Improved Intel AMT ACM cert chain creation errors.
Ylian Saint-Hilaire committed
Feb 24, 2022 at 11:00 UTC
db707b6525ddd3d5062a19c1a77b89064eb1cd41
3 files changed
+20
-12
certoperations.js
+18
-10
@@ -168,6 +168,7 @@ module.exports.CertificateOperations = function (parent) {
168
obj.loadIntelAmtAcmCerts = function (amtacmactivation) {
169
if (amtacmactivation == null) return;
170
var acmCerts = [], acmmatch = [];
171
+ amtacmactivation.acmCertErrors = [];
172
if (amtacmactivation.certs != null) {
173
for (var j in amtacmactivation.certs) {
174
if (j.startsWith('_')) continue; // Skip any certificates that start with underscore as the name.
@@ -175,14 +176,21 @@ module.exports.CertificateOperations = function (parent) {
176
177
if ((typeof acmconfig.certpfx == 'string') && (typeof acmconfig.certpfxpass == 'string')) {
178
// P12 format, certpfx and certpfxpass
178
- try { r = obj.loadPfxCertificate(parent.common.joinPath(obj.parent.datapath, acmconfig.certpfx), acmconfig.certpfxpass); } catch (ex) { console.log(ex); }
179
- if ((r == null) || (r.certs == null) || (r.keys == null) || (r.certs.length < 2) || (r.keys.length != 1)) continue;
179
+ const certFilePath = parent.common.joinPath(obj.parent.datapath, acmconfig.certpfx);
180
+ try { r = obj.loadPfxCertificate(certFilePath, acmconfig.certpfxpass); } catch (ex) { console.log(ex); }
181
+ if ((r == null) || (r.certs == null) || (r.keys == null)) { amtacmactivation.acmCertErrors.push("Unable to load certificate file: " + certFilePath + "."); continue; }
182
+ if (r.certs.length < 2) { amtacmactivation.acmCertErrors.push("Certificate file contains less then 2 certificates: " + certFilePath + "."); continue; }
183
+ if (r.keys.length != 1) { amtacmactivation.acmCertErrors.push("Certificate file must contain exactly one private key: " + certFilePath + "."); continue; }
184
} else if ((typeof acmconfig.certfiles == 'object') && (typeof acmconfig.keyfile == 'string')) {
185
// PEM format, certfiles and keyfile
186
r = { certs: [], keys: [] };
183
- for (var k in acmconfig.certfiles) { r.certs.push(obj.pki.certificateFromPem(obj.fs.readFileSync(parent.common.joinPath(obj.parent.datapath, acmconfig.certfiles[k])))); }
187
+ for (var k in acmconfig.certfiles) {
188
+ const certFilePath = parent.common.joinPath(obj.parent.datapath, acmconfig.certfiles[k]);
189
+ try { r.certs.push(obj.pki.certificateFromPem(obj.fs.readFileSync(certFilePath))); } catch (ex) { amtacmactivation.acmCertErrors.push("Unable to load certificate file: " + certFilePath + "."); }
190
+ }
191
r.keys.push(obj.pki.privateKeyFromPem(obj.fs.readFileSync(parent.common.joinPath(obj.parent.datapath, acmconfig.keyfile))));
185
- if ((r.certs.length < 2) || (r.keys.length != 1)) continue;
192
+ if (r.certs.length < 2) { amtacmactivation.acmCertErrors.push("Certificate file contains less then 2 certificates: " + certFilePath + "."); continue; }
193
+ if (r.keys.length != 1) { amtacmactivation.acmCertErrors.push("Certificate file must contain exactly one private key: " + certFilePath + "."); continue; }
194
}
195
196
// Reorder the certificates from leaf to root.
@@ -198,12 +206,12 @@ module.exports.CertificateOperations = function (parent) {
206
}
207
}
208
}
201
- if (orderingError == true) continue;
209
+ if (orderingError == true) { amtacmactivation.acmCertErrors.push("Unable to order Intel AMT ACM activation certificates to create a full chain."); continue; }
210
r.certs = or;
211
212
// Check that the certificate and private key match
213
if ((compareArrays(r.certs[0].publicKey.n.data, r.keys[0].n.data) == false) || (compareArrays(r.certs[0].publicKey.e.data, r.keys[0].e.data) == false)) {
206
- parent.addServerWarning('Intel AMT activation certificate provided with a mismatching private key.');
214
+ amtacmactivation.acmCertErrors.push("Intel AMT activation certificate provided with a mismatching private key.");
215
continue;
216
}
217
@@ -221,11 +229,11 @@ module.exports.CertificateOperations = function (parent) {
229
for (var k in r.certs[0].extensions) { if (r.certs[0].extensions[k]['2.16.840.1.113741.1.2.3'] == true) { validActivationCert = true; } }
230
var orgName = r.certs[0].subject.getField('OU');
231
if ((orgName != null) && (orgName.value == 'Intel(R) Client Setup Certificate')) { validActivationCert = true; }
224
- if (validActivationCert == false) continue;
232
+ if (validActivationCert == false) { amtacmactivation.acmCertErrors.push("Intel AMT activation certificate must have usage OID \"2.16.840.1.113741.1.2.3\" or organization name \"Intel(R) Client Setup Certificate\"."); continue; }
233
234
// Compute the SHA256 and SHA1 hashes of the root certificate
235
for (var k in r.certs) {
228
- if (r.certs[k].subject.hash != r.certs[k].issuer.hash) continue;
236
+ if (r.certs[k].subject.hash != r.certs[k].issuer.hash) { amtacmactivation.acmCertErrors.push("Invalid Intel AMT ACM certificate chain."); continue; }
237
const certdata = obj.forge.asn1.toDer(obj.pki.certificateToAsn1(r.certs[k])).data;
238
var md = obj.forge.md.sha256.create();
239
md.update(certdata);
@@ -234,11 +242,11 @@ module.exports.CertificateOperations = function (parent) {
242
md.update(certdata);
243
acmconfig.sha1 = Buffer.from(md.digest().getBytes(), 'binary').toString('hex');
244
}
237
- if ((acmconfig.sha1 == null) || (acmconfig.sha256 == null)) continue;
245
+ if ((acmconfig.sha1 == null) || (acmconfig.sha256 == null)) { amtacmactivation.acmCertErrors.push("Unable to compute Intel AMT activation certificate SHA1 and SHA256 hashes."); continue; }
246
247
// Get the certificate common name
248
var certCommonName = r.certs[0].subject.getField('CN');
241
- if (certCommonName == null) continue;
249
+ if (certCommonName == null) { amtacmactivation.acmCertErrors.push("Unable to get Intel AMT activation certificate common name."); continue; }
250
var certCommonNameSplit = certCommonName.value.split('.');
251
var topLevel = certCommonNameSplit[certCommonNameSplit.length - 1].toLowerCase();
252
var topLevelNum = TopLevelDomainExtendedSupport[topLevel];
meshcentral.js
+1
-1
@@ -1491,7 +1491,7 @@ function CreateMeshCentralServer(config, args) {
1491
// Load any Intel AMT ACM activation certificates
1492
if (obj.config.domains[i].amtacmactivation == null) { obj.config.domains[i].amtacmactivation = {}; }
1493
obj.certificateOperations.loadIntelAmtAcmCerts(obj.config.domains[i].amtacmactivation);
1494
-
1494
+ if (obj.config.domains[i].amtacmactivation.acmCertErrors != null) { for (var j in obj.config.domains[i].amtacmactivation.acmCertErrors) { obj.addServerWarning(obj.config.domains[i].amtacmactivation.acmCertErrors[j]); } }
1495
if (typeof obj.config.domains[i].certurl == 'string') {
1496
obj.supportsProxyCertificatesRequest = true; // If a certurl is set, enable proxy cert requests
1497
// Then, fix the URL and add 'https://' if needed
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.9.88",
3
+ "version": "0.9.89",
4
"keywords": [
5
"Remote Device Management",
6
"Remote Device Monitoring",