awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-18 00:51:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improvements on Azure ADCS PKI feature

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-08-27 21:20:10 -03:00
parent 0762de93d6
commit 13b20806ba
19 changed files with 922 additions and 600 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-enums.ts
-12
View File
@@ -1,12 +0,0 @@
export enum AzureAdCsTemplateType {
WEB_SERVER = "WebServer",
COMPUTER = "Computer",
USER = "User",
DOMAIN_CONTROLLER = "DomainController",
SUBORDINATE_CA = "SubordinateCA"
}
export enum AzureAdCsAuthMethod {
CLIENT_CERTIFICATE = "client-certificate",
KERBEROS = "kerberos"
}
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts
+158 -89
View File
@@ -78,71 +78,106 @@ const buildSubjectDN = (commonName: string, properties?: TPkiSubscriberPropertie
throw new BadRequestError({ message: "Common Name is required and cannot be empty" });
}
const sanitizedCN = commonName.trim().replace(new RE2("[,=+<>#;\\\\\\]]", "g"), "");
if (!sanitizedCN) {
throw new BadRequestError({ message: "Common Name contains only invalid characters" });
const trimmedCN = commonName.trim();
const invalidCharsRegex = new RE2("[,=+<>#;\\\\\\]]");
if (invalidCharsRegex.test(trimmedCN)) {
throw new BadRequestError({
message: "Common Name contains invalid characters: , = + < > # ; \\ ]"
});
}
let subject = `CN=${sanitizedCN}`;
let subject = `CN=${trimmedCN}`;
// Helper function to validate and sanitize DN component values
const sanitizeComponent = (value: string | undefined): string | null => {
const validateComponent = (value: string | undefined, componentName: string): string | null => {
if (!value || typeof value !== "string") return null;
const trimmed = value.trim();
if (!trimmed) return null;
// Remove or escape problematic characters for DN components
// Be more aggressive in removing characters that can cause OID issues
const sanitized = trimmed.replace(new RE2('[,=+<>#;\\\\"\\/\\r\\n\\t]', "g"), "").trim();
const componentInvalidCharsRegex = new RE2('[,=+<>#;\\\\"\\/\\r\\n\\t]');
if (componentInvalidCharsRegex.test(trimmed)) {
throw new BadRequestError({
message: `${componentName} contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t`
});
}
// Additional validation to prevent empty components that cause OID errors
if (sanitized.length === 0) return null;
const problematicCharsRegex = new RE2("^[\\\\s\\\\-_.]+|[\\\\s\\\\-_.]+$");
if (problematicCharsRegex.test(trimmed)) {
throw new BadRequestError({
message: `${componentName} cannot start or end with spaces, hyphens, underscores, or periods`
});
}
// Ensure the component doesn't start or end with spaces or problematic chars
const finalSanitized = sanitized.replace(new RE2("^[\\\\s\\\\-_.]+|[\\\\s\\\\-_.]+$", "g"), "");
return finalSanitized.length > 0 ? finalSanitized : null;
return trimmed;
};
// Build DN components in proper order for ADCS compatibility
// Order matters for Microsoft ADCS - follow X.500 standard ordering
const emailAddress = sanitizeComponent(properties?.emailAddress);
const emailAddress = validateComponent(properties?.emailAddress, "Email Address");
if (emailAddress) {
// Enhanced email validation for DN usage
const emailRegex = new RE2(/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/);
if (emailRegex.test(emailAddress) && emailAddress.length > 5 && emailAddress.length < 64) {
subject += `,E=${emailAddress}`;
if (!emailRegex.test(emailAddress) || emailAddress.length <= 5 || emailAddress.length >= 64) {
throw new BadRequestError({
message: "Email Address must be a valid email format between 5 and 64 characters"
});
}
subject += `,E=${emailAddress}`;
}
const organizationalUnit = sanitizeComponent(properties?.organizationalUnit);
if (organizationalUnit && organizationalUnit.length <= 64) {
const organizationalUnit = validateComponent(properties?.organizationalUnit, "Organizational Unit");
if (organizationalUnit) {
if (organizationalUnit.length > 64) {
throw new BadRequestError({
message: "Organizational Unit cannot exceed 64 characters"
});
}
subject += `,OU=${organizationalUnit}`;
}
const organization = sanitizeComponent(properties?.organization);
if (organization && organization.length <= 64) {
const organization = validateComponent(properties?.organization, "Organization");
if (organization) {
if (organization.length > 64) {
throw new BadRequestError({
message: "Organization cannot exceed 64 characters"
});
}
subject += `,O=${organization}`;
}
const locality = sanitizeComponent(properties?.locality);
if (locality && locality.length <= 64) {
const locality = validateComponent(properties?.locality, "Locality");
if (locality) {
if (locality.length > 64) {
throw new BadRequestError({
message: "Locality cannot exceed 64 characters"
});
}
subject += `,L=${locality}`;
}
const state = sanitizeComponent(properties?.state);
if (state && state.length <= 64) {
const state = validateComponent(properties?.state, "State");
if (state) {
if (state.length > 64) {
throw new BadRequestError({
message: "State cannot exceed 64 characters"
});
}
subject += `,ST=${state}`;
}
const country = sanitizeComponent(properties?.country);
const country = validateComponent(properties?.country, "Country");
if (country) {
// Country code must be exactly 2 uppercase letters
const countryCode = country.toUpperCase().replace(new RE2("[^A-Z]", "g"), "");
if (countryCode.length === 2) {
subject += `,C=${countryCode}`;
const countryCode = country.toUpperCase();
const invalidCountryRegex = new RE2("[^A-Z]");
if (invalidCountryRegex.test(countryCode)) {
throw new BadRequestError({
message: "Country must contain only uppercase letters"
});
}
if (countryCode.length !== 2) {
throw new BadRequestError({
message: "Country must be exactly 2 characters"
});
}
subject += `,C=${countryCode}`;
}
return subject;
@@ -155,6 +190,12 @@ export const castDbEntryToAzureAdCsCertificateAuthority = (
throw new BadRequestError({ message: "Malformed Azure AD Certificate Service certificate authority" });
}
if (!ca.externalCa.dnsAppConnectionId) {
throw new BadRequestError({
message: "Azure ADCS connection ID is missing from certificate authority configuration"
});
}
return {
id: ca.id,
type: CaType.AZURE_AD_CS,
@@ -163,19 +204,25 @@ export const castDbEntryToAzureAdCsCertificateAuthority = (
projectId: ca.projectId,
credentials: ca.externalCa.credentials,
configuration: {
azureAdcsConnectionId: ca.externalCa.dnsAppConnectionId as string
azureAdcsConnectionId: ca.externalCa.dnsAppConnectionId
},
status: ca.status as CaStatus
};
};
const submitCertificateRequest = async (
credentials: { username: string; password: string },
credentials: { username: string; password: string; sslRejectUnauthorized?: boolean; sslCertificate?: string },
caServiceUrl: string,
certificateRequest: AzureCertificateRequest
): Promise<AzureCertificateResponse> => {
try {
const adcsClient = createAdcsHttpClient(credentials.username, credentials.password, caServiceUrl);
const adcsClient = createAdcsHttpClient(
credentials.username,
credentials.password,
caServiceUrl,
credentials.sslRejectUnauthorized ?? true,
credentials.sslCertificate
);
// Clean CSR by removing headers and newlines for ADCS submission
const cleanCsr = certificateRequest.csr
@@ -203,14 +250,22 @@ const submitCertificateRequest = async (
// Add ExpirationDate attribute (requires EDITF_ATTRIBUTEENDDATE flag on CA)
certAttribParts.push(`ExpirationDate:${rfc2616Date}`);
} catch (error) {
// Invalid TTL format - will use template default validity period
throw new BadRequestError({
message: "Invalid validity period format"
});
}
}
// Join all attributes with proper CRLF ending
const certAttrib = certAttribParts.length > 0 ? `${certAttribParts.join("\r\n")}\r\n` : "";
// Prepare form data for ADCS web interface - correct format based on Microsoft docs
// Prepare form data for ADCS web interface - these parameters are required by Microsoft ADCS
// Mode: "newreq" indicates a new certificate request
// CertRequest: the base64-encoded CSR without headers
// CertAttrib: certificate template and other attributes in CRLF format
// FriendlyType: display name for the certificate type
// TargetStoreFlags: certificate store flags (0 = default)
// SaveCert: "yes" to save the certificate to the server
const formData = new URLSearchParams({
Mode: "newreq",
CertRequest: cleanCsr,
@@ -222,7 +277,7 @@ const submitCertificateRequest = async (
const response = await adcsClient.post("/certsrv/certfnsh.asp", formData.toString());
const responseText = response.body;
const responseText = response.data;
// Parse the HTML response to extract certificate information
let requestId: string | undefined;
@@ -254,15 +309,8 @@ const submitCertificateRequest = async (
// Validate the certificate format before using it
try {
const testCert = new x509.X509Certificate(certificate);
// If we get here, the certificate is valid
status = "issued";
// Use testCert if needed for validation
if (testCert) {
// Certificate is valid
}
} catch (error) {
// If the extracted certificate is invalid, treat as pending
certificate = "";
status = "pending";
}
@@ -348,17 +396,17 @@ const submitCertificateRequest = async (
// Clean up HTML entities and tags from error message
errorMessage = errorMessage
.replace(/&quot;/g, '"')
.replace(/&lt;/g, "<")
.replace(/&gt;/g, ">")
.replace(/&amp;/g, "&")
.replace(/<[^>]*>/g, "") // Remove HTML tags
.replace(/\r\n/g, " ")
.replace(/\n/g, " ")
.replace(/\r/g, " ")
.replace(/\s+/g, " ")
.replace(/\s*[".]?\s*[".]?\s*$/, "") // Remove trailing quotes and periods
.replace(/^\s*[".]?\s*/, "") // Remove leading quotes and periods
.replace(new RE2("&quot;", "g"), '"')
.replace(new RE2("&lt;", "g"), "<")
.replace(new RE2("&gt;", "g"), ">")
.replace(new RE2("&amp;", "g"), "&")
.replace(new RE2("<[^>]*>", "g"), "") // Remove HTML tags
.replace(new RE2("\\r\\n", "g"), " ")
.replace(new RE2("\\n", "g"), " ")
.replace(new RE2("\\r", "g"), " ")
.replace(new RE2("\\s+", "g"), " ")
.replace(new RE2('\\s*[".]*\\s*[".]*\\s*$'), "") // Remove trailing quotes and periods
.replace(new RE2('^\\s*[".]*\\s*'), "") // Remove leading quotes and periods
.trim();
// Handle specific Microsoft ADCS OID-related errors
@@ -437,20 +485,24 @@ const submitCertificateRequest = async (
};
const retrieveCertificate = async (
credentials: { username: string; password: string },
credentials: { username: string; password: string; sslRejectUnauthorized?: boolean; sslCertificate?: string },
caServiceUrl: string,
certificateId: string
): Promise<string> => {
try {
const adcsClient = createAdcsHttpClient(credentials.username, credentials.password, caServiceUrl);
const adcsClient = createAdcsHttpClient(
credentials.username,
credentials.password,
caServiceUrl,
credentials.sslRejectUnauthorized ?? true,
credentials.sslCertificate
);
const response = await adcsClient.get(`/certsrv/certnew.cer?ReqID=${certificateId}&Enc=b64`, {
headers: {
Accept: "application/pkix-cert,application/x-x509-ca-cert,application/octet-stream,*/*"
}
Accept: "application/pkix-cert,application/x-x509-ca-cert,application/octet-stream,*/*"
});
const certData = response.body;
const certData = response.data;
// Check if the response contains HTML indicating the certificate is not ready
if (certData.includes("<html>") || certData.includes("taken under submission") || certData.includes("pending")) {
@@ -468,7 +520,7 @@ const retrieveCertificate = async (
let cleanCertData = certData.trim();
// Remove any HTML artifacts or unwanted characters, keeping only base64
cleanCertData = cleanCertData.replace(/[^A-Za-z0-9+/=\s]/g, "").replace(/\s/g, "");
cleanCertData = cleanCertData.replace(new RE2("[^A-Za-z0-9+/=\\s]", "g"), "").replace(new RE2("\\s", "g"), "");
if (cleanCertData.length < 100) {
throw new BadRequestError({
@@ -477,7 +529,7 @@ const retrieveCertificate = async (
}
// Format as proper PEM certificate with 64 character lines
const formattedCert = cleanCertData.replace(/(.{64})/g, "$1\n").trim();
const formattedCert = cleanCertData.replace(new RE2("(.{64})", "g"), "$1\n").trim();
const pemCert = `-----BEGIN CERTIFICATE-----\n${formattedCert}\n-----END CERTIFICATE-----`;
// Validate the constructed PEM before returning
@@ -730,15 +782,23 @@ export const AzureAdCsCertificateAuthorityFns = ({
});
// Get credentials from the Azure ADCS connection
const { username, password, adcsUrl } = await getAzureADCSConnectionCredentials(
azureCa.configuration.azureAdcsConnectionId,
appConnectionDAL,
kmsService
);
const { username, password, adcsUrl, sslRejectUnauthorized, sslCertificate } =
await getAzureADCSConnectionCredentials(
azureCa.configuration.azureAdcsConnectionId,
appConnectionDAL,
kmsService
);
const credentials = {
const credentials: {
username: string;
password: string;
sslRejectUnauthorized?: boolean;
sslCertificate?: string;
} = {
username,
password
password,
sslRejectUnauthorized,
sslCertificate
};
const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
@@ -774,11 +834,7 @@ export const AzureAdCsCertificateAuthorityFns = ({
});
}
let templateValue = templateInput;
// Always use just the template display name for ADCS submission
// ADCS expects format like "CertificateTemplate:WebServer" not the full template value
templateValue = templateInput;
const templateValue = templateInput;
const certificateRequest: AzureCertificateRequest = {
csr: csrPem,
@@ -867,7 +923,7 @@ export const AzureAdCsCertificateAuthorityFns = ({
if (retryCount === maxRetries) {
throw new BadRequestError({
message: `Certificate request submitted with ID ${submissionResponse.certificateId} but failed to retrieve after ${maxRetries} attempts. The certificate may still be pending approval or processing. Last error: ${lastError?.message || "Unknown error"}`
message: `Certificate request submitted with ID ${submissionResponse.certificateId} but failed to retrieve after ${maxRetries} attempts. The certificate may still be pending approval or processing. Last error: ${lastError?.message || "Unknown error"}. For manual approval scenarios, consider implementing a background polling mechanism.`
});
}
}
@@ -890,7 +946,10 @@ export const AzureAdCsCertificateAuthorityFns = ({
}
// Remove any extra whitespace and ensure proper line endings
cleanedCertificatePem = cleanedCertificatePem.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim();
cleanedCertificatePem = cleanedCertificatePem
.replace(new RE2("\\r\\n", "g"), "\n")
.replace(new RE2("\\r", "g"), "\n")
.trim();
// Validate that we have both begin and end markers
if (!cleanedCertificatePem.includes("-----END CERTIFICATE-----")) {
@@ -984,18 +1043,28 @@ export const AzureAdCsCertificateAuthorityFns = ({
}
// Get credentials from the Azure ADCS connection
const { username, password, adcsUrl } = await getAzureADCSConnectionCredentials(
azureAdcsConnectionId,
appConnectionDAL,
kmsService
);
const { username, password, adcsUrl, sslRejectUnauthorized, sslCertificate } =
await getAzureADCSConnectionCredentials(azureAdcsConnectionId, appConnectionDAL, kmsService);
const credentials = {
const credentials: {
username: string;
password: string;
sslRejectUnauthorized?: boolean;
sslCertificate?: string;
} = {
username,
password
password,
sslRejectUnauthorized,
sslCertificate
};
const client = createAdcsHttpClient(credentials.username, credentials.password, adcsUrl);
const client = createAdcsHttpClient(
credentials.username,
credentials.password,
adcsUrl,
credentials.sslRejectUnauthorized ?? true,
credentials.sslCertificate
);
try {
// Get available templates from ADCS web interface and filter to only usable ones
@@ -1003,7 +1072,7 @@ export const AzureAdCsCertificateAuthorityFns = ({
try {
const requestFormResponse = await client.get("/certsrv/certrqxt.asp");
const responseText = requestFormResponse.body;
const responseText = requestFormResponse.data;
// ADCS returns JavaScript-based template info instead of HTML options
// Look for patterns like: getTemplateStringInfo(CTINFO_INDEX_REALNAME, null) and sRealName assignments
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas.ts
-11
View File
@@ -11,17 +11,6 @@ export const AzureAdCsCertificateAuthorityConfigurationSchema = z.object({
azureAdcsConnectionId: z.string().uuid().trim().describe("Azure ADCS Connection ID")
});
export const AzureAdCsCertificateAuthorityCredentialsSchema = z
.object({
clientId: z.string(),
clientSecret: z.string().optional(),
certificateThumbprint: z.string().optional()
})
.refine((data) => data.clientSecret || data.certificateThumbprint, {
message: "At least one authentication method (clientSecret or certificateThumbprint) must be provided",
path: ["clientSecret"]
});
export const AzureAdCsCertificateAuthoritySchema = BaseCertificateAuthoritySchema.extend({
type: z.literal(CaType.AZURE_AD_CS),
configuration: AzureAdCsCertificateAuthorityConfigurationSchema
backend/src/services/certificate-authority/certificate-authority-service.ts
+1 -49
View File
@@ -2,11 +2,7 @@ import { ForbiddenError } from "@casl/ability";
import { ActionProjectType, TableName } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import {
ProjectPermissionActions,
ProjectPermissionCertificateActions,
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { OrgServiceActor } from "@app/lib/types";
@@ -446,49 +442,6 @@ export const certificateAuthorityServiceFactory = ({
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
const orderSubscriberCertificate = async (subscriberId: string, actor: OrgServiceActor) => {
const subscriber = await pkiSubscriberDAL.findById(subscriberId);
if (!subscriber.caId) {
throw new BadRequestError({ message: "Subscriber does not have a CA" });
}
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(subscriber.caId);
const { permission } = await permissionService.getProjectPermission({
actor: actor.type,
actorId: actor.id,
projectId: ca.projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
actionProjectType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Create,
ProjectPermissionSub.Certificates
);
if (!ca.externalCa && !ca.internalCa) {
throw new BadRequestError({ message: "Certificate authority configuration not found" });
}
if (ca.externalCa?.type === CaType.ACME) {
return acmeFns.orderSubscriberCertificate(subscriberId);
}
if (ca.externalCa?.type === CaType.AZURE_AD_CS) {
return azureAdCsFns.orderSubscriberCertificate(subscriberId);
}
if (ca.internalCa) {
// Handle internal CA certificate ordering - this would need to be implemented
throw new BadRequestError({ message: "Internal CA certificate ordering not yet supported" });
}
throw new BadRequestError({ message: "Unsupported certificate authority type" });
};
const getAzureAdcsTemplates = async ({
caId,
projectId,
@@ -530,7 +483,6 @@ export const certificateAuthorityServiceFactory = ({
listCertificateAuthoritiesByProjectId,
updateCertificateAuthority,
deleteCertificateAuthority,
orderSubscriberCertificate,
getAzureAdcsTemplates
};
};
backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
+3 -112
View File
@@ -8,8 +8,6 @@ import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto/cryptography";
import { BadRequestError } from "@app/lib/errors";
import { ms } from "@app/lib/ms";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
@@ -21,12 +19,9 @@ import {
TAltNameMapping
} from "@app/services/certificate/certificate-types";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TPkiSubscriberDALFactory } from "@app/services/pki-subscriber/pki-subscriber-dal";
import { TPkiSubscriberProperties } from "@app/services/pki-subscriber/pki-subscriber-types";
import { TProjectDALFactory } from "@app/services/project/project-dal";
import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
import { AzureAdCsCertificateAuthorityFns } from "../azure-ad-cs/azure-ad-cs-certificate-authority-fns";
import { TCertificateAuthorityCertDALFactory } from "../certificate-authority-cert-dal";
import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
import { CaStatus } from "../certificate-authority-enums";
@@ -38,7 +33,6 @@ import {
} from "../certificate-authority-fns";
import { TCertificateAuthoritySecretDALFactory } from "../certificate-authority-secret-dal";
import { validateAndMapAltNameType } from "../certificate-authority-validators";
import { TExternalCertificateAuthorityDALFactory } from "../external-certificate-authority-dal";
import { TIssueCertWithTemplateDTO } from "./internal-certificate-authority-types";
type TInternalCertificateAuthorityFnsDeps = {
@@ -57,83 +51,6 @@ type TInternalCertificateAuthorityFnsDeps = {
certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction">;
certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
appConnectionDAL?: Pick<TAppConnectionDALFactory, "findById" | "updateById">;
appConnectionService?: Pick<TAppConnectionServiceFactory, "connectAppConnectionById">;
externalCertificateAuthorityDAL?: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
pkiSubscriberDAL?: Pick<TPkiSubscriberDALFactory, "findById">;
};
const buildSubjectDN = (commonName: string, properties?: TPkiSubscriberProperties): string => {
// Validate and sanitize common name - it's required and cannot be empty
if (!commonName || !commonName.trim()) {
throw new BadRequestError({ message: "Common Name is required and cannot be empty" });
}
const sanitizedCN = commonName.trim().replace(/[,=+<>#;\\]/g, ""); // Remove problematic characters
if (!sanitizedCN) {
throw new BadRequestError({ message: "Common Name contains only invalid characters" });
}
let subject = `CN=${sanitizedCN}`;
// Helper function to validate and sanitize DN component values
const sanitizeComponent = (value: string | undefined): string | null => {
if (!value || typeof value !== "string") return null;
const trimmed = value.trim();
if (!trimmed) return null;
// Remove problematic characters for DN components
const sanitized = trimmed.replace(/[,=+<>#;\\"/\r\n\t]/g, "").trim();
// Additional validation to prevent empty components
if (sanitized.length === 0) return null;
// Ensure the component doesn't start or end with spaces or problematic chars
const finalSanitized = sanitized.replace(/^[\s-_.]+|[\s-_.]+$/g, "");
return finalSanitized.length > 0 ? finalSanitized : null;
};
// Build DN components in proper X.500 ordering
const emailAddress = sanitizeComponent(properties?.emailAddress);
if (emailAddress) {
// Enhanced email validation for DN usage
const emailRegex = new RE2(/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/);
if (emailRegex.test(emailAddress) && emailAddress.length > 5 && emailAddress.length < 64) {
subject += `,E=${emailAddress}`;
}
}
const organizationalUnit = sanitizeComponent(properties?.organizationalUnit);
if (organizationalUnit && organizationalUnit.length <= 64) {
subject += `,OU=${organizationalUnit}`;
}
const organization = sanitizeComponent(properties?.organization);
if (organization && organization.length <= 64) {
subject += `,O=${organization}`;
}
const locality = sanitizeComponent(properties?.locality);
if (locality && locality.length <= 64) {
subject += `,L=${locality}`;
}
const state = sanitizeComponent(properties?.state);
if (state && state.length <= 64) {
subject += `,ST=${state}`;
}
const country = sanitizeComponent(properties?.country);
if (country) {
// Country code must be exactly 2 uppercase letters
const countryCode = country.toUpperCase().replace(/[^A-Z]/g, "");
if (countryCode.length === 2) {
subject += `,C=${countryCode}`;
}
}
return subject;
};
export const InternalCertificateAuthorityFns = ({
@@ -145,11 +62,7 @@ export const InternalCertificateAuthorityFns = ({
certificateAuthorityCrlDAL,
certificateDAL,
certificateBodyDAL,
certificateSecretDAL,
appConnectionDAL,
appConnectionService,
externalCertificateAuthorityDAL,
pkiSubscriberDAL
certificateSecretDAL
}: TInternalCertificateAuthorityFnsDeps) => {
const issueCertificate = async (
subscriber: TPkiSubscribers,
@@ -195,7 +108,7 @@ export const InternalCertificateAuthorityFns = ({
const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
name: buildSubjectDN(subscriber.commonName, subscriber.properties as TPkiSubscriberProperties | undefined),
name: `CN=${subscriber.commonName}`,
keys: leafKeys,
signingAlgorithm: alg,
extensions: [
@@ -611,30 +524,8 @@ export const InternalCertificateAuthorityFns = ({
};
};
const issueCertificateWithAzureAdCs = async (subscriberId: string) => {
if (!appConnectionDAL || !appConnectionService || !externalCertificateAuthorityDAL || !pkiSubscriberDAL) {
throw new BadRequestError({ message: "Azure AD CS dependencies not available" });
}
const azureAdCsFns = AzureAdCsCertificateAuthorityFns({
appConnectionDAL,
appConnectionService,
certificateAuthorityDAL,
externalCertificateAuthorityDAL,
certificateDAL,
certificateBodyDAL,
certificateSecretDAL,
kmsService,
projectDAL,
pkiSubscriberDAL
});
return azureAdCsFns.orderSubscriberCertificate(subscriberId);
};
return {
issueCertificate,
issueCertificateWithTemplate,
issueCertificateWithAzureAdCs
issueCertificateWithTemplate
};
};