@cryptotaxi247 / MeshCentral / commits / 3a22bfbc

Fixed issue with TLS certificate that had an no issuer CN (#4681)

Ylian Saint-Hilaire committed Nov 2, 2022 at 10:45 UTC 3a22bfbc2479acfce2127371945f0e75cee67dde

2 files changed +6 -4

certoperations.js

+5 -3

@@ -922,7 +922,7 @@ module.exports.CertificateOperations = function (parent) {

922 // Fetch the certificates names for the main certificate

923 r.AmtMpsName = obj.pki.certificateFromPem(r.mps.cert).subject.getField('CN').value;

924 var webCertificate = obj.pki.certificateFromPem(r.web.cert);

925 - r.WebIssuer = webCertificate.issuer.getField('CN').value;

925 + if (webCertificate.issuer.getField('CN') != null) { r.WebIssuer = webCertificate.issuer.getField('CN').value; } else { r.WebIssuer = null; }

926 r.CommonName = webCertificate.subject.getField('CN').value;

927 r.CommonNames = [ r.CommonName ];

928 var altNames = webCertificate.getExtension('subjectAltName');

@@ -1005,6 +1005,7 @@ module.exports.CertificateOperations = function (parent) {

1005 return r;

1006 }

1007 }

1008 +

1009 if (parent.configurationFiles != null) {

1010 console.log("Error: Vault/Database missing some certificates.");

1011 if (r.root == null) { console.log(' Code signing certificate is missing.'); }

@@ -1074,7 +1075,8 @@ module.exports.CertificateOperations = function (parent) {

1075 webPrivateKey = r.web.key;

1076 }

1077 }

1077 - var webIssuer = webCertAndKey.cert.issuer.getField('CN').value;

1078 + var webIssuer = null;

1079 + if (webCertAndKey.cert.issuer.getField('CN') != null) { webIssuer = webCertAndKey.cert.issuer.getField('CN').value; }

1080

1081 // If the mesh agent server certificate does not exist, create one

1082 var agentCertAndKey, agentCertificate, agentPrivateKey;

@@ -1131,7 +1133,7 @@ module.exports.CertificateOperations = function (parent) {

1133

1134 // Fetch the certificates names for the main certificate

1135 var webCertificate = obj.pki.certificateFromPem(r.web.cert);

1134 - r.WebIssuer = webCertificate.issuer.getField('CN').value;

1136 + if (webCertificate.issuer.getField('CN') != null) { r.WebIssuer = webCertificate.issuer.getField('CN').value; } else { r.WebIssuer = null; }

1137 r.CommonName = webCertificate.subject.getField('CN').value;

1138 if (r.CommonName.startsWith('*.')) {

1139 if (commonName.indexOf('.') == -1) { console.log("ERROR: Must specify a server full domain name in Config.json->Settings->Cert when using a wildcard certificate."); process.exit(0); return; }

webserver.js

+1 -1

@@ -3393,7 +3393,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF

3393 if (typeof obj.args.trustedcert == 'boolean') return obj.args.trustedcert; // If the status of the cert specified, use that.

3394 if (obj.args.tlsoffload != null) return true; // We are using TLS offload, a real cert is likely used.

3395 if (obj.parent.config.letsencrypt != null) return (obj.parent.config.letsencrypt.production === true); // We are using Let's Encrypt, real cert in use if production is set to true.

3396 - if (obj.certificates.WebIssuer.indexOf('MeshCentralRoot-') == 0) return false; // Our cert is issued by self-signed cert.

3396 + if ((typeof obj.certificates.WebIssuer == 'string') && (obj.certificates.WebIssuer.indexOf('MeshCentralRoot-') == 0)) return false; // Our cert is issued by self-signed cert.

3397 if (obj.certificates.CommonName.indexOf('.') == -1) return false; // Our cert is named with a fake name

3398 return true; // This is a guess

3399 }