push.rocks/smartacme
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(swaitch to acme-v2): switch to letsencrypt v2

Browse Source
This commit is contained in:
Philipp Kunz
2018-08-12 00:29:02 +02:00
parent 3e350dfed5
commit 9eda0da9a7
24 changed files with 1460 additions and 1144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

94
ts/smartacme.classes.acmeaccount.ts
View File

@ -1,94 +0,0 @@
import * as q from 'smartq'
import * as plugins from './smartacme.plugins'
import * as helpers from './smartacme.helpers'
import { SmartAcme, IRsaKeypair } from './smartacme.classes.smartacme'
import { AcmeCert } from './smartacme.classes.acmecert'
/**
* class AcmeAccount represents an AcmeAccount
*/
export class AcmeAccount {
parentSmartAcme: SmartAcme
location: string
link: string
JWK
constructor(smartAcmeParentArg: SmartAcme) {
this.parentSmartAcme = smartAcmeParentArg
}
/**
* register the account with letsencrypt
*/
register() {
let done = q.defer()
this.parentSmartAcme.rawacmeClient.newReg(
{
contact: [ 'mailto:domains@lossless.org' ]
},
(err, res) => {
if (err) {
console.error('smartacme: something went wrong:')
console.log(err)
done.reject(err)
return
}
this.JWK = res.body.key
this.link = res.headers.link
console.log(this.link)
this.location = res.headers.location
done.resolve()
})
return done.promise
}
/**
* agree to letsencrypr terms of service
*/
agreeTos() {
let done = q.defer()
let tosPart = this.link.split(',')[ 1 ]
let tosLinkPortion = tosPart.split(';')[ 0 ]
let url = tosLinkPortion.split(';')[ 0 ].trim().replace(/[<>]/g, '')
this.parentSmartAcme.rawacmeClient.post(this.location, { Agreement: url, resource: 'reg' }, (err, res) => {
if (err) {
console.log(err)
done.reject(err)
return
}
done.resolve()
})
return done.promise
}
createAcmeCert(
domainNameArg: string,
countryArg = 'Germany',
countryShortArg = 'DE',
city = 'Bremen',
companyArg = 'Some Company',
companyShortArg = 'SC'
) {
let done = q.defer<AcmeCert>()
let acmeCert = new AcmeCert(
{
bit: 2064,
key: null, // not needed right now
domain: domainNameArg,
country: countryArg,
country_short: countryShortArg,
locality: city,
organization: companyArg,
organization_short: companyShortArg,
password: null,
unstructured: null,
subject_alt_names: null
},
this
)
done.resolve(acmeCert)
return done.promise
}
}

255
ts/smartacme.classes.acmecert.ts
View File

@ -1,255 +0,0 @@
import * as q from 'smartq'
import * as plugins from './smartacme.plugins'
import * as helpers from './smartacme.helpers'
import { SmartAcme, IRsaKeypair } from './smartacme.classes.smartacme'
import { AcmeAccount } from './smartacme.classes.acmeaccount'
/**
* types of challenges supported by letsencrypt and this module
*/
export type TChallengeType = 'dns-01' | 'http-01'
/**
* values that a challenge's status can have
*/
export type TChallengeStatus = 'pending'
export interface ISmartAcmeChallenge {
uri: string
status: TChallengeStatus
type: TChallengeType
token: string
keyAuthorization: string
}
export interface ISmartAcmeChallengeChosen extends ISmartAcmeChallenge {
dnsKeyHash: string
domainName: string
domainNamePrefixed: string
}
export interface IAcmeCsrConstructorOptions {
bit: number,
key: string,
domain: string,
country: string,
country_short: string,
locality: string,
organization: string,
organization_short: string,
password: string,
unstructured: string,
subject_alt_names: string[]
}
// Dnsly instance (we really just need one)
let myDnsly = new plugins.dnsly.Dnsly('google')
/**
* class AcmeCert represents a cert for domain
*/
export class AcmeCert {
domainName: string
attributes
fullchain: string
parentAcmeAccount: AcmeAccount
csr
validFrom: Date
validTo: Date
keypair: IRsaKeypair
keyPairFinal: IRsaKeypair
chosenChallenge: ISmartAcmeChallengeChosen
dnsKeyHash: string
constructor(optionsArg: IAcmeCsrConstructorOptions, parentAcmeAccount: AcmeAccount) {
this.domainName = optionsArg.domain
this.parentAcmeAccount = parentAcmeAccount
this.keypair = helpers.createKeypair(optionsArg.bit)
let privateKeyForged = plugins.nodeForge.pki.privateKeyFromPem(this.keypair.privateKey)
let publicKeyForged = plugins.nodeForge.pki.publicKeyToPem(
plugins.nodeForge.pki.setRsaPublicKey(privateKeyForged.n, privateKeyForged.e)
)
this.keyPairFinal = {
privateKey: privateKeyForged,
publicKey: publicKeyForged
}
// set dates
this.validFrom = new Date()
this.validTo = new Date()
this.validTo.setDate(this.validFrom.getDate() + 90)
// set attributes
this.attributes = [
{ name: 'commonName', value: optionsArg.domain },
{ name: 'countryName', value: optionsArg.country },
{ shortName: 'ST', value: optionsArg.country_short },
{ name: 'localityName', value: optionsArg.locality },
{ name: 'organizationName', value: optionsArg.organization },
{ shortName: 'OU', value: optionsArg.organization_short },
{ name: 'challengePassword', value: optionsArg.password },
{ name: 'unstructuredName', value: optionsArg.unstructured }
]
// set up csr
this.csr = plugins.nodeForge.pki.createCertificationRequest()
this.csr.setSubject(this.attributes)
this.csr.setAttributes(this.attributes)
}
/**
* requests a challenge for a domain
* @param domainNameArg - the domain name to request a challenge for
* @param challengeType - the challenge type to request
*/
requestChallenge(challengeTypeArg: TChallengeType = 'dns-01') {
let done = q.defer<ISmartAcmeChallengeChosen>()
this.parentAcmeAccount.parentSmartAcme.rawacmeClient.newAuthz(
{
identifier: {
type: 'dns',
value: this.domainName
}
},
this.parentAcmeAccount.parentSmartAcme.keyPair,
(err, res) => {
if (err) {
console.error('smartacme: something went wrong:')
console.log(err)
done.reject(err)
}
let preChosenChallenge = res.body.challenges.filter(x => {
return x.type === challengeTypeArg
})[ 0 ]
/**
* the key is needed to accept the challenge
*/
let authKey: string = plugins.rawacme.keyAuthz(
preChosenChallenge.token,
this.parentAcmeAccount.parentSmartAcme.keyPair.publicKey
)
/**
* needed in case selected challenge is of type dns-01
*/
this.dnsKeyHash = plugins.rawacme.dnsKeyAuthzHash(authKey) // needed if dns challenge is chosen
/**
* the return challenge
*/
this.chosenChallenge = {
uri: preChosenChallenge.uri,
type: preChosenChallenge.type,
token: preChosenChallenge.token,
keyAuthorization: authKey,
status: preChosenChallenge.status,
dnsKeyHash: this.dnsKeyHash,
domainName: this.domainName,
domainNamePrefixed: helpers.prefixName(this.domainName)
}
done.resolve(this.chosenChallenge)
}
)
return done.promise
}
/**
* checks if DNS records are set, will go through a max of 30 cycles
*/
async checkDns(cycleArg = 1) {
let result = await myDnsly.checkUntilAvailable(helpers.prefixName(this.domainName), 'TXT', this.dnsKeyHash)
if (result) {
console.log('DNS is set!')
return
} else {
throw new Error('DNS not set!')
}
}
/**
* validates a challenge, only call after you have set the challenge at the expected location
*/
async requestValidation() {
let makeRequest = () => {
let done = q.defer()
this.parentAcmeAccount.parentSmartAcme.rawacmeClient.poll(this.chosenChallenge.uri, async (err, res) => {
if (err) {
console.log(err)
return
}
console.log(`Validation response:`)
console.log(JSON.stringify(res.body))
if (res.body.status === 'pending' || res.body.status === 'invalid') {
await plugins.smartdelay.delayFor(3000)
makeRequest().then((x: any) => { done.resolve(x) })
} else {
console.log('perfect!')
done.resolve(res.body)
}
})
return done.promise
}
await makeRequest()
}
/**
* requests a certificate
*/
requestCert() {
let done = q.defer()
let payload = {
csr: plugins.rawacme.base64.encode(
plugins.rawacme.toDer(
plugins.nodeForge.pki.certificationRequestToPem(
this.csr
)
)
),
notBefore: this.validFrom.toISOString(),
notAfter: this.validTo.toISOString()
}
this.parentAcmeAccount.parentSmartAcme.rawacmeClient.newCert(
payload,
helpers.createKeypair(),
(err, res) => {
if (err) {
console.log(err)
done.reject(err)
}
console.log(res.body)
done.resolve(res.body)
})
return done.promise
}
/**
* getCertificate - takes care of cooldown, validation polling and certificate retrieval
*/
getCertificate() {
}
/**
* accept a challenge - for private use only
*/
acceptChallenge() {
let done = q.defer()
this.parentAcmeAccount.parentSmartAcme.rawacmeClient.post(
this.chosenChallenge.uri,
{
resource: 'challenge',
keyAuthorization: this.chosenChallenge.keyAuthorization
},
this.parentAcmeAccount.parentSmartAcme.keyPair,
(err, res) => {
if (err) {
console.log(err)
done.reject(err)
}
done.resolve(res.body)
}
)
return done.promise
}
}

27
ts/smartacme.classes.keypair.ts Normal file
View File

@ -0,0 +1,27 @@
import * as plugins from './smartacme.plugins';
const rsa = require('rsa-compat').RSA;
export class KeyPair {
rsaKeyPair: any
/**
* generates a fresh rsa keyPair
*/
static async generateFresh(): Promise<KeyPair> {
const done = plugins.smartpromise.defer();
var options = { bitlen: 2048, exp: 65537, public: true, pem: true, internal: true };
rsa.generateKeypair(options, function(err, keypair) {
if(err) {
console.log(err);
}
done.resolve(keypair);
});
const result: any = await done.promise;
const keyPair = new KeyPair(result);
return keyPair;
}
constructor(rsaKeyPairArg) {
this.rsaKeyPair = rsaKeyPairArg;
}
}

105
ts/smartacme.classes.smartacme.ts
View File

@ -1,82 +1,47 @@
// third party modules
import * as q from 'smartq' // promises
import * as plugins from './smartacme.plugins'
import * as helpers from './smartacme.helpers'
const acme = require('acme-v2').ACME.create({
RSA: require('rsa-compat').RSA,
import { AcmeAccount } from './smartacme.classes.acmeaccount'
// other overrides
promisify: require('util').promisify,
/**
* a rsa keypair needed for account creation and subsequent requests
*/
export interface IRsaKeypair {
publicKey: string
privateKey: string
}
// used for constructing user-agent
os: require('os'),
process: require('process'),
export { AcmeAccount } from './smartacme.classes.acmeaccount'
export { AcmeCert, ISmartAcmeChallenge, ISmartAcmeChallengeChosen } from './smartacme.classes.acmecert'
// used for overriding the default user-agent
userAgent: 'My custom UA String',
getUserAgentString: function(deps) {
return 'My custom UA String';
},
// don't try to validate challenges locally
skipChallengeTest: false
});
import { KeyPair } from './smartacme.classes.keypair';
/**
* class SmartAcme exports methods for maintaining SSL Certificates
*/
export class SmartAcme {
acmeUrl: string // the acme url to use for this instance
productionBool: boolean // a boolean to quickly know wether we are in production or not
keyPair: IRsaKeypair // the keyPair needed for account creation
rawacmeClient
keyPair: KeyPair;
directoryUrls: any;
/**
* the constructor for class SmartAcme
*/
constructor(productionArg: boolean = false) {
this.productionBool = productionArg
this.keyPair = helpers.createKeypair()
if (this.productionBool) {
this.acmeUrl = plugins.rawacme.LETSENCRYPT_URL
} else {
this.acmeUrl = plugins.rawacme.LETSENCRYPT_STAGING_URL
}
}
async init() {
// get directory url
this.directoryUrls = await acme.init('https://acme-staging-v02.api.letsencrypt.org/directory');
/**
* init the smartacme instance
*/
init() {
let done = q.defer()
plugins.rawacme.createClient(
{
url: this.acmeUrl,
publicKey: this.keyPair.publicKey,
privateKey: this.keyPair.privateKey
},
(err, client) => {
if (err) {
console.error('smartacme: something went wrong:')
console.log(err)
done.reject(err)
return
}
// create keyPair
this.keyPair = await KeyPair.generateFresh();
// make client available in class
this.rawacmeClient = client
done.resolve()
// get account
const registrationData = await acme.accounts.create({
email: 'domains@lossless.org', // valid email (server checks MX records)
accountKeypair: this.keyPair.rsaKeyPair,
agreeToTerms: async tosUrl => {
return tosUrl;
}
)
return done.promise
}
}).catch(e => {
console.log(e);
});
/**
* creates an account if not currently present in module
* @executes ASYNC
*/
createAcmeAccount() {
let done = q.defer<AcmeAccount>()
let acmeAccount = new AcmeAccount(this)
acmeAccount.register().then(() => {
return acmeAccount.agreeTos()
}).then(() => {
done.resolve(acmeAccount)
})
return done.promise
console.log(registrationData);
}
}

50
ts/smartacme.helpers.ts
View File

@ -1,50 +0,0 @@
import 'typings-global'
import * as q from 'smartq'
import * as plugins from './smartacme.plugins'
import { SmartAcme, IRsaKeypair } from './smartacme.classes.smartacme'
import { AcmeAccount } from './smartacme.classes.acmeaccount'
/**
* creates a keypair to use with requests and to generate JWK from
*/
export let createKeypair = (bit = 2048): IRsaKeypair => {
let result = plugins.rsaKeygen.generate(bit)
return {
publicKey: result.public_key,
privateKey: result.private_key
}
}
/**
* prefix a domain name to make sure it complies with letsencrypt
*/
export let prefixName = (domainNameArg: string): string => {
return '_acme-challenge.' + domainNameArg
}
/**
* gets an existing registration
* @executes ASYNC
*/
let getReg = (SmartAcmeArg: SmartAcme, location: string) => {
let done = q.defer()
let body = { resource: 'reg' }
SmartAcmeArg.rawacmeClient.post(
location,
body,
SmartAcmeArg.keyPair,
(err, res) => {
if (err) {
console.error('smartacme: something went wrong:')
console.log(err)
done.reject(err)
return
}
console.log(JSON.stringify(res.body))
done.resolve()
}
)
return done.promise
}

6
ts/smartacme.paths.ts
View File

@ -1,6 +0,0 @@
import * as path from 'path'
import * as smartfile from 'smartfile'
export let packageDir = path.join(__dirname,'../')
export let assetDir = path.join(packageDir,'assets/')
smartfile.fs.ensureDirSync(assetDir)

23
ts/smartacme.plugins.ts
View File

@ -1,22 +1,5 @@
import 'typings-global' // typings for node
import * as path from 'path' // native node path module
let rsaKeygen = require('rsa-keygen') // rsa keygen
let rawacme = require('rawacme') // acme helper functions
let nodeForge = require('node-forge')
// push.rocks modules here
import * as dnsly from 'dnsly'
import * as smartdelay from 'smartdelay'
import * as smartfile from 'smartfile'
import * as smartstring from 'smartstring'
import * as smartpromise from '@pushrocks/smartpromise';
export {
dnsly,
rsaKeygen,
rawacme,
nodeForge,
smartdelay,
smartfile,
smartstring
}
smartpromise
}