From 9d69a0f4a960cdb60528a7396ee099883f9de31f Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Wed, 10 Aug 2016 20:37:03 -0400 Subject: [PATCH] initial commit --- README.md | 104 ++++++++++++++++++++++++++++++++++++++- index.js | 123 ++++++++++++++++++++++++++++++++++++++++++++++ test.js | 142 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 367 insertions(+), 2 deletions(-) create mode 100644 index.js create mode 100644 test.js diff --git a/README.md b/README.md index 3dc5814..c3d0584 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,102 @@ -# le-sni-auto -An auto-sni strategy for registering and renewing letsencrypt certificates using SNICallback +le-sni-auto +=========== + +**DRAFT** this is not yet published to npm + +An auto-sni strategy for registering and renewing letsencrypt certificates using SNICallback. + +This does a couple of rather simple things: + + * caches certificates in memory + * calls `getCertificatesAsync(domain, null)` when a certificate is not in memory + * calls `getCertificatesASync(domain, certs)` when a certificate is up for renewal or expired + +Install +======= + +```bash +npm install --save le-sni-auto@2.x +``` + +Usage +===== + +With node-letsencrypt +--------------------- + +```javascript +'use strict'; + + + +var leSni = require('le-sni-auto').create({ + + notBefore: 10 * 24 * 60 * 60 1000 // do not renew more than 10 days before expiration +, notAfter: 5 * 24 * 60 * 60 1000 // do not wait more than 5 days before expiration + +, httpsOptions: { + rejectUnauthorized: true // These options will be used with tls.createSecureContext() + , requestCert: false // in addition to key (privkey.pem) and cert (cert.pem + chain.pem), + , ca: null // which are provided by letsencrypt + , crl: null + } + +}); + + + +var le = require('letsencrypt').create({ + server: 'staging' + +, sni: leSni + +, approveDomains: function (domain, cb) { + // here you would lookup details such as email address in your db + cb(null, { email: 'john.doe@gmail.com.', domains: [domain, 'www.' + domain], agreeTos: true }} + } +}); + + + +var app = require('express')(); +var httpsOptions = { SNICallback: le.sni.callback }; + +httpsOptions = require('localhost.daplie.com-certificates').merge(httpsOptions); + + +http.createServer(le.handleAcmeOrRedirectToHttps()); +https.createServer(dummyCerts, le.handleAcmeOrUse(app)).listen(443); +``` + +You can also provide a thunk-style `getCertificates(domain, certs, cb)`. + +Standalone +---------- + +```javascript +'use strict'; + + +var le = require('letsencrypt').create({ + notBefore: 10 * 24 * 60 * 60 1000 // do not renew prior to 10 days before expiration +, notAfter: 5 * 24 * 60 * 60 1000 // do not wait more than 5 days before expiration + + // key (privkey.pem) and cert (cert.pem + chain.pem) will be provided by letsencrypt +, httpsOptions: { rejectUnauthorized: true, requestCert: false, ca: null, crl: null } + +, getCertificatesAsync: function (domain, certs) { + // return a promise with an object with the following keys: + // { privkey, cert, chain, expiresAt, issuedAt, subject, altnames } + } +}); + + + + +var dummyCerts = require('localhost.daplie.com-certificates'); +dummyCerts.SNICallback = le.sni.sniCallback; + +https.createServer(dummyCerts, ); +``` + +You can also provide a thunk-style `getCertificates(domain, certs, cb)`. diff --git a/index.js b/index.js new file mode 100644 index 0000000..4c98f5c --- /dev/null +++ b/index.js @@ -0,0 +1,123 @@ +'use strict'; + +// autoSni = { notBefore, notAfter, getCertificates, httpsOptions, _dbg_now } +module.exports.create = function (autoSni) { + + var DAY = 24 * 60 * 60 * 1000; + var MIN = 60 * 1000; + if (!autoSni.getCertificatesAsync) { autoSni.getCertificatesAsync = require('bluebird').promisify(autoSni.getCertificates); } + if (!autoSni.notBefore) { throw new Error("must supply options.notBefore (and options.notAfter)"); } + if (!autoSni.notAfter) { autoSni.notAfter = autoSni.notBefore - (3 * DAY); } + if (!autoSni.httpsOptions) { autoSni.httpOptions = {}; } + + + + + //autoSni.renewWithin = autoSni.notBefore; // i.e. 15 days + autoSni.renewWindow = autoSni.notBefore - autoSni.notAfter; // i.e. 1 day + //autoSni.renewRatio = autoSni.notBefore = autoSni.renewWindow; // i.e. 1/15 (6.67%) + + + + + var tls = require('tls'); + + + + + var _autoSni = { + + + + + // in-process cache + _ipc: {} + // just to account for clock skew + , _fiveMin: 5 * MIN + + + + + // cache and format incoming certs + , _cacheCerts: function (certs) { + var meta = { + certs: certs + , tlsContext: !autoSni._dbg_now && tls.createSecureContext({ + key: certs.privkey + , cert: certs.cert + certs.chain + , rejectUnauthorized: autoSni.httpsOptions.rejectUnauthorized + + , requestCert: autoSni.httpsOptions.requestCert // request peer verification + , ca: autoSni.httpsOptions.ca // this chain is for incoming peer connctions + , crl: autoSni.httpsOptions.crl // this crl is for incoming peer connections + }) || { '_fake_tls_context_': true } + + , subject: certs.subject + // stagger renewal time by a little bit of randomness + , renewAt: (certs.expiresAt - (autoSni.notBefore - (autoSni.renewWindow * Math.random()))) + // err just barely on the side of safety + , expiresNear: certs.expiresAt - autoSni._fiveMin + }; + var link = { subject: certs.subject }; + + certs.altnames.forEach(function (domain) { + autoSni._ipc[domain] = link; + }); + autoSni._ipc[certs.subject] = meta; + + return meta; + } + + + + + // automate certificate registration on request + , sniCallback: function (domain, cb) { + var certMeta = autoSni._ipc[domain]; + var promise; + var now = (autoSni._dbg_now || Date.now()); + + if (certMeta && certMeta.subject !== domain) { + certMeta = autoSni._ipc[domain]; + } + + if (!certMeta) { + // we don't have a cert and must get one + promise = autoSni.getCertificatesAsync(domain, null); + } + else if (now >= certMeta.expiresNear) { + // we have a cert, but it's no good for the average user + promise = autoSni.getCertificatesAsync(domain, certMeta.certs); + } else { + + // it's time to renew the cert + if (now >= certMeta.renewAt) { + // give the cert some time (2-5 min) to be validated and replaced before trying again + certMeta.renewAt = (autoSni._dbg_now || Date.now()) + (2 * MIN) + (3 * MIN * Math.random()); + // let the update happen in the background + autoSni.getCertificatesAsync(domain, certMeta.certs).then(autoSni._cacheCerts); + } + + // return the valid cert right away + cb(null, certMeta.tlsContext); + return; + } + + // promise the non-existent or expired cert + promise.then(autoSni._cacheCerts).then(function (certMeta) { + cb(null, certMeta.tlsContext); + }, cb); + } + + + + + }; + + Object.keys(_autoSni).forEach(function (key) { + autoSni[key] = _autoSni[key]; + }); + _autoSni = null; + + return autoSni; +}; diff --git a/test.js b/test.js new file mode 100644 index 0000000..ca47b61 --- /dev/null +++ b/test.js @@ -0,0 +1,142 @@ +'use strict'; + +var DAY = 24 * 60 * 60 * 1000; +var MIN = 60 * 1000; +var START_DAY = new Date(2015, 0, 1, 17, 30, 0, 0).valueOf(); +var NOT_BEFORE = 10 * DAY; +var NOT_AFTER = 5 * DAY; +var EXPIRES_AT = START_DAY + NOT_BEFORE + (15 * MIN); +var RENEWABLE_DAY = EXPIRES_AT - (60 * MIN); +var CERT_1 = { + expiresAt: EXPIRES_AT +, subject: 'example.com' +, altnames: ['example.com', 'www.example.com'] +}; +var CERT_2 = { + expiresAt: EXPIRES_AT + NOT_BEFORE + (60 * MIN) +, subject: 'example.com' +, altnames: ['example.com', 'www.example.com'] +}; + +var count = 0; +var expectedCount = 3; +var tests = [ + function (domain, certs, cb) { + count += 1; + console.log('#1 is 1 of 3'); + if (!domain) { + throw new Error("should have a domain"); + } + + if (certs) { + console.log('certs'); + console.log(certs); + throw new Error("shouldn't have certs that don't even exist yet"); + } + + cb(null, CERT_1); + } +, function (/*domain, certs, cb*/) { + console.log('#2 should NOT be called'); + throw new Error("Should not call register renew a certificate with more than 10 days left"); + } +, function (domain, certs, cb) { + count += 1; + console.log('#3 is 2 of 3'); + // NOTE: there's a very very small chance this will fail occasionally (if Math.random() < 0.01) + if (!certs) { + throw new Error("should have certs to renew (renewAt)"); + } + + cb(null, CERT_1); + } +, function (domain, certs, cb) { + count += 1; + console.log('#4 is 3 of 3'); + if (!certs) { + throw new Error("should have certs to renew (expiresNear)"); + } + + cb(null, CERT_2); + } +, function (/*domain, certs, cb*/) { + console.log('#5 should NOT be called'); + throw new Error("Should not call register renew a certificate with more than 10 days left"); + } +].map(function (fn) { + return require('bluebird').promisify(fn); +}); + +// opts = { notBefore, notAfter, letsencrypt.renew, letsencrypt.register, httpsOptions } +var leSni = require('./').create({ + notBefore: NOT_BEFORE +, notAfter: NOT_AFTER +, getCertificatesAsync: tests.shift() +, _dbg_now: START_DAY +}); + +leSni.sniCallback('example.com', function (err, tlsContext) { + if (err) { throw err; } + if (!tlsContext._fake_tls_context_) { + throw new Error("Did not return tlsContext 0"); + } + leSni.getCertificatesAsync = tests.shift(); + + + + + leSni.sniCallback('example.com', function (err, tlsContext) { + if (err) { throw err; } + if (!tlsContext._fake_tls_context_) { + throw new Error("Did not return tlsContext 1"); + } + leSni.getCertificatesAsync = tests.shift(); + + leSni._dbg_now = RENEWABLE_DAY; + + + + + leSni.sniCallback('example.com', function (err, tlsContext) { + if (err) { throw err; } + if (!tlsContext._fake_tls_context_) { + throw new Error("Did not return tlsContext 2"); + } + leSni.getCertificatesAsync = tests.shift(); + + leSni._dbg_now = EXPIRES_AT; + + + + + leSni.sniCallback('example.com', function (err, tlsContext) { + if (err) { throw err; } + if (!tlsContext._fake_tls_context_) { + throw new Error("Did not return tlsContext 2"); + } + leSni.getCertificatesAsync = tests.shift(); + + + + + leSni.sniCallback('example.com', function (err, tlsContext) { + if (err) { throw err; } + if (!tlsContext._fake_tls_context_) { + throw new Error("Did not return tlsContext 2"); + } + + if (expectedCount === count && !tests.length) { + console.log('PASS'); + return; + } + + throw new Error("only " + count + " of the register getCertificate were called"); + }); + + + + + }); + }); + }); +});