awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-06 21:27:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix CA signature check

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-11-28 02:06:01 -03:00
parent 7c6a9136c7
commit 6339c205c0
1 changed files with 18 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
+18 -38
View File
@@ -34,8 +34,6 @@ import {
CertExtendedKeyUsageOIDToName, CertExtendedKeyUsageOIDToName,
CertKeyAlgorithm, CertKeyAlgorithm,
CertKeyUsage, CertKeyUsage,
CertSignatureAlgorithm,
CertSignatureType,
CertStatus, CertStatus,
TAltNameMapping TAltNameMapping
} from "../../certificate/certificate-types"; } from "../../certificate/certificate-types";
@@ -127,6 +125,22 @@ export const internalCertificateAuthorityServiceFactory = ({
kmsService, kmsService,
permissionService permissionService
}: TInternalCertificateAuthorityServiceFactoryDep) => { }: TInternalCertificateAuthorityServiceFactoryDep) => {
const $checkSignature = (caKeyAlg: string, requestedKeyType: string, signatureAlgorithm?: string) => {
const isRsaCa = caKeyAlg.startsWith("RSA");
const isEcdsaCa = caKeyAlg.startsWith("EC") || caKeyAlg.startsWith("ECDSA");
// eslint-disable-next-line no-nested-ternary
const caSupports = isRsaCa ? "RSA" : isEcdsaCa ? "ECDSA" : "unknown";
const isRequestValid = (requestedKeyType === "RSA" && isRsaCa) || (requestedKeyType === "ECDSA" && isEcdsaCa);
if (!isRequestValid) {
throw new BadRequestError({
message: `Requested signature algorithm ${signatureAlgorithm} is not compatible with CA key algorithm ${caKeyAlg}. CA can only sign with ${caSupports}-based signature algorithms.`
});
}
};
const createCa = async ({ const createCa = async ({
type, type,
friendlyName, friendlyName,
@@ -1302,26 +1316,7 @@ export const internalCertificateAuthorityServiceFactory = ({
const leafKeys = await crypto.nativeCrypto.subtle.generateKey(keyGenAlg, true, ["sign", "verify"]); const leafKeys = await crypto.nativeCrypto.subtle.generateKey(keyGenAlg, true, ["sign", "verify"]);
if (signatureAlgorithm) { if (signatureAlgorithm) {
const caKeyAlgorithm = ca.internalCa.keyAlgorithm; $checkSignature(ca.internalCa.keyAlgorithm, signatureAlgorithm.split("-")[0], signatureAlgorithm);
const requestedKeyType = signatureAlgorithm.split("-")[0];
const isRsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.RSA_2048.split("_")[0]);
const isEcdsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.ECDSA_P256.split("_")[0]);
if (
(requestedKeyType === CertSignatureAlgorithm.RSA_SHA256.split("-")[0] && !isRsaCa) ||
(requestedKeyType === CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0] && !isEcdsaCa)
) {
// eslint-disable-next-line no-nested-ternary
const supportedType = isRsaCa
? CertSignatureAlgorithm.RSA_SHA256.split("-")[0]
: isEcdsaCa
? CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0]
: "unknown";
throw new BadRequestError({
message: `Requested signature algorithm ${signatureAlgorithm} is not compatible with CA key algorithm ${caKeyAlgorithm}. CA can only sign with ${supportedType}-based signature algorithms.`
});
}
} }
// Determine signing algorithm for certificate signing // Determine signing algorithm for certificate signing
@@ -1690,22 +1685,7 @@ export const internalCertificateAuthorityServiceFactory = ({
} }
if (signatureAlgorithm) { if (signatureAlgorithm) {
const caKeyAlgorithm = ca.internalCa.keyAlgorithm; $checkSignature(ca.internalCa.keyAlgorithm, signatureAlgorithm.split("-")[0], signatureAlgorithm);
const requestedKeyType = signatureAlgorithm.split("-")[0]; // Get the first part (RSA, ECDSA)
const isRsaCa = caKeyAlgorithm.startsWith(CertSignatureType.RSA);
const isEcdsaCa = caKeyAlgorithm.startsWith(CertSignatureType.ECDSA);
if (
(requestedKeyType === CertSignatureType.RSA && !isRsaCa) ||
(requestedKeyType === CertSignatureType.ECDSA && !isEcdsaCa)
) {
// eslint-disable-next-line no-nested-ternary
const supportedType = isRsaCa ? CertSignatureType.RSA : isEcdsaCa ? CertSignatureType.ECDSA : "unknown";
throw new BadRequestError({
message: `Requested signature algorithm ${signatureAlgorithm} is not compatible with CA key algorithm ${caKeyAlgorithm}. CA can only sign with ${supportedType}-based signature algorithms.`
});
}
} }
const effectiveKeyAlgorithm = (keyAlgorithm || ca.internalCa.keyAlgorithm) as CertKeyAlgorithm; const effectiveKeyAlgorithm = (keyAlgorithm || ca.internalCa.keyAlgorithm) as CertKeyAlgorithm;