Fixed ACM activation with wildcard certs.
Ylian Saint-Hilaire committed
Jul 4, 2021 at 11:58 UTC
0b08c610beaed490d09a2c34f0d97f4427653d0f
1 file changed
+10
-2
certoperations.js
+10
-2
@@ -28,6 +28,14 @@ module.exports.CertificateOperations = function (parent) {
28
29
const TopLevelDomainExtendedSupport = { 'net': 2, 'com': 2, 'arpa': 3, 'org': 2, 'gov': 2, 'edu': 2, 'de': 2, 'fr': 3, 'cn': 3, 'nl': 3, 'br': 3, 'mx': 3, 'uk': 3, 'pl': 3, 'tw': 3, 'ca': 3, 'fi': 3, 'be': 3, 'ru': 3, 'se': 3, 'ch': 2, 'dk': 2, 'ar': 3, 'es': 3, 'no': 3, 'at': 3, 'in': 3, 'tr': 3, 'cz': 2, 'ro': 3, 'hu': 3, 'nz': 3, 'pt': 3, 'il': 3, 'gr': 3, 'co': 3, 'ie': 3, 'za': 3, 'th': 3, 'sg': 3, 'hk': 3, 'cl': 2, 'lt': 3, 'id': 3, 'hr': 3, 'ee': 3, 'bg': 3, 'ua': 2 };
30
31
+ // Return true if the trusted FQDN matched the certificate common name
32
+ function checkAcmActivationCertName(commonName, trustedFqdn) {
33
+ commonName = commonName.toLowerCase();
34
+ trustedFqdn = trustedFqdn.toLowerCase();
35
+ if (commonName.startsWith('*.') && (commonName.length > 2)) { commonName = commonName.substring(2); }
36
+ return ((commonName == trustedFqdn) || (trustedFqdn.endsWith('.' + commonName)));
37
+ }
38
+
39
// Sign a Intel AMT TLS ACM activation request
40
obj.getAcmCertChain = function (domain, fqdn, hash) {
41
if ((domain == null) || (domain.amtacmactivation == null) || (domain.amtacmactivation.certs == null) || (fqdn == null) || (hash == null)) return { action: 'acmactivate', error: 1, errorText: 'Invalid arguments' };
@@ -38,8 +46,8 @@ module.exports.CertificateOperations = function (parent) {
46
var signkey = null, certChain = null, hashAlgo = null, certIndex = null;
47
for (var i in domain.amtacmactivation.certs) {
48
const certEntry = domain.amtacmactivation.certs[i];
41
- if ((certEntry.sha256 == hash) && ((certEntry.cn == '*') || (certEntry.cn == fqdn))) { hashAlgo = 'sha256'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
42
- if ((certEntry.sha1 == hash) && ((certEntry.cn == '*') || (certEntry.cn == fqdn))) { hashAlgo = 'sha1'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
49
+ if ((certEntry.sha256 == hash) && ((certEntry.cn == '*') || checkAcmActivationCertName(certEntry.cn, fqdn))) { hashAlgo = 'sha256'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
50
+ if ((certEntry.sha1 == hash) && ((certEntry.cn == '*') || checkAcmActivationCertName(certEntry.cn, fqdn))) { hashAlgo = 'sha1'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
51
}
52
if (signkey == null) return { action: 'acmactivate', error: 2, errorText: "No signing certificate found." }; // Did not find a match.
53