awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-11 09:28:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

PKI: EST passphrase fix and UI fixes

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-20 13:37:02 -03:00
parent 2b169e9c95
commit fccc2ed881
17 changed files with 122 additions and 312 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/routes/index.ts
-1
View File
@@ -2127,7 +2127,6 @@ export const registerRoutes = async (
const certificateEstV3Service = certificateEstV3ServiceFactory({
internalCertificateAuthorityService,
certificateTemplateDAL,
certificateTemplateV2Service,
certificateAuthorityDAL,
certificateAuthorityCertDAL,
backend/src/server/routes/v3/certificates-router.ts
+16 -115
View File
@@ -1,38 +1,25 @@
import * as x509 from "@peculiar/x509";
import { z } from "zod";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { ApiDocsTags } from "@app/lib/api-docs";
import { BadRequestError } from "@app/lib/errors";
import { ms } from "@app/lib/ms";
import { writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
import {
ACMESANType,
CertExtendedKeyUsageOIDToName,
CertificateOrderStatus,
CertKeyAlgorithm,
CertKeyUsage,
CertSignatureAlgorithm,
mapLegacyAltNameType,
TAltNameMapping
CertSignatureAlgorithm
} from "@app/services/certificate/certificate-types";
import { parseDistinguishedName } from "@app/services/certificate-authority/certificate-authority-fns";
import {
validateAndMapAltNameType,
validateCaDateField
} from "@app/services/certificate-authority/certificate-authority-validators";
import { validateCaDateField } from "@app/services/certificate-authority/certificate-authority-validators";
import {
CertExtendedKeyUsageType,
CertKeyUsageType,
CertSubjectAlternativeNameType,
mapLegacyExtendedKeyUsageToStandard,
mapLegacyKeyUsageToStandard
CertSubjectAlternativeNameType
} from "@app/services/certificate-common/certificate-constants";
import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";
import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";
interface CertificateRequestForService {
commonName?: string;
@@ -66,67 +53,6 @@ const validateDateOrder = (data: { notBefore?: string; notAfter?: string }) => {
return true;
};
const extractCertificateRequestFromCSR = (csr: string): TCertificateRequest => {
let csrPem = csr;
if (!csr.includes("-----BEGIN CERTIFICATE REQUEST-----")) {
try {
csrPem = Buffer.from(csr, "base64").toString("utf8");
} catch (error) {
throw new BadRequestError({ message: "Invalid base64 CSR encoding" });
}
}
const csrObj = new x509.Pkcs10CertificateRequest(csrPem);
const subject = parseDistinguishedName(csrObj.subject);
const certificateRequest: TCertificateRequest = {
commonName: subject.commonName,
organization: subject.organization,
organizationUnit: subject.ou,
locality: subject.locality,
state: subject.province,
country: subject.country
};
const csrKeyUsageExtension = csrObj.getExtension("2.5.29.15") as x509.KeyUsagesExtension;
if (csrKeyUsageExtension) {
const csrKeyUsages = Object.values(CertKeyUsage).filter(
// eslint-disable-next-line no-bitwise
(keyUsage) => (x509.KeyUsageFlags[keyUsage] & csrKeyUsageExtension.usages) !== 0
);
certificateRequest.keyUsages = csrKeyUsages.map(mapLegacyKeyUsageToStandard);
}
const csrExtendedKeyUsageExtension = csrObj.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension;
if (csrExtendedKeyUsageExtension) {
const csrExtendedKeyUsages = csrExtendedKeyUsageExtension.usages
.map((ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string])
.filter((eku) => eku !== undefined);
certificateRequest.extendedKeyUsages = csrExtendedKeyUsages.map(mapLegacyExtendedKeyUsageToStandard);
}
const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17");
if (sanExtension) {
const sanNames = new x509.GeneralNames(sanExtension.value);
const altNamesArray: TAltNameMapping[] = sanNames.items
.filter((value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip")
.map((name): TAltNameMapping => {
const altNameType = validateAndMapAltNameType(name.value);
if (!altNameType) {
throw new BadRequestError({ message: `Invalid altName from CSR: ${name.value}` });
}
return altNameType;
});
certificateRequest.subjectAlternativeNames = altNamesArray.map((altName) => ({
type: mapLegacyAltNameType(altName.type),
value: altName.value
}));
}
return certificateRequest;
};
export const registerCertificatesRouter = async (server: FastifyZodProvider) => {
server.route({
method: "POST",
@@ -140,7 +66,6 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
body: z
.object({
profileId: z.string().uuid(),
csr: z.string().trim().optional(),
commonName: validateTemplateRegexField.optional(),
ttl: z
.string()
@@ -182,43 +107,19 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
let certificateRequestForService: CertificateRequestForService;
if (req.body.csr) {
try {
const csrData = extractCertificateRequestFromCSR(req.body.csr);
certificateRequestForService = {
commonName: csrData.commonName,
keyUsages: csrData.keyUsages,
extendedKeyUsages: csrData.extendedKeyUsages,
altNames: csrData.subjectAlternativeNames,
validity: {
ttl: req.body.ttl
},
notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
signatureAlgorithm: req.body.signatureAlgorithm,
keyAlgorithm: req.body.keyAlgorithm
};
} catch (error) {
throw new BadRequestError({ message: `Invalid CSR: ${(error as Error).message}` });
}
} else {
certificateRequestForService = {
commonName: req.body.commonName,
keyUsages: req.body.keyUsages,
extendedKeyUsages: req.body.extendedKeyUsages,
altNames: req.body.altNames,
validity: {
ttl: req.body.ttl
},
notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
signatureAlgorithm: req.body.signatureAlgorithm,
keyAlgorithm: req.body.keyAlgorithm
};
}
const certificateRequestForService: CertificateRequestForService = {
commonName: req.body.commonName,
keyUsages: req.body.keyUsages,
extendedKeyUsages: req.body.extendedKeyUsages,
altNames: req.body.altNames,
validity: {
ttl: req.body.ttl
},
notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
signatureAlgorithm: req.body.signatureAlgorithm,
keyAlgorithm: req.body.keyAlgorithm
};
const mappedCertificateRequest = mapEnumsForValidation(certificateRequestForService);
backend/src/services/certificate-common/certificate-constants.ts
-33
View File
@@ -55,39 +55,6 @@ export enum CertSubjectAttributeType {
COUNTRY = "country"
}
export const mapSANTypeToLegacy = (type: CertSubjectAlternativeNameType): string => {
switch (type) {
case CertSubjectAlternativeNameType.DNS_NAME:
return "dns";
case CertSubjectAlternativeNameType.IP_ADDRESS:
return "ip";
case CertSubjectAlternativeNameType.EMAIL:
return "email";
case CertSubjectAlternativeNameType.URI:
return "uri";
default:
return type;
}
};
export const mapLegacySANTypeToStandard = (type: string): CertSubjectAlternativeNameType => {
switch (type) {
case "dns":
case "dns_name":
return CertSubjectAlternativeNameType.DNS_NAME;
case "ip":
case "ip_address":
return CertSubjectAlternativeNameType.IP_ADDRESS;
case "email":
return CertSubjectAlternativeNameType.EMAIL;
case "uri":
case "url":
return CertSubjectAlternativeNameType.URI;
default:
throw new Error(`Unknown SAN type: ${type}`);
}
};
export const mapKeyUsageToLegacy = (usage: CertKeyUsageType): string => {
switch (usage) {
case CertKeyUsageType.DIGITAL_SIGNATURE:
backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts
+6 -5
View File
@@ -123,6 +123,12 @@ vi.mock("@app/services/certificate/certificate-types", () => ({
};
return mapping[type] || type;
}),
TAltNameType: {
EMAIL: "email",
DNS: "dns",
IP: "ip",
URL: "url"
},
CertExtendedKeyUsageOIDToName: {
"1.3.6.1.5.5.7.3.1": "serverAuth",
"1.3.6.1.5.5.7.3.2": "clientAuth",
@@ -161,10 +167,6 @@ describe("CertificateEstV3Service Security Fix", () => {
signCertFromCa: vi.fn()
};
const mockCertificateTemplateDAL = {
findById: vi.fn()
};
const mockCertificateTemplateV2Service = {
validateCertificateRequest: vi.fn()
};
@@ -230,7 +232,6 @@ describe("CertificateEstV3Service Security Fix", () => {
service = certificateEstV3ServiceFactory({
internalCertificateAuthorityService: mockInternalCertificateAuthorityService,
certificateTemplateDAL: mockCertificateTemplateDAL,
certificateTemplateV2Service: mockCertificateTemplateV2Service,
certificateAuthorityDAL: mockCertificateAuthorityDAL,
certificateAuthorityCertDAL: mockCertificateAuthorityCertDAL,
backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
+18 -28
View File
@@ -7,7 +7,8 @@ import {
CertExtendedKeyUsageOIDToName,
CertKeyUsage,
mapLegacyAltNameType,
TAltNameMapping
TAltNameMapping,
TAltNameType
} from "@app/services/certificate/certificate-types";
import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
@@ -25,7 +26,6 @@ import {
import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
import { TCertificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";
import { TEstEnrollmentConfigDALFactory } from "@app/services/enrollment-config/est-enrollment-config-dal";
@@ -38,7 +38,6 @@ import { TLicenseServiceFactory } from "../../ee/services/license/license-servic
type TCertificateEstV3ServiceFactoryDep = {
internalCertificateAuthorityService: Pick<TInternalCertificateAuthorityServiceFactory, "signCertFromCa">;
certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "findById">;
certificateTemplateV2Service: Pick<TCertificateTemplateV2ServiceFactory, "validateCertificateRequest">;
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
@@ -53,7 +52,6 @@ export type TCertificateEstV3ServiceFactory = ReturnType<typeof certificateEstV3
export const certificateEstV3ServiceFactory = ({
internalCertificateAuthorityService,
certificateTemplateDAL,
certificateTemplateV2Service,
certificateAuthorityCertDAL,
certificateAuthorityDAL,
@@ -98,7 +96,11 @@ export const certificateEstV3ServiceFactory = ({
const sanNames = new x509.GeneralNames(sanExtension.value);
const altNamesArray: TAltNameMapping[] = sanNames.items
.filter(
(value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip"
(value) =>
value.type === TAltNameType.EMAIL ||
value.type === TAltNameType.DNS ||
value.type === TAltNameType.IP ||
value.type === TAltNameType.URL
)
.map((name): TAltNameMapping => {
const altNameType = validateAndMapAltNameType(name.value);
@@ -257,13 +259,6 @@ export const certificateEstV3ServiceFactory = ({
});
}
const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
if (!certTemplate) {
throw new NotFoundError({
message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
});
}
const leafCertificate = extractX509CertFromChain(decodeURIComponent(sslClientCert))?.[0];
if (!leafCertificate) {
@@ -272,7 +267,7 @@ export const certificateEstV3ServiceFactory = ({
const cert = new x509.X509Certificate(leafCertificate);
const caCertChains = await getCaCertChains({
caId: certTemplate.caId,
caId: profile.caId,
certificateAuthorityCertDAL,
certificateAuthorityDAL,
projectDAL,
@@ -374,17 +369,10 @@ export const certificateEstV3ServiceFactory = ({
});
}
const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
if (!certTemplate) {
throw new NotFoundError({
message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
});
}
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId);
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
if (!ca?.internalCa?.id) {
throw new NotFoundError({
message: `Internal Certificate Authority with ID '${certTemplate.caId}' not found`
message: `Internal Certificate Authority with ID '${profile.caId}' not found`
});
}
@@ -396,15 +384,17 @@ export const certificateEstV3ServiceFactory = ({
kmsService
});
const certificateChain = extractX509CertFromChain(caCertChain);
if (!certificateChain || certificateChain.length === 0) {
throw new BadRequestError({
message: "Invalid CA certificate chain: unable to extract certificates"
});
let certificates: x509.X509Certificate[] = [];
if (caCertChain && caCertChain.trim()) {
try {
certificates = extractX509CertFromChain(caCertChain).map((cert) => new x509.X509Certificate(cert));
} catch (error) {
certificates = [];
}
}
const certificates = certificateChain.map((cert) => new x509.X509Certificate(cert));
const caCertificate = new x509.X509Certificate(caCert);
return convertRawCertsToPkcs7([caCertificate.rawData, ...certificates.map((cert) => cert.rawData)]);
};
backend/src/services/certificate-profile/certificate-profile-service.ts
+1 -1
View File
@@ -805,7 +805,7 @@ export const certificateProfileServiceFactory = ({
isEnabled: true,
caChain: profile.estConfig.caChain,
disableBootstrapCertValidation: profile.estConfig.disableBootstrapCaValidation,
hashedPassphrase: ""
hashedPassphrase: profile.estConfig.passphrase
};
};
backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
+3 -6
View File
@@ -41,12 +41,9 @@ export const certificateTemplateV2ServiceFactory = ({
attributes.forEach((attr) => {
const existing = consolidated.get(attr.type);
if (existing) {
consolidated.set(attr.type, {
...attr,
allowed: [...new Set([...(existing.allowed || []), ...(attr.allowed || [])])],
required: [...new Set([...(existing.required || []), ...(attr.required || [])])],
denied: [...new Set([...(existing.denied || []), ...(attr.denied || [])])]
} as T);
throw new ForbiddenRequestError({
message: `Duplicate attribute type '${attr.type}' found in request. Each attribute type must appear only once.`
});
} else {
consolidated.set(attr.type, attr);
}
backend/src/services/certificate-v3/certificate-v3-service.ts
+7 -15
View File
@@ -193,21 +193,13 @@ export const certificateV3ServiceFactory = ({
subjectAlternativeNames: certificateRequest.altNames
});
let template;
try {
template = await certificateTemplateV2Service.getTemplateV2ById({
actor,
actorId,
actorAuthMethod,
actorOrgId,
templateId: profile.certificateTemplateId
});
} catch (error) {
throw new BadRequestError({
message: `Certificate profile is using a legacy template (${profile.certificateTemplateId}) that doesn't support security validation policies. Please migrate to a template v2 for proper security enforcement.`
});
}
const template = await certificateTemplateV2Service.getTemplateV2ById({
actor,
actorId,
actorAuthMethod,
actorOrgId,
templateId: profile.certificateTemplateId
});
if (!template) {
throw new NotFoundError({ message: "Certificate template not found for this profile" });
}