fix rsakeysize for letsencrypt #6988
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Apr 21, 2025 at 15:57 UTC
134ca4f025090fa034a827ecd863ce7243c7b604
2 files changed
+9
-4
letsencrypt.js
+3
-3
@@ -66,7 +66,7 @@ module.exports.CreateLetsEncrypt = function (parent) {
66
if (obj.parent.config.letsencrypt.email == null) { obj.configErr = "Let's Encrypt email address not specified."; parent.addServerWarning(obj.configErr); obj.log("WARNING: " + obj.configErr); func(certs); return; }
67
if ((obj.parent.redirserver == null) || ((typeof obj.parent.config.settings.rediraliasport === 'number') && (obj.parent.config.settings.rediraliasport !== 80)) || ((obj.parent.config.settings.rediraliasport == null) && (obj.parent.redirserver.port !== 80))) { obj.configErr = "Redirection web server must be active on port 80 for Let's Encrypt to work."; parent.addServerWarning(obj.configErr); obj.log("WARNING: " + obj.configErr); func(certs); return; }
68
if (obj.redirWebServerHooked !== true) { obj.configErr = "Redirection web server not setup for Let's Encrypt to work."; parent.addServerWarning(obj.configErr); obj.log("WARNING: " + obj.configErr); func(certs); return; }
69
- if ((obj.parent.config.letsencrypt.rsakeysize != null) && (obj.parent.config.letsencrypt.rsakeysize !== 2048) && (obj.parent.config.letsencrypt.rsakeysize !== 3072)) { obj.configErr = "Invalid Let's Encrypt certificate key size, must be 2048 or 3072."; parent.addServerWarning(obj.configErr); obj.log("WARNING: " + obj.configErr); func(certs); return; }
69
+ if ((obj.parent.config.letsencrypt.rsakeysize != null) && (obj.parent.config.letsencrypt.rsakeysize !== 2048) && (obj.parent.config.letsencrypt.rsakeysize !== 3072) && (obj.parent.config.letsencrypt.rsakeysize !== 4096)) { obj.configErr = "Invalid Let's Encrypt certificate key size, must be 2048, 3072 or 4096."; parent.addServerWarning(obj.configErr); obj.log("WARNING: " + obj.configErr); func(certs); return; }
70
if (obj.checkInterval == null) { obj.checkInterval = setInterval(obj.checkRenewCertificate, 86400000); } // Call certificate check every 24 hours.
71
obj.configOk = true;
72
@@ -165,7 +165,7 @@ module.exports.CreateLetsEncrypt = function (parent) {
165
166
// Create a private key
167
obj.log("Generating private key...");
168
- acme.forge.createPrivateKey().then(function (accountKey) {
168
+ acme.forge.createPrivateKey(obj.parent.config.letsencrypt.rsakeysize != null ? obj.parent.config.letsencrypt.rsakeysize : 2048).then(function (accountKey) {
169
170
// Create the ACME client
171
obj.log("Setting up ACME client...");
@@ -189,7 +189,7 @@ module.exports.CreateLetsEncrypt = function (parent) {
189
190
// Create Certificate Request (CSR)
191
obj.log("Creating certificate request...");
192
- var certRequest = { commonName: obj.leDomains[0] };
192
+ var certRequest = { commonName: obj.leDomains[0], keySize: obj.parent.config.letsencrypt.rsakeysize != null ? obj.parent.config.letsencrypt.rsakeysize : 2048 };
193
if (obj.leDomains.length > 1) { certRequest.altNames = obj.leDomains; }
194
acme.forge.createCsr(certRequest).then(function (r) {
195
obj.csr = r[1];
meshcentral-config-schema.json
+6
-1
@@ -546,7 +546,7 @@
546
},
547
"agentWsCompression": {
548
"type": "boolean",
549
- "default": true,
549
+ "default": false,
550
"description": "Enables agent-side, websocket per-message deflate compression. wscompression must also be true for this to work."
551
},
552
"noAgentUpdate": {
@@ -3892,6 +3892,11 @@
3892
"default": false,
3893
"description": "By default a test certificate will be obtained from Let's Encrypt. Setting \"zerossl\", will ignore this setting. Always start by getting a test certificate and make sure that works before setting this to true and obtaining a production certificate. Making too many bad requests for a production certificate will get you banned for a long period of time."
3894
},
3895
+ "rsaKeySize": {
3896
+ "type": "integer",
3897
+ "default": 2048,
3898
+ "description": "The size of the RSA key to generate. The default is 2048 bits."
3899
+ },
3900
"nochecks": {
3901
"type": "boolean",
3902
"default": false,