Merge pull request #14126 from jgrumboe/fix-13074

fix(backend): fix certificate validation

packages/backend-common/package.json

@@ -75,6 +75,7 @@
     "morgan": "^1.10.0",
     "node-abort-controller": "^3.0.1",
     "node-fetch": "^2.6.7",
+    "node-forge": "^1.3.1",
     "raw-body": "^2.4.1",
     "request": "^2.88.2",
     "selfsigned": "^2.0.0",
@@ -105,6 +106,7 @@
     "@types/minimist": "^1.2.0",
     "@types/mock-fs": "^4.13.0",
     "@types/morgan": "^1.9.0",
+    "@types/node-forge": "^1.3.0",
     "@types/recursive-readdir": "^2.2.0",
     "@types/stoppable": "^1.1.0",
     "@types/supertest": "^2.0.8",

packages/backend-common/src/service/lib/hostFactory.ts

@@ -21,8 +21,9 @@ import * as http from 'http';
 import * as https from 'https';
 import { Logger } from 'winston';
 import { HttpsSettings } from './config';
+import forge from 'node-forge';
 
-const ALMOST_MONTH_IN_MS = 25 * 24 * 60 * 60 * 1000;
+const FIVE_DAYS_IN_MS = 5 * 24 * 60 * 60 * 1000;
 
 const IP_HOSTNAME_REGEX = /:|^\d+\.\d+\.\d+\.\d+$/;
 
@@ -82,6 +83,16 @@ export async function createHttpsServer(
   return https.createServer(credentials, app) as http.Server;
 }
 
+function getCertificateExpiration(cert: string, logger?: Logger) {
+  try {
+    const crt = forge.pki.certificateFromPem(cert);
+    return crt.validity.notAfter.getTime() - Date.now();
+  } catch (error) {
+    logger?.warn(`Unable to parse self-signed certificate. ${error}`);
+    return 0;
+  }
+}
+
 async function getGeneratedCertificate(hostname: string, logger?: Logger) {
   const hasModules = await fs.pathExists('node_modules');
   let certPath;
@@ -94,23 +105,18 @@ async function getGeneratedCertificate(hostname: string, logger?: Logger) {
     certPath = resolvePath('.dev-cert.pem');
   }
 
-  let cert = undefined;
   if (await fs.pathExists(certPath)) {
-    const stat = await fs.stat(certPath);
-    const ageMs = Date.now() - stat.ctimeMs;
-    if (stat.isFile() && ageMs < ALMOST_MONTH_IN_MS) {
-      cert = await fs.readFile(certPath);
+    const cert = await fs.readFile(certPath);
+    const remainingMs = getCertificateExpiration(cert.toString(), logger);
+    if (remainingMs > FIVE_DAYS_IN_MS) {
+      logger?.info('Using existing self-signed certificate');
+      return {
+        key: cert,
+        cert,
+      };
     }
   }
 
-  if (cert) {
-    logger?.info('Using existing self-signed certificate');
-    return {
-      key: cert,
-      cert: cert,
-    };
-  }
-
   logger?.info('Generating new self-signed certificate');
   const newCert = await createCertificate(hostname);
   await fs.writeFile(certPath, newCert.cert + newCert.key, 'utf8');