From 4015e792ddded59931fe0cce85ff11336078f41d Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Wed, 16 Dec 2015 00:13:07 +0000 Subject: [PATCH] updates --- README.md | 20 +- lib/get-certificate.js | 418 +++++++++++++++++++++-------------------- node.js | 2 +- 3 files changed, 222 insertions(+), 218 deletions(-) diff --git a/README.md b/README.md index 511f72c..bba14cb 100644 --- a/README.md +++ b/README.md @@ -23,19 +23,21 @@ leCore. ## API -``` -LeCore.registerNewAccount(); +```javascript +LeCore.registerNewAccount(options, cb); -LeCore.getCertificate(); +LeCore.getCertificate(options, cb); -LeCore.Acme // Signs requests with JWK - acme = new Acme(lePrivateKey) // privateKey format is abstract - acme.post(url, body, cb) // POST with signature - acme.parseLinks(link) // (internal) parses 'link' header - acme.getNonce(url, cb) // (internal) HEAD request to get 'replay-nonce' strings +LeCore.Acme // Signs requests with JWK + acme = new Acme(lePrivateKey) // privateKey format is abstract + acme.post(url, body, cb) // POST with signature + acme.parseLinks(link) // (internal) parses 'link' header + acme.getNonce(url, cb) // (internal) HEAD request to get 'replay-nonce' strings LeCore.leCrypto - generateSignature(lePrivateKey, nodeBufferBody, nonceString) + thumbprint(lePubKey) // generates thumbprint + generateSignature(lePrivKey, bodyBuf, nonce) // generates a signature + importPemPrivateKey(privateKeyPem); // returns abstract private key ``` For testing and development, you can also inject the dependencies you want to use: diff --git a/lib/get-certificate.js b/lib/get-certificate.js index 47dd039..5073df4 100644 --- a/lib/get-certificate.js +++ b/lib/get-certificate.js @@ -4,243 +4,245 @@ * Some code used from https://github.com/letsencrypt/boulder/tree/master/test/js * MPL 2.0 */ - 'use strict'; -var NOOP=function () {}, log=NOOP; -var request=require('request'); -var util=require('./acme-util'); -var cryptoUtil=require('./crypto-util'); -var Acme = require('./acme-client'); +module.exports.create = function (deps) { + var NOOP=function () {}, log=NOOP; + var request=require('request'); + var util=require('./acme-util'); + var importPemPrivateKey = deps.leCrypto.importPemPrivateKey; + var thumbprinter = deps.leCrypto.thumbprint; + var generateCsr = deps.leCrypto.generateCsr || deps.leCrypto.generateCSR; + var Acme = deps.Acme; -function getCert(options, cb) { - var state={ - validatedDomains:[] - , validAuthorizationUrls:[] - , newAuthorizationUrl: options.newAuthorizationUrl || options.newAuthz - , newCertificateUrl: options.newCertificateUrl || options.newCert - }; + function getCert(options, cb) { + var state={ + validatedDomains:[] + , validAuthorizationUrls:[] + , newAuthorizationUrl: options.newAuthorizationUrl || options.newAuthz + , newCertificateUrl: options.newCertificateUrl || options.newCert + }; - if (!options.accountPrivateKeyPem) { - return handleErr(new Error("options.accountPrivateKeyPem must be an ascii private key pem")); - } - if (!options.domainPrivateKeyPem) { - return handleErr(new Error("options.domainPrivateKeyPem must be an ascii private key pem")); - } - if (!options.setChallenge) { - return handleErr(new Error("options.setChallenge must be function(hostname, challengeKey, tokenValue, done) {}")); - } - if (!options.removeChallenge) { - return handleErr(new Error("options.removeChallenge must be function(hostname, challengeKey, done) {}")); - } - if (!(options.domains && options.domains.length)) { - return handleErr(new Error("options.domains must be an array of domains such as ['example.com', 'www.example.com']")); - } - - state.domains = options.domains.slice(0); // copy array - try { - state.accountKeyPem=options.accountPrivateKeyPem; - state.accountKeyPair=cryptoUtil.importPemPrivateKey(state.accountKeyPem); - state.acme=new Acme(state.accountKeyPair); - state.certPrivateKeyPem=options.domainPrivateKeyPem; - state.certPrivateKey=cryptoUtil.importPemPrivateKey(state.certPrivateKeyPem); - } catch(err) { - return handleErr(err, 'Failed to parse privateKey'); - } - - nextDomain(); - - function nextDomain() { - if (state.domains.length > 0) { - getChallenges(state.domains.shift()); - return; - } else { - getCertificate(); + if (!options.accountPrivateKeyPem) { + return handleErr(new Error("options.accountPrivateKeyPem must be an ascii private key pem")); + } + if (!options.domainPrivateKeyPem) { + return handleErr(new Error("options.domainPrivateKeyPem must be an ascii private key pem")); + } + if (!options.setChallenge) { + return handleErr(new Error("options.setChallenge must be function(hostname, challengeKey, tokenValue, done) {}")); + } + if (!options.removeChallenge) { + return handleErr(new Error("options.removeChallenge must be function(hostname, challengeKey, done) {}")); + } + if (!(options.domains && options.domains.length)) { + return handleErr(new Error("options.domains must be an array of domains such as ['example.com', 'www.example.com']")); } - } - function getChallenges(domain) { - state.domain=domain; + state.domains = options.domains.slice(0); // copy array + try { + state.accountKeyPem=options.accountPrivateKeyPem; + state.accountKeyPair=importPemPrivateKey(state.accountKeyPem); + state.acme=new Acme(state.accountKeyPair); + state.certPrivateKeyPem=options.domainPrivateKeyPem; + state.certPrivateKey=importPemPrivateKey(state.certPrivateKeyPem); + } catch(err) { + return handleErr(err, 'Failed to parse privateKey'); + } - state.acme.post(state.newAuthorizationUrl, { - resource:'new-authz', - identifier:{ - type:'dns', - value:state.domain, + nextDomain(); + + function nextDomain() { + if (state.domains.length > 0) { + getChallenges(state.domains.shift()); + return; + } else { + getCertificate(); } - }, getReadyToValidate); - } - - function getReadyToValidate(err, res, body) { - var links, authz, httpChallenges, challenge, thumbprint, keyAuthorization, challengePath; - - if (err) { - return handleErr(err); } - if (Math.floor(res.statusCode/100)!==2) { - return handleErr(null, 'Authorization request failed ('+res.statusCode+')'); + function getChallenges(domain) { + state.domain=domain; + + state.acme.post(state.newAuthorizationUrl, { + resource:'new-authz', + identifier:{ + type:'dns', + value:state.domain, + } + }, getReadyToValidate); } - links=Acme.parseLink(res.headers.link); - if (!links || !('next' in links)) { - return handleErr(err, 'Server didn\'t provide information to proceed (2)'); - } + function getReadyToValidate(err, res, body) { + var links, authz, httpChallenges, challenge, thumbprint, keyAuthorization, challengePath; - state.authorizationUrl=res.headers.location; - state.newCertificateUrl=links.next; + if (err) { + return handleErr(err); + } - authz=JSON.parse(body); + if (Math.floor(res.statusCode/100)!==2) { + return handleErr(null, 'Authorization request failed ('+res.statusCode+')'); + } - httpChallenges=authz.challenges.filter(function(x) { - return x.type==='http-01'; - }); - if (httpChallenges.length===0) { - return handleErr(null, 'Server didn\'t offer any challenge we can handle.'); - } - challenge=httpChallenges[0]; + links=Acme.parseLink(res.headers.link); + if (!links || !('next' in links)) { + return handleErr(err, 'Server didn\'t provide information to proceed (2)'); + } - thumbprint=cryptoUtil.thumbprint(state.accountKeyPair.publicKey); - keyAuthorization=challenge.token+'.'+thumbprint; - state.responseUrl=challenge.uri; + state.authorizationUrl=res.headers.location; + state.newCertificateUrl=links.next; - options.setChallenge(state.domain, challenge.token, keyAuthorization, challengeDone); + authz=JSON.parse(body); - function challengeDone() { - state.acme.post(state.responseUrl, { - resource:'challenge', - keyAuthorization:keyAuthorization - }, function(err, res, body) { - ensureValidation(err, res, body, function unlink() { - options.removeChallenge(state.domain, challenge.token, function () { - // ignore + httpChallenges=authz.challenges.filter(function(x) { + return x.type==='http-01'; + }); + if (httpChallenges.length===0) { + return handleErr(null, 'Server didn\'t offer any challenge we can handle.'); + } + challenge=httpChallenges[0]; + + thumbprint=thumbprinter(state.accountKeyPair.publicKey); + keyAuthorization=challenge.token+'.'+thumbprint; + state.responseUrl=challenge.uri; + + options.setChallenge(state.domain, challenge.token, keyAuthorization, challengeDone); + + function challengeDone() { + state.acme.post(state.responseUrl, { + resource:'challenge', + keyAuthorization:keyAuthorization + }, function(err, res, body) { + ensureValidation(err, res, body, function unlink() { + options.removeChallenge(state.domain, challenge.token, function () { + // ignore + }); }); }); + } + } + + function ensureValidation(err, res, body, unlink) { + var authz; + + if (err || Math.floor(res.statusCode/100)!==2) { + unlink(); + return handleErr(err, 'Authorization status request failed ('+res.statusCode+')'); + } + + authz=JSON.parse(body); + + if (authz.status==='pending') { + setTimeout(function() { + request.get(state.authorizationUrl, {}, function(err, res, body) { + ensureValidation(err, res, body, unlink); + }); + }, 1000); + } else if (authz.status==='valid') { + log('Validating domain ... done'); + state.validatedDomains.push(state.domain); + state.validAuthorizationUrls.push(state.authorizationUrl); + unlink(); + nextDomain(); + } else if (authz.status==='invalid') { + unlink(); + return handleErr(null, 'The CA was unable to validate the file you provisioned', body); + } else { + unlink(); + return handleErr(null, 'CA returned an authorization in an unexpected state', authz); + } + } + + function getCertificate() { + var csr=generateCsr(state.certPrivateKey, state.validatedDomains); + log('Requesting certificate...'); + state.acme.post(state.newCertificateUrl, { + resource:'new-cert', + csr:csr, + authorizations:state.validAuthorizationUrls + }, downloadCertificate); + } + + function downloadCertificate(err, res, body) { + var links, certUrl; + + if (err || Math.floor(res.statusCode/100)!==2) { + log('Certificate request failed with error ', err); + if (body) { + log(body.toString()); + } + return handleErr(err, 'Certificate request failed'); + } + + links=Acme.parseLink(res.headers.link); + if (!links || !('up' in links)) { + return handleErr(err, 'Failed to fetch issuer certificate'); + } + + log('Requesting certificate: done'); + + state.certificate=body; + certUrl=res.headers.location; + request.get({ + url:certUrl, + encoding:null + }, function(err, res, body) { + if (err) { + return handleErr(err, 'Failed to fetch cert from '+certUrl); + } + if (res.statusCode!==200) { + return handleErr(err, 'Failed to fetch cert from '+certUrl, res.body.toString()); + } + if (body.toString()!==state.certificate.toString()) { + handleErr(null, 'Cert at '+certUrl+' did not match returned cert'); + } else { + log('Successfully verified cert at '+certUrl); + log('Requesting issuer certificate...'); + request.get({ + url:links.up, + encoding:null + }, function(err, res, body) { + if (err || res.statusCode!==200) { + return handleErr(err, 'Failed to fetch issuer certificate'); + } + state.caCert=certBufferToPem(body); + log('Requesting issuer certificate: done'); + done(); + }); + } }); } - } - function ensureValidation(err, res, body, unlink) { - var authz; + function done() { + var cert; - if (err || Math.floor(res.statusCode/100)!==2) { - unlink(); - return handleErr(err, 'Authorization status request failed ('+res.statusCode+')'); - } - - authz=JSON.parse(body); - - if (authz.status==='pending') { - setTimeout(function() { - request.get(state.authorizationUrl, {}, function(err, res, body) { - ensureValidation(err, res, body, unlink); - }); - }, 1000); - } else if (authz.status==='valid') { - log('Validating domain ... done'); - state.validatedDomains.push(state.domain); - state.validAuthorizationUrls.push(state.authorizationUrl); - unlink(); - nextDomain(); - } else if (authz.status==='invalid') { - unlink(); - return handleErr(null, 'The CA was unable to validate the file you provisioned', body); - } else { - unlink(); - return handleErr(null, 'CA returned an authorization in an unexpected state', authz); - } - } - - function getCertificate() { - var csr=cryptoUtil.generateCSR(state.certPrivateKey, state.validatedDomains); - log('Requesting certificate...'); - state.acme.post(state.newCertificateUrl, { - resource:'new-cert', - csr:csr, - authorizations:state.validAuthorizationUrls - }, downloadCertificate); - } - - function downloadCertificate(err, res, body) { - var links, certUrl; - - if (err || Math.floor(res.statusCode/100)!==2) { - log('Certificate request failed with error ', err); - if (body) { - log(body.toString()); + try { + cert=certBufferToPem(state.certificate); + } catch(e) { + console.error(e.stack); + //cb(new Error("Could not write output files. Please check permissions!")); + handleErr(e, 'Could not write output files. Please check permissions!'); + return; } - return handleErr(err, 'Certificate request failed'); + + cb(null, { + cert: cert + , key: state.certPrivateKeyPem + , ca: state.caCert + }); } - links=Acme.parseLink(res.headers.link); - if (!links || !('up' in links)) { - return handleErr(err, 'Failed to fetch issuer certificate'); + function handleErr(err, text, info) { + log(text, err, info); + cb(err || new Error(text)); } - - log('Requesting certificate: done'); - - state.certificate=body; - certUrl=res.headers.location; - request.get({ - url:certUrl, - encoding:null - }, function(err, res, body) { - if (err) { - return handleErr(err, 'Failed to fetch cert from '+certUrl); - } - if (res.statusCode!==200) { - return handleErr(err, 'Failed to fetch cert from '+certUrl, res.body.toString()); - } - if (body.toString()!==state.certificate.toString()) { - handleErr(null, 'Cert at '+certUrl+' did not match returned cert'); - } else { - log('Successfully verified cert at '+certUrl); - log('Requesting issuer certificate...'); - request.get({ - url:links.up, - encoding:null - }, function(err, res, body) { - if (err || res.statusCode!==200) { - return handleErr(err, 'Failed to fetch issuer certificate'); - } - state.caCert=certBufferToPem(body); - log('Requesting issuer certificate: done'); - done(); - }); - } - }); } - function done() { - var cert; - - try { - cert=certBufferToPem(state.certificate); - } catch(e) { - console.error(e.stack); - //cb(new Error("Could not write output files. Please check permissions!")); - handleErr(e, 'Could not write output files. Please check permissions!'); - return; - } - - cb(null, { - cert: cert - , key: state.certPrivateKeyPem - , ca: state.caCert - }); + function certBufferToPem(cert) { + cert=util.toStandardB64(cert.toString('base64')); + cert=cert.match(/.{1,64}/g).join('\n'); + return '-----BEGIN CERTIFICATE-----\n'+cert+'\n-----END CERTIFICATE-----'; } - function handleErr(err, text, info) { - log(text, err, info); - cb(err || new Error(text)); - } - -} - -function certBufferToPem(cert) { - cert=util.toStandardB64(cert.toString('base64')); - cert=cert.match(/.{1,64}/g).join('\n'); - return '-----BEGIN CERTIFICATE-----\n'+cert+'\n-----END CERTIFICATE-----'; -} - -module.exports = getCert; + return getCert; +}; diff --git a/node.js b/node.js index 8e10151..150b2f0 100644 --- a/node.js +++ b/node.js @@ -9,7 +9,7 @@ function create(deps) { var LeCore = {}; LeCore.leCrypto = deps.leCrypto; - LeCore.Acme = require('./lib/acme-client').create(deps); + deps.Acme = LeCore.Acme = require('./lib/acme-client').create(deps); LeCore.registerNewAccount = require('./lib/register-new-account').create(deps); LeCore.getCertificate = require('./lib/get-certificate').create(deps);