Fix annoying Google Chrome warning about invalid certificate
* add subjectAltName with DNS and IP entry type when necessary according to passed commonName in "IssueWebServerCertificate" function
lajet committed
Mar 16, 2019 at 22:49 UTC
17118766731b00dde136acaa3dcdf24dd1732f8b
1 file changed
+29
-1
certoperations.js
+29
-1
@@ -154,7 +154,35 @@ module.exports.CertificateOperations = function (parent) {
154
if (extKeyUsage == null) { extKeyUsage = { name: "extKeyUsage", serverAuth: true }; } else { extKeyUsage.name = "extKeyUsage"; }
155
//var extensions = [{ name: "basicConstraints", cA: false }, { name: "keyUsage", keyCertSign: true, digitalSignature: true, nonRepudiation: true, keyEncipherment: true, dataEncipherment: true }, extKeyUsage, { name: "nsCertType", client: false, server: true, email: false, objsign: false, sslCA: false, emailCA: false, objCA: false }, { name: "subjectKeyIdentifier" }];
156
var extensions = [{ name: "basicConstraints", cA: false }, { name: "keyUsage", keyCertSign: false, digitalSignature: true, nonRepudiation: false, keyEncipherment: true, dataEncipherment: (extKeyUsage.serverAuth !== true) }, extKeyUsage, { name: "subjectKeyIdentifier" }];
157
- if (extKeyUsage.serverAuth === true) { extensions.push({ name: "subjectAltName", altNames: [{ type: 6, value: "http://" + commonName + "/" }, { type: 6, value: "http://localhost/" }, { type: 6, value: commonName }, { type: 6, value: "localhost" }] }); }
157
+
158
+ if (extKeyUsage.serverAuth === true) {
159
+
160
+ // set subjectAltName according to commonName parsing.
161
+ // Ideally, we should let opportunity in given interface to set any type of altNames according to node_forge library
162
+ // such as type 2, 6 and 7
163
+ // 2 -> DNS
164
+ // 6 -> URI
165
+ // 7 -> IP
166
+ var altNames = [];
167
+
168
+ // According to commonName parsing (IP or DNS), add URI and DNS and/or IP altNames
169
+ if (require('net').isIP(commonName)) {
170
+ // set both IP and DNS when commonName is an IP@
171
+ altNames.push({ type: 7, ip: commonName });
172
+ altNames.push({ type: 2, value: commonName });
173
+ } else {
174
+ // set only DNS when commonName is a FQDN
175
+ altNames.push({ type: 2, value: commonName });
176
+ }
177
+ altNames.push({ type: 6, value: "http://" + commonName + "/" })
178
+
179
+ // add localhost stuff for easy testing on localhost ;)
180
+ altNames.push({ type: 2, value: "localhost" });
181
+ altNames.push({ type: 6, value: "http://localhost/" });
182
+ altNames.push({ type: 7, ip: "127.0.0.1" });
183
+
184
+ extensions.push({ name: "subjectAltName", altNames: altNames });
185
+ }
186
187
cert.setExtensions(extensions);
188
cert.sign(rootcert.key, obj.forge.md.sha384.create());