awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-18 00:51:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

PKI: EST passphrase fix and UI fixes

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-20 13:37:02 -03:00
parent 2b169e9c95
commit fccc2ed881
17 changed files with 122 additions and 312 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-common/certificate-constants.ts
-33
View File
@@ -55,39 +55,6 @@ export enum CertSubjectAttributeType {
COUNTRY = "country"
}
export const mapSANTypeToLegacy = (type: CertSubjectAlternativeNameType): string => {
switch (type) {
case CertSubjectAlternativeNameType.DNS_NAME:
return "dns";
case CertSubjectAlternativeNameType.IP_ADDRESS:
return "ip";
case CertSubjectAlternativeNameType.EMAIL:
return "email";
case CertSubjectAlternativeNameType.URI:
return "uri";
default:
return type;
}
};
export const mapLegacySANTypeToStandard = (type: string): CertSubjectAlternativeNameType => {
switch (type) {
case "dns":
case "dns_name":
return CertSubjectAlternativeNameType.DNS_NAME;
case "ip":
case "ip_address":
return CertSubjectAlternativeNameType.IP_ADDRESS;
case "email":
return CertSubjectAlternativeNameType.EMAIL;
case "uri":
case "url":
return CertSubjectAlternativeNameType.URI;
default:
throw new Error(`Unknown SAN type: ${type}`);
}
};
export const mapKeyUsageToLegacy = (usage: CertKeyUsageType): string => {
switch (usage) {
case CertKeyUsageType.DIGITAL_SIGNATURE:
backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts
+6 -5
View File
@@ -123,6 +123,12 @@ vi.mock("@app/services/certificate/certificate-types", () => ({
};
return mapping[type] || type;
}),
TAltNameType: {
EMAIL: "email",
DNS: "dns",
IP: "ip",
URL: "url"
},
CertExtendedKeyUsageOIDToName: {
"1.3.6.1.5.5.7.3.1": "serverAuth",
"1.3.6.1.5.5.7.3.2": "clientAuth",
@@ -161,10 +167,6 @@ describe("CertificateEstV3Service Security Fix", () => {
signCertFromCa: vi.fn()
};
const mockCertificateTemplateDAL = {
findById: vi.fn()
};
const mockCertificateTemplateV2Service = {
validateCertificateRequest: vi.fn()
};
@@ -230,7 +232,6 @@ describe("CertificateEstV3Service Security Fix", () => {
service = certificateEstV3ServiceFactory({
internalCertificateAuthorityService: mockInternalCertificateAuthorityService,
certificateTemplateDAL: mockCertificateTemplateDAL,
certificateTemplateV2Service: mockCertificateTemplateV2Service,
certificateAuthorityDAL: mockCertificateAuthorityDAL,
certificateAuthorityCertDAL: mockCertificateAuthorityCertDAL,
backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
+18 -28
View File
@@ -7,7 +7,8 @@ import {
CertExtendedKeyUsageOIDToName,
CertKeyUsage,
mapLegacyAltNameType,
TAltNameMapping
TAltNameMapping,
TAltNameType
} from "@app/services/certificate/certificate-types";
import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
@@ -25,7 +26,6 @@ import {
import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
import { TCertificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";
import { TEstEnrollmentConfigDALFactory } from "@app/services/enrollment-config/est-enrollment-config-dal";
@@ -38,7 +38,6 @@ import { TLicenseServiceFactory } from "../../ee/services/license/license-servic
type TCertificateEstV3ServiceFactoryDep = {
internalCertificateAuthorityService: Pick<TInternalCertificateAuthorityServiceFactory, "signCertFromCa">;
certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "findById">;
certificateTemplateV2Service: Pick<TCertificateTemplateV2ServiceFactory, "validateCertificateRequest">;
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
@@ -53,7 +52,6 @@ export type TCertificateEstV3ServiceFactory = ReturnType<typeof certificateEstV3
export const certificateEstV3ServiceFactory = ({
internalCertificateAuthorityService,
certificateTemplateDAL,
certificateTemplateV2Service,
certificateAuthorityCertDAL,
certificateAuthorityDAL,
@@ -98,7 +96,11 @@ export const certificateEstV3ServiceFactory = ({
const sanNames = new x509.GeneralNames(sanExtension.value);
const altNamesArray: TAltNameMapping[] = sanNames.items
.filter(
(value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip"
(value) =>
value.type === TAltNameType.EMAIL ||
value.type === TAltNameType.DNS ||
value.type === TAltNameType.IP ||
value.type === TAltNameType.URL
)
.map((name): TAltNameMapping => {
const altNameType = validateAndMapAltNameType(name.value);
@@ -257,13 +259,6 @@ export const certificateEstV3ServiceFactory = ({
});
}
const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
if (!certTemplate) {
throw new NotFoundError({
message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
});
}
const leafCertificate = extractX509CertFromChain(decodeURIComponent(sslClientCert))?.[0];
if (!leafCertificate) {
@@ -272,7 +267,7 @@ export const certificateEstV3ServiceFactory = ({
const cert = new x509.X509Certificate(leafCertificate);
const caCertChains = await getCaCertChains({
caId: certTemplate.caId,
caId: profile.caId,
certificateAuthorityCertDAL,
certificateAuthorityDAL,
projectDAL,
@@ -374,17 +369,10 @@ export const certificateEstV3ServiceFactory = ({
});
}
const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
if (!certTemplate) {
throw new NotFoundError({
message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
});
}
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId);
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
if (!ca?.internalCa?.id) {
throw new NotFoundError({
message: `Internal Certificate Authority with ID '${certTemplate.caId}' not found`
message: `Internal Certificate Authority with ID '${profile.caId}' not found`
});
}
@@ -396,15 +384,17 @@ export const certificateEstV3ServiceFactory = ({
kmsService
});
const certificateChain = extractX509CertFromChain(caCertChain);
if (!certificateChain || certificateChain.length === 0) {
throw new BadRequestError({
message: "Invalid CA certificate chain: unable to extract certificates"
});
let certificates: x509.X509Certificate[] = [];
if (caCertChain && caCertChain.trim()) {
try {
certificates = extractX509CertFromChain(caCertChain).map((cert) => new x509.X509Certificate(cert));
} catch (error) {
certificates = [];
}
}
const certificates = certificateChain.map((cert) => new x509.X509Certificate(cert));
const caCertificate = new x509.X509Certificate(caCert);
return convertRawCertsToPkcs7([caCertificate.rawData, ...certificates.map((cert) => cert.rawData)]);
};
backend/src/services/certificate-profile/certificate-profile-service.ts
+1 -1
View File
@@ -805,7 +805,7 @@ export const certificateProfileServiceFactory = ({
isEnabled: true,
caChain: profile.estConfig.caChain,
disableBootstrapCertValidation: profile.estConfig.disableBootstrapCaValidation,
hashedPassphrase: ""
hashedPassphrase: profile.estConfig.passphrase
};
};
backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
+3 -6
View File
@@ -41,12 +41,9 @@ export const certificateTemplateV2ServiceFactory = ({
attributes.forEach((attr) => {
const existing = consolidated.get(attr.type);
if (existing) {
consolidated.set(attr.type, {
...attr,
allowed: [...new Set([...(existing.allowed || []), ...(attr.allowed || [])])],
required: [...new Set([...(existing.required || []), ...(attr.required || [])])],
denied: [...new Set([...(existing.denied || []), ...(attr.denied || [])])]
} as T);
throw new ForbiddenRequestError({
message: `Duplicate attribute type '${attr.type}' found in request. Each attribute type must appear only once.`
});
} else {
consolidated.set(attr.type, attr);
}
backend/src/services/certificate-v3/certificate-v3-service.ts
+7 -15
View File
@@ -193,21 +193,13 @@ export const certificateV3ServiceFactory = ({
subjectAlternativeNames: certificateRequest.altNames
});
let template;
try {
template = await certificateTemplateV2Service.getTemplateV2ById({
actor,
actorId,
actorAuthMethod,
actorOrgId,
templateId: profile.certificateTemplateId
});
} catch (error) {
throw new BadRequestError({
message: `Certificate profile is using a legacy template (${profile.certificateTemplateId}) that doesn't support security validation policies. Please migrate to a template v2 for proper security enforcement.`
});
}
const template = await certificateTemplateV2Service.getTemplateV2ById({
actor,
actorId,
actorAuthMethod,
actorOrgId,
templateId: profile.certificateTemplateId
});
if (!template) {
throw new NotFoundError({ message: "Certificate template not found for this profile" });
}