awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-13 13:29:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-15 15:39:21 +04:00
parent 2c89f8b672
commit 37014bf3f9
36 changed files with 115 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
+7 -7
View File
@@ -171,7 +171,7 @@ export const internalCertificateAuthorityServiceFactory = ({
});
const alg = keyAlgorithmToAlgCfg(keyAlgorithm);
const keys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const keys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const newCa = await certificateAuthorityDAL.transaction(async (tx) => {
const notBeforeDate = notBefore ? new Date(notBefore) : new Date();
@@ -226,7 +226,7 @@ export const internalCertificateAuthorityServiceFactory = ({
});
// https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey
const skObj = crypto.rawCrypto.KeyObject.from(keys.privateKey);
const skObj = crypto.nativeCrypto.KeyObject.from(keys.privateKey);
const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
plainText: skObj.export({
@@ -1102,9 +1102,9 @@ export const internalCertificateAuthorityServiceFactory = ({
kmsService
});
const isCaAndCertPublicKeySame = Buffer.from(await crypto.rawCrypto.subtle.exportKey("spki", caPublicKey)).equals(
Buffer.from(certObj.publicKey.rawData)
);
const isCaAndCertPublicKeySame = Buffer.from(
await crypto.nativeCrypto.subtle.exportKey("spki", caPublicKey)
).equals(Buffer.from(certObj.publicKey.rawData));
if (!isCaAndCertPublicKeySame) {
throw new BadRequestError({ message: "CA and certificate public key do not match" });
@@ -1265,7 +1265,7 @@ export const internalCertificateAuthorityServiceFactory = ({
}
const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
const leafKeys = await crypto.rawCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
name: `CN=${commonName}`,
@@ -1412,7 +1412,7 @@ export const internalCertificateAuthorityServiceFactory = ({
extensions
});
const skLeafObj = crypto.rawCrypto.KeyObject.from(leafKeys.privateKey);
const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
const kmsEncryptor = await kmsService.encryptWithKmsKey({