Added automatic key usage fix for root cert
Ylian Saint-Hilaire committed
Nov 14, 2019 at 16:10 UTC
600c276ad2f3d70ac116059df0845719f6924780
2 files changed
+16
-1
certoperations.js
+15
@@ -418,6 +418,21 @@ module.exports.CertificateOperations = function (parent) {
418
var rootPrivateKey = obj.fileLoad("root-cert-private.key", "utf8");
419
r.root = { cert: rootCertificate, key: rootPrivateKey };
420
rcount++;
421
+
422
+ // Check if the root certificate has the "Certificate Signing (04)" Key usage.
423
+ // This option is required for newer versions of Intel AMT for CIRA/WS-EVENTS.
424
+ var xroot = obj.pki.certificateFromPem(rootCertificate);
425
+ var xext = xroot.getExtension("keyUsage");
426
+ if ((xext == null) || (xext.keyCertSign !== true)) {
427
+ // We need to fix this certificate
428
+ console.log('Fixing root certificate to add signing key usage...');
429
+ obj.fs.writeFileSync(parent.getConfigFilePath("root-cert-public-backup.crt"), rootCertificate);
430
+ xroot.setExtensions([{ name: "basicConstraints", cA: true }, { name: "subjectKeyIdentifier" }, { name: "keyUsage", keyCertSign: true }]);
431
+ var xrootPrivateKey = obj.pki.privateKeyFromPem(rootPrivateKey);
432
+ xroot.sign(xrootPrivateKey, obj.forge.md.sha384.create());
433
+ r.root.cert = obj.pki.certificateToPem(xroot);
434
+ try { obj.fs.writeFileSync(parent.getConfigFilePath("root-cert-public.crt"), r.root.cert); } catch (ex) { }
435
+ }
436
}
437
438
if (args.tlsoffload) {
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.4-a",
3
+ "version": "0.4.4-b",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",