awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix missing signatureAlgorithm on getCaCredentials

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-17 10:58:28 -03:00
parent 659086009d
commit 4f23e6dc53
6 changed files with 33 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
backend/src/services/certificate-authority/certificate-authority-fns.test.ts
View File

@@ -28,6 +28,17 @@ describe("signatureAlgorithmToAlgCfg", () => {
});
});
it("should handle RSA-SHA256 with RSA_3072 correctly", () => {
const result = signatureAlgorithmToAlgCfg("RSA-SHA256", CertKeyAlgorithm.RSA_3072);
expect(result).toEqual({
name: "RSASSA-PKCS1-v1_5",
hash: "SHA-256",
publicExponent: new Uint8Array([1, 0, 1]),
modulusLength: 3072
});
});
it("should handle RSA-SHA512 correctly", () => {
const result = signatureAlgorithmToAlgCfg("RSA-SHA512", CertKeyAlgorithm.RSA_2048);

16
backend/src/services/certificate-authority/certificate-authority-fns.ts
View File

@@ -1,3 +1,4 @@
/* eslint-disable no-nested-ternary */
import * as x509 from "@peculiar/x509";
import { crypto } from "@app/lib/crypto/cryptography";
@@ -68,6 +69,13 @@ export const parseDistinguishedName = (dn: string): TDNParts => {
export const keyAlgorithmToAlgCfg = (keyAlgorithm: CertKeyAlgorithm) => {
switch (keyAlgorithm) {
case CertKeyAlgorithm.RSA_3072:
return {
name: "RSASSA-PKCS1-v1_5",
hash: "SHA-256",
publicExponent: new Uint8Array([1, 0, 1]),
modulusLength: 3072
};
case CertKeyAlgorithm.RSA_4096:
return {
name: "RSASSA-PKCS1-v1_5",
@@ -137,7 +145,8 @@ export const signatureAlgorithmToAlgCfg = (signatureAlgorithm: string, keyAlgori
name: "RSASSA-PKCS1-v1_5",
hash: normalizedHash || "SHA-256",
publicExponent: new Uint8Array([1, 0, 1]),
modulusLength: keyAlgorithm === CertKeyAlgorithm.RSA_4096 ? 4096 : 2048
modulusLength:
keyAlgorithm === CertKeyAlgorithm.RSA_4096 ? 4096 : keyAlgorithm === CertKeyAlgorithm.RSA_3072 ? 3072 : 2048
};
case "ECDSA":
// eslint-disable-next-line no-case-declarations
@@ -177,7 +186,8 @@ export const getCaCredentials = async ({
certificateAuthorityDAL,
certificateAuthoritySecretDAL,
projectDAL,
kmsService
kmsService,
signatureAlgorithm
}: TGetCaCredentialsDTO) => {
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
@@ -198,7 +208,7 @@ export const getCaCredentials = async ({
cipherTextBlob: caSecret.encryptedPrivateKey
});
const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
const alg = signatureAlgorithm || keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
const skObj = crypto.nativeCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "der", type: "pkcs8" });
const caPrivateKey = await crypto.nativeCrypto.subtle.importKey(
"pkcs8",

3
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
View File

@@ -1322,7 +1322,8 @@ export const internalCertificateAuthorityServiceFactory = ({
certificateAuthorityDAL,
certificateAuthoritySecretDAL,
projectDAL,
kmsService
kmsService,
signatureAlgorithm: signingAlg
});
const caCrl = await certificateAuthorityCrlDAL.findOne({ caSecretId: caSecret.id });

1
backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts
View File

@@ -195,6 +195,7 @@ export type TGetCaCredentialsDTO = {
certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
signatureAlgorithm?: RsaHashedImportParams | EcKeyImportParams;
};
export type TGetCaCertChainsDTO = {

4
backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
View File

@@ -174,9 +174,11 @@ export const certificateTemplateV2ServiceFactory = ({
const mapTemplateKeyAlgorithmToApi = (templateFormat: string): string => {
const mapping: Record<string, string> = {
"RSA-2048": "RSA_2048",
"RSA-3072": "RSA_3072",
"RSA-4096": "RSA_4096",
"ECDSA-P256": "EC_prime256v1",
"ECDSA-P384": "EC_secp384r1"
"ECDSA-P384": "EC_secp384r1",
"ECDSA-P521": "EC_secp521r1"
};
return mapping[templateFormat] || templateFormat;
};

4
backend/src/services/certificate/certificate-types.ts
View File

@@ -13,9 +13,11 @@ export enum CertStatus {
export enum CertKeyAlgorithm {
RSA_2048 = "RSA_2048",
RSA_3072 = "RSA_3072",
RSA_4096 = "RSA_4096",
ECDSA_P256 = "EC_prime256v1",
ECDSA_P384 = "EC_secp384r1"
ECDSA_P384 = "EC_secp384r1",
ECDSA_P521 = "EC_secp521r1"
}
export enum CertSignatureAlgorithm {