MeshCentral now generates a code-signing certificate.
Ylian Saint-Hilaire committed
May 25, 2022 at 11:05 UTC
504941d1e45c6f78781b4449ba09d97fbcd97f74
1 file changed
+27
-1
certoperations.js
+27
-1
@@ -714,6 +714,10 @@ module.exports.CertificateOperations = function (parent) {
714
extensions.push({ name: 'subjectAltName', altNames: altNames });
715
}
716
717
+ if (extKeyUsage.codeSign === true) {
718
+ extensions = [{ name: 'basicConstraints', cA: false }, { name: 'keyUsage', keyCertSign: false, digitalSignature: true, nonRepudiation: false, keyEncipherment: false, dataEncipherment: false }, { name: 'extKeyUsage', codeSigning: true }, { name: "subjectKeyIdentifier" }];
719
+ }
720
+
721
cert.setExtensions(extensions);
722
cert.sign(rootcert.key, obj.forge.md.sha384.create());
723
@@ -780,7 +784,7 @@ module.exports.CertificateOperations = function (parent) {
784
var certargs = args.cert;
785
var mpscertargs = args.mpscert;
786
var strongCertificate = (args.fastcert ? false : true);
783
- var rcountmax = 4;
787
+ var rcountmax = 5;
788
var caindex = 1;
789
var caok = false;
790
var calist = [];
@@ -847,6 +851,12 @@ module.exports.CertificateOperations = function (parent) {
851
if (obj.checkCertificate(r.agent.cert, r.agent.key) == false) { delete r.agent; } else { rcount++; }
852
}
853
854
+ // If the code signing certificate already exist, load it
855
+ if (obj.fileExists("codesign-cert-public.crt") && obj.fileExists("codesign-cert-private.key")) {
856
+ r.codesign = { cert: obj.fileLoad("codesign-cert-public.crt", 'utf8'), key: obj.decryptPrivateKey(obj.fileLoad("codesign-cert-private.key", 'utf8')) };
857
+ if (obj.checkCertificate(r.codesign.cert, r.codesign.key) == false) { delete r.codesign; } else { rcount++; }
858
+ }
859
+
860
// If the swarm server certificate exist, load it (This is an optional certificate)
861
if (obj.fileExists('swarmserver-cert-public.crt') && obj.fileExists('swarmserver-cert-private.key')) {
862
r.swarmserver = { cert: obj.fileLoad('swarmserver-cert-public.crt', 'utf8'), key: obj.decryptPrivateKey(obj.fileLoad('swarmserver-cert-private.key', 'utf8')) };
@@ -1047,6 +1057,22 @@ module.exports.CertificateOperations = function (parent) {
1057
agentPrivateKey = r.agent.key;
1058
}
1059
1060
+ // If the code signing certificate does not exist, create one
1061
+ var codesignCertAndKey, codesignCertificate, codesignPrivateKey;
1062
+ if (r.codesign == null) {
1063
+ console.log("Generating code signing certificate...");
1064
+ codesignCertAndKey = obj.IssueWebServerCertificate(rootCertAndKey, true, commonName, country, organization, { codeSign: true }, strongCertificate);
1065
+ codesignCertificate = obj.pki.certificateToPem(codesignCertAndKey.cert);
1066
+ codesignPrivateKey = obj.pki.privateKeyToPem(codesignCertAndKey.key);
1067
+ obj.fs.writeFileSync(parent.getConfigFilePath('codesign-cert-public.crt'), codesignCertificate);
1068
+ obj.fs.writeFileSync(parent.getConfigFilePath('codesign-cert-private.key'), codesignPrivateKey);
1069
+ } else {
1070
+ // Keep the code signing certificate we have
1071
+ codesignCertAndKey = { cert: obj.pki.certificateFromPem(r.codesign.cert), key: obj.pki.privateKeyFromPem(r.codesign.key) };
1072
+ codesignCertificate = r.codesign.cert;
1073
+ codesignPrivateKey = r.codesign.key;
1074
+ }
1075
+
1076
// If the Intel AMT MPS certificate does not exist, create one
1077
var mpsCertAndKey, mpsCertificate, mpsPrivateKey;
1078
if ((r.mps == null) || (forceMpsCertGen == 1)) {