'; |
||||
|
wcOpts = { name: "ECDSA", namedCurve: "P-256" }; |
||||
|
} |
||||
|
return crypto.subtle.importKey( |
||||
|
"jwk" |
||||
|
, info.serverJwk |
||||
|
, wcOpts |
||||
|
, true |
||||
|
, ["sign"] |
||||
|
).then(function (privateKey) { |
||||
|
return window.crypto.subtle.exportKey("pkcs8", privateKey); |
||||
|
}).then (function (keydata) { |
||||
|
var pem = spkiToPEM(keydata, pemName); |
||||
|
$qs('#js-privkey').innerHTML = pem; |
||||
|
$qs("#js-download-privkey-link").href = |
||||
|
"data:text/octet-stream;base64," + window.btoa(pem); |
||||
|
steps[i](); |
||||
|
}); |
||||
|
}); |
||||
|
}).then(function () { |
||||
|
return submitForm(); |
||||
|
}); |
||||
|
}; |
||||
|
|
||||
|
// spinner
|
||||
|
steps[4] = function () { |
||||
|
updateProgress(1); |
||||
|
hideForms(); |
||||
|
$qs('.js-acme-form-poll').hidden = false; |
||||
|
}; |
||||
|
steps[4].submit = function () { |
||||
|
console.log('Congrats! Auto advancing...'); |
||||
|
|
||||
|
|
||||
|
}).catch(function (err) { |
||||
|
console.error(err.toString()); |
||||
|
window.alert("An error happened in the final step, but it's not your fault. Email aj@rootprojects.org and let him know."); |
||||
|
}); |
||||
|
}; |
||||
|
|
||||
|
steps[5] = function () { |
||||
|
updateProgress(2); |
||||
|
hideForms(); |
||||
|
$qs('.js-acme-form-download').hidden = false; |
||||
|
}; |
||||
|
steps[1](); |
||||
|
|
||||
|
var params = new URLSearchParams(window.location.search); |
||||
|
var apiType = params.get('acme-api-type') || "staging-v02"; |
||||
|
|
||||
|
$qsa('.js-acme-api-type').forEach(function ($el) { |
||||
|
$el.addEventListener('change', updateApiType); |
||||
|
}); |
||||
|
|
||||
|
updateApiType(); |
||||
|
|
||||
|
$qsa('.js-acme-form').forEach(function ($el) { |
||||
|
$el.addEventListener('submit', function (ev) { |
||||
|
ev.preventDefault(); |
||||
|
submitForm(ev); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
|
||||
|
$qsa('.js-acme-challenge-type').forEach(function ($el) { |
||||
|
$el.addEventListener('change', updateChallengeType); |
||||
|
}); |
||||
|
|
||||
|
if(params.has('acme-domains')) { |
||||
|
console.log("acme-domains param: ", params.get('acme-domains')); |
||||
|
$qs('.js-acme-domains').value = params.get('acme-domains'); |
||||
|
|
||||
|
$qsa('.js-acme-api-type').forEach(function(ele) { |
||||
|
if(ele.value === apiType) { |
||||
|
ele.checked = true; |
||||
|
} |
||||
|
}); |
||||
|
|
||||
|
updateApiType(); |
||||
|
steps[2](); |
||||
|
submitForm(); |
||||
|
} |
||||
|
|
||||
|
$qs('body').hidden = false; |
||||
|
|
||||
|
return testKeypairSupport().then(function (rsaSupport) { |
||||
|
if (rsaSupport) { |
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
return testRsaSupport().then(function () { |
||||
|
console.info('[crypto] RSA is supported'); |
||||
|
}).catch(function (err) { |
||||
|
console.error('[crypto] could not use either RSA nor EC.'); |
||||
|
console.error(err); |
||||
|
window.alert("Generating secure certificates requires a browser with cryptography support." |
||||
|
+ "Please consider a recent version of Chrome, Firefox, or Safari."); |
||||
|
throw err; |
||||
|
}); |
||||
|
}); |
||||
|
}()); |
Loading…
Reference in new issue