awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 06:35:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: subject alternative name policy enforcement

Browse Source
This commit is contained in:
Sheen Capadngan
2024-08-16 17:24:33 +08:00
parent b9bd518aa6
commit 0961d2f1c6
10 changed files with 106 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/certificate-authority-service.ts
+35 -30
View File
@@ -1096,17 +1096,6 @@ export const certificateAuthorityServiceFactory = ({
throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
}
if (certificateTemplate) {
validateCertificateDetailsAgainstTemplate(
{
commonName,
notBeforeDate,
notAfterDate
},
certificateTemplate
);
}
const alg = keyAlgorithmToAlgCfg(ca.keyAlgorithm as CertKeyAlgorithm);
const leafKeys = await crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
@@ -1136,11 +1125,13 @@ export const certificateAuthorityServiceFactory = ({
await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey)
];
let altNamesArray: {
type: "email" | "dns";
value: string;
}[] = [];
if (altNames) {
const altNamesArray: {
type: "email" | "dns";
value: string;
}[] = altNames
altNamesArray = altNames
.split(",")
.map((name) => name.trim())
.map((altName) => {
@@ -1168,6 +1159,18 @@ export const certificateAuthorityServiceFactory = ({
extensions.push(altNamesExtension);
}
if (certificateTemplate) {
validateCertificateDetailsAgainstTemplate(
{
commonName,
notBeforeDate,
notAfterDate,
altNames: altNamesArray.map((entry) => entry.value)
},
certificateTemplate
);
}
const serialNumber = crypto.randomBytes(32).toString("hex");
const leafCert = await x509.X509CertificateGenerator.create({
serialNumber,
@@ -1345,17 +1348,6 @@ export const certificateAuthorityServiceFactory = ({
message: "A common name (CN) is required in the CSR or as a parameter to this endpoint"
});
if (certificateTemplate) {
validateCertificateDetailsAgainstTemplate(
{
commonName: cn,
notBeforeDate,
notAfterDate
},
certificateTemplate
);
}
const { caPrivateKey } = await getCaCredentials({
caId: ca.id,
certificateAuthorityDAL,
@@ -1371,11 +1363,12 @@ export const certificateAuthorityServiceFactory = ({
await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey)
];
let altNamesArray: {
type: "email" | "dns";
value: string;
}[] = [];
if (altNames) {
const altNamesArray: {
type: "email" | "dns";
value: string;
}[] = altNames
altNamesArray = altNames
.split(",")
.map((name) => name.trim())
.map((altName) => {
@@ -1403,6 +1396,18 @@ export const certificateAuthorityServiceFactory = ({
extensions.push(altNamesExtension);
}
if (certificateTemplate) {
validateCertificateDetailsAgainstTemplate(
{
commonName: cn,
notBeforeDate,
notAfterDate,
altNames: altNamesArray.map((entry) => entry.value)
},
certificateTemplate
);
}
const serialNumber = crypto.randomBytes(32).toString("hex");
const leafCert = await x509.X509CertificateGenerator.create({
serialNumber,