Corrected getPublicKeyHashBinary() to handle hashing the public key of a cert without ForgeJS.
Ylian Saint-Hilaire committed
Oct 1, 2023 at 00:52 UTC
f5c056fdeb0a3b0da61e5038d405b6c14d0a74bf
1 file changed
+3
-4
certoperations.js
+3
-4
@@ -640,12 +640,11 @@ module.exports.CertificateOperations = function (parent) {
640
const { X509Certificate } = require('crypto');
641
if (X509Certificate == null) {
642
// This version of NodeJS (<v15.6.0) does not support X509 certs, use Node-Forge instead which only supports RSA certs.
643
- var publickey = obj.pki.certificateFromPem(pem).publicKey;
644
- return obj.pki.getPublicKeyFingerprint(publickey, { encoding: 'binary', md: obj.forge.md.sha384.create() });
643
+ return obj.pki.getPublicKeyFingerprint(obj.pki.certificateFromPem(pem).publicKey, { encoding: 'binary', md: obj.forge.md.sha384.create() });
644
} else {
645
// This version of NodeJS supports x509 certificates
647
- // TODO: THIS IS NOT CORRECT, this is SHA254 of the entire cert.
648
- return Buffer.from(new X509Certificate(pem).fingerprint256.split(':').join(''), 'hex');
646
+ var cert = new X509Certificate(pem);
647
+ return obj.crypto.createHash('sha384').update(cert.publicKey.export({ type: ((cert.publicKey.asymmetricKeyType == 'rsa') ? 'pkcs1' : 'spki'), format: 'der' })).digest('binary');
648
}
649
};
650