More work on Intel AMT ACM activation.
Ylian Saint-Hilaire committed
Jun 18, 2019 at 17:53 UTC
d0b80154a4f4fdbd37326d655f2366caa0dbe78d
1 file changed
+28
meshcentral.js
+28
@@ -727,6 +727,31 @@ function CreateMeshCentralServer(config, args) {
727
var r = null;
728
try { r = obj.certificateOperations.loadPfxCertificate(obj.path.join(obj.datapath, acmconfig.cert), acmconfig.certpass); } catch (ex) { console.log(ex); }
729
if ((r == null) || (r.certs == null) || (r.keys == null) || (r.certs.length < 2) || (r.keys.length == 0)) { badAcmConfigs.push(j); continue; }
730
+
731
+ // Check if the right OU or OID is present for Intel AMT activation
732
+ var validActivationCert = false;
733
+ for (var k in r.certs[0].extensions) { if (r.certs[0].extensions[k]['2.16.840.1.113741.1.2.3'] == true) { validActivationCert = true; } }
734
+ var orgName = r.certs[0].subject.getField('OU');
735
+ if ((orgName != null) && (orgName.value == 'Intel(R) Client Setup Certificate')) { validActivationCert = true; }
736
+ if (validActivationCert == false) continue;
737
+
738
+ // Compute the SHA256 and SHA1 hashes of the root certificate
739
+ for (var k in r.certs) {
740
+ if (r.certs[k].subject.hash != r.certs[k].issuer.hash) continue;
741
+ const certdata = obj.certificateOperations.forge.asn1.toDer(obj.certificateOperations.pki.certificateToAsn1(r.certs[k])).data;
742
+ var md = obj.certificateOperations.forge.md.sha256.create();
743
+ md.update(certdata);
744
+ acmconfig.sha256 = Buffer.from(md.digest().getBytes(), 'binary').toString('hex');
745
+ md = obj.certificateOperations.forge.md.sha1.create();
746
+ md.update(certdata);
747
+ acmconfig.sha1 = Buffer.from(md.digest().getBytes(), 'binary').toString('hex');
748
+ }
749
+ if ((acmconfig.sha1 == null) || (acmconfig.sha256 == null)) continue;
750
+
751
+ // Get the certificate common name
752
+ var certCommonName = r.certs[0].subject.getField('CN');
753
+ if (certCommonName != null) { acmconfig.cn = certCommonName.value; }
754
+
755
delete acmconfig.cert;
756
delete acmconfig.certpass;
757
acmconfig.certs = r.certs;
@@ -734,9 +759,12 @@ function CreateMeshCentralServer(config, args) {
759
for (var k in acmconfig.dnsmatch) { if (dnsmatch.indexOf(acmconfig.dnsmatch[k]) == -1) { dnsmatch.push(acmconfig.dnsmatch[k]); } }
760
amtAcmCertCount++;
761
}
762
+
763
// Remove all bad configurations
764
for (var j in badAcmConfigs) { console.log('WARNING: Incorrect Intel AMT ACM configuration "' + i + (i == '' ? '' : '/') + badAcmConfigs[j] + '".'); delete obj.config.domains[i].amtacmactivationcerts[j]; }
765
if (amtAcmCertCount == 0) { delete obj.config.domains[i].amtacmactivation; } else { obj.config.domains[i].amtacmactivation.dnsmatch = dnsmatch; }
766
+
767
+ //console.log(obj.config.domains[''].amtacmactivation);
768
}
769
770
if (obj.config.domains[i].certurl != null) {