From 751f58ff7cf14d5a4bd737ca35b75b31e23ad11f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 30 Dec 2020 12:14:41 +0100 Subject: [PATCH] backend-common: replace generated cert params with a simple bool switch, and fix certificate generation --- packages/backend-common/config.d.ts | 55 ++++++++++------ .../backend-common/src/service/lib/config.ts | 26 ++++++-- .../src/service/lib/hostFactory.ts | 64 +++++++++++++++++-- 3 files changed, 115 insertions(+), 30 deletions(-) diff --git a/packages/backend-common/config.d.ts b/packages/backend-common/config.d.ts index 3e21235c63..b7241bcc03 100644 --- a/packages/backend-common/config.d.ts +++ b/packages/backend-common/config.d.ts @@ -32,26 +32,41 @@ export interface Config { port?: string | number; }; - /** HTTPS configuration for the backend. If omitted the backend will serve HTTP */ - https?: { - /** Certificate configuration or parameters for generating a self-signed certificate */ - certificate?: - | { - /** Algorithm to use to generate a self-signed certificate */ - algorithm: string; - keySize?: number; - days?: number; - } - | { - /** PEM encoded certificate. Use $file to load in a file */ - cert: string; - /** - * PEM encoded certificate key. Use $file to load in a file. - * @visibility secret - */ - key: string; - }; - }; + /** + * HTTPS configuration for the backend. If omitted the backend will serve HTTP. + * + * Setting this to `true` will cause self-signed certificates to be generated, which + * can be useful for local development or other non-production scenarios. + */ + https?: + | true + | { + /** + * Certificate configuration or parameters for generating a self-signed certificate + * + * Setting parameters for self-signed certificates is deprecated and will be removed in + * the future, set `backend.https = true` instead. + */ + certificate?: + | { + /** Algorithm to use to generate a self-signed certificate */ + algorithm?: string; + keySize?: number; + days?: number; + attributes: { + commonName: string; + }; + } + | { + /** PEM encoded certificate. Use $file to load in a file */ + cert: string; + /** + * PEM encoded certificate key. Use $file to load in a file. + * @visibility secret + */ + key: string; + }; + }; /** Database connection configuration, select database type using the `client` field */ database: diff --git a/packages/backend-common/src/service/lib/config.ts b/packages/backend-common/src/service/lib/config.ts index ea1a2b0887..6abea97454 100644 --- a/packages/backend-common/src/service/lib/config.ts +++ b/packages/backend-common/src/service/lib/config.ts @@ -47,14 +47,14 @@ export type CertificateReferenceOptions = { }; export type CertificateSigningOptions = { - algorithm: string; + algorithm?: string; size?: number; days?: number; - attributes?: CertificateAttributes; + attributes: CertificateAttributes; }; export type CertificateAttributes = { - commonName?: string; + commonName: string; }; /** @@ -193,8 +193,26 @@ export function readCspOptions( * ``` */ export function readHttpsSettings(config: Config): HttpsSettings | undefined { - const cc = config.getOptionalConfig('https'); + const https = config.get('https'); + if (https === true) { + const baseUrl = config.getString('baseUrl'); + let commonName; + try { + commonName = new URL(baseUrl).hostname; + } catch (error) { + throw new Error(`Invalid backend.baseUrl "${baseUrl}"`); + } + return { + certificate: { + attributes: { + commonName, + }, + }, + }; + } + + const cc = config.getOptionalConfig('https'); if (!cc) { return undefined; } diff --git a/packages/backend-common/src/service/lib/hostFactory.ts b/packages/backend-common/src/service/lib/hostFactory.ts index 8fab2fd4ab..f190b847b6 100644 --- a/packages/backend-common/src/service/lib/hostFactory.ts +++ b/packages/backend-common/src/service/lib/hostFactory.ts @@ -59,26 +59,78 @@ export function createHttpsServer( const signingOptions: any = httpsSettings?.certificate; - if (signingOptions?.algorithm !== undefined) { + if (signingOptions?.attributes) { logger?.info('Generating self-signed certificate with attributes'); + if (signingOptions?.algorithm) { + logger?.warn( + 'Certificate generation configuration with parameters in backend.https.certificate is deprecated, set backend.https = true instead', + ); + } const certificateAttributes: Array = Object.entries( signingOptions.attributes, ).map(([name, value]) => ({ name, value })); - // TODO: Create a type def for selfsigned. const signatures = require('selfsigned').generate(certificateAttributes, { - algorithm: signingOptions?.algorithm, + algorithm: signingOptions?.algorithm || 'sha256', keySize: signingOptions?.size || 2048, days: signingOptions?.days || 30, + extensions: [ + { + name: 'keyUsage', + keyCertSign: true, + digitalSignature: true, + nonRepudiation: true, + keyEncipherment: true, + dataEncipherment: true, + }, + { + name: 'extKeyUsage', + serverAuth: true, + clientAuth: true, + codeSigning: true, + timeStamping: true, + }, + { + name: 'subjectAltName', + altNames: [ + { + type: 2, // DNS + value: 'localhost', + }, + { + type: 2, + value: 'localhost.localdomain', + }, + { + type: 2, + value: '[::1]', + }, + { + type: 7, // IP + ip: '127.0.0.1', + }, + { + type: 7, + ip: 'fe80::1', + }, + ...(signingOptions.attributes.commonName + ? [ + { + type: 2, // DNS + value: signingOptions.attributes.commonName, + }, + ] + : []), + ], + }, + ], }); - logger?.info('Bootstrapping self-signed certificate'); - credentials.key = signatures.private; credentials.cert = signatures.cert; } else { - logger?.info('Bootstrapping cert from config'); + logger?.info('Loading certificate from config'); credentials.key = signingOptions?.key; credentials.cert = signingOptions?.cert;