Added correct hostname header when loading reverse proxy certificate.
Ylian Saint-Hilaire committed
Oct 29, 2019 at 11:10 UTC
532c10def6a753cc3e56f02d54d7406310154f49
2 files changed
+13
-9
certoperations.js
+8
-6
@@ -195,25 +195,27 @@ module.exports.CertificateOperations = function (parent) {
195
}
196
197
// Return the certificate of the remote HTTPS server
198
- obj.loadCertificate = function (url, tag, func) {
198
+ obj.loadCertificate = function (url, hostname, tag, func) {
199
+ console.log('loadCertificate', url, hostname);
200
const u = require('url').parse(url);
201
if (u.protocol == 'https:') {
202
// Read the certificate from HTTPS
202
- const tlssocket = obj.tls.connect((u.port ? u.port : 443), u.hostname, { servername: u.hostname, rejectUnauthorized: false }, function () { this.xxcert = this.getPeerCertificate(); this.end(); });
203
+ if (hostname == null) { hostname = u.hostname; }
204
+ const tlssocket = obj.tls.connect((u.port ? u.port : 443), u.hostname, { servername: hostname, rejectUnauthorized: false }, function () { this.xxcert = this.getPeerCertificate(); this.end(); });
205
tlssocket.xxurl = url;
206
tlssocket.xxfunc = func;
207
tlssocket.xxtag = tag;
206
- tlssocket.on('end', function () { this.xxfunc(this.xxurl, this.xxcert.raw.toString('binary'), this.xxtag); });
207
- tlssocket.on('error', function () { this.xxfunc(this.xxurl, null, this.xxtag); });
208
+ tlssocket.on('end', function () { this.xxfunc(this.xxurl, this.xxcert.raw.toString('binary'), hostname, this.xxtag); });
209
+ tlssocket.on('error', function () { this.xxfunc(this.xxurl, null, hostname, this.xxtag); });
210
} else if (u.protocol == 'file:') {
211
// Read the certificate from a file
212
obj.fs.readFile(url.substring(7), 'utf8', function (err, data) {
213
if (err) { func(url, null, tag); return; }
214
var x1 = data.indexOf('-----BEGIN CERTIFICATE-----'), x2 = data.indexOf('-----END CERTIFICATE-----');
215
if ((x1 >= 0) && (x2 > x1)) {
214
- func(url, Buffer.from(data.substring(x1 + 27, x2), 'base64').toString('binary'), tag);
216
+ func(url, Buffer.from(data.substring(x1 + 27, x2), 'base64').toString('binary'), hostname, tag);
217
} else {
216
- func(url, data, tag);
218
+ func(url, data, hostname, tag);
219
}
220
});
221
} else { func(url, null, tag); }
meshcentral.js
+5
-3
@@ -862,7 +862,9 @@ function CreateMeshCentralServer(config, args) {
862
863
// Load web certs
864
webCertLoadCount++;
865
- obj.certificateOperations.loadCertificate(obj.config.domains[i].certurl, obj.config.domains[i], function (url, cert, xdomain) {
865
+ var dnsname = obj.config.domains[i].dns;
866
+ if ((dnsname == null) && (i == '') && (obj.config.settings.cert != null)) { dnsname = obj.config.settings.cert; }
867
+ obj.certificateOperations.loadCertificate(obj.config.domains[i].certurl, dnsname, obj.config.domains[i], function (url, cert, xhostname, xdomain) {
868
if (cert != null) {
869
// Hash the entire cert
870
var hash = obj.crypto.createHash('sha384').update(Buffer.from(cert, 'binary')).digest('hex');
@@ -875,11 +877,11 @@ function CreateMeshCentralServer(config, args) {
877
//console.log('V1: ' + xdomain.certkeyhash);
878
} catch (ex) { }
879
878
- console.log('Loaded web certificate from ' + url);
880
+ console.log('Loaded web certificate from \"' + url + '\", host: \"' + xhostname + '\"');
881
console.log(' SHA384 cert hash: ' + xdomain.certhash);
882
if (xdomain.certhash != xdomain.certkeyhash) { console.log(' SHA384 key hash: ' + xdomain.certkeyhash); }
883
} else {
882
- console.log('Failed to load web certificate at: ' + url);
884
+ console.log('Failed to load web certificate at: \"' + url + '\", host: \"' + xhostname + '\"');
885
}
886
webCertLoadCount--;
887
if (webCertLoadCount == 0) { obj.StartEx4(); } // Done loading all certificates