Added support for intermediate CA certs in web server TLS.
Ylian Saint-Hilaire committed
Sep 7, 2017 at 16:01 UTC
5e00e61d08d6701bd006c87e22d2641da8b65f77
5 files changed
+17
-5
certoperations.js
+14
-1
@@ -154,6 +154,19 @@ module.exports.CertificateOperations = function () {
154
r.agent = { cert: agentCertificate, key: agentPrivateKey };
155
rcount++;
156
}
157
+
158
+ // If CA certificates are present, load them
159
+ var caok, caindex = 1, calist = [];
160
+ do {
161
+ caok = false;
162
+ if (obj.fileExists(directory + '/webserver-cert-chain' + caindex + '.crt')) {
163
+ var caCertificate = obj.fs.readFileSync(directory + '/webserver-cert-chain' + caindex + '.crt', 'utf8');
164
+ calist.push(caCertificate);
165
+ caok = true;
166
+ }
167
+ caindex++;
168
+ } while (caok == true);
169
+ r.calist = calist;
170
171
// Decode certificate arguments
172
var commonName = 'un-configured', country, organization;
@@ -226,7 +239,7 @@ module.exports.CertificateOperations = function () {
239
agentPrivateKey = r.agent.key
240
}
241
229
- var r = { root: { cert: rootCertificate, key: rootPrivateKey }, web: { cert: webCertificate, key: webPrivateKey }, mps: { cert: mpsCertificate, key: mpsPrivateKey }, agent: { cert: agentCertificate, key: agentPrivateKey }, CommonName: commonName, RootName: rootName };
242
+ var r = { root: { cert: rootCertificate, key: rootPrivateKey }, web: { cert: webCertificate, key: webPrivateKey }, mps: { cert: mpsCertificate, key: mpsPrivateKey }, agent: { cert: agentCertificate, key: agentPrivateKey }, calist: calist, CommonName: commonName, RootName: rootName };
243
if (func != undefined) { func(r); }
244
return r;
245
}
meshagent.js
-1
@@ -436,7 +436,6 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
436
case 'iplocation':
437
{
438
// Sent by the agent to update location information
439
- console.log(command);
439
if ((command.type == 'publicip') && (command.value != null) && (typeof command.value == 'object') && (command.value.ip) && (command.value.loc)) {
440
var x = {};
441
x.publicip = command.value.ip;
meshcentral.js
+1
-1
@@ -299,7 +299,7 @@ function CreateMeshCentralServer() {
299
}
300
301
// Setup and start the redirection server if needed
302
- if (obj.args.redirport != undefined && typeof obj.args.redirport == 'number') {
302
+ if ((obj.args.redirport != undefined) && (typeof obj.args.redirport == 'number') && (obj.args.redirport != 0)) {
303
obj.redirserver = require('./redirserver.js').CreateRedirServer(obj, obj.db, obj.args, obj.certificates);
304
}
305
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.0.7-o",
3
+ "version": "0.0.7-p",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+1
-1
@@ -89,7 +89,7 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
89
// Setup the HTTP server with TLS
90
//var certOperations = require('./certoperations.js').CertificateOperations();
91
//var webServerCert = certOperations.GetWebServerCertificate('./data', 'SampleServer.org', 'US', 'SampleOrg');
92
- obj.tlsServer = require('https').createServer({ cert: obj.certificates.web.cert, key: obj.certificates.web.key, rejectUnauthorized: true }, obj.app);
92
+ obj.tlsServer = require('https').createServer({ cert: obj.certificates.web.cert, key: obj.certificates.web.key, ca: obj.certificates.calist, rejectUnauthorized: true }, obj.app);
93
obj.expressWs = require('express-ws')(obj.app, obj.tlsServer);
94
}
95