Added 'keepcerts' option to force keeping HTTPS/MPS cert.
Ylian Saint-Hilaire committed
Aug 26, 2022 at 15:43 UTC
f7dc1d749bbbb1eecf6bf83c3545309119547b5e
3 files changed
+17
-12
certoperations.js
+14
-10
@@ -742,12 +742,15 @@ module.exports.CertificateOperations = function (parent) {
742
// Return true if the name is found in the certificates names, we support wildcard certificates
743
obj.compareCertificateNames = function(certNames, name) {
744
if (certNames == null) return false;
745
- if (certNames.indexOf(name.toLowerCase()) >= 0) return true;
746
- for (var i in certNames) {
747
- if ((certNames[i].startsWith('*.') == true) && (name.endsWith(certNames[i].substring(1)) == true)) { return true; }
748
- if (certNames[i].startsWith('http://*.') == true) {
749
- if (name.endsWith(certNames[i].substring(8)) == true) { return true; }
750
- if ((certNames[i].endsWith('/') == true) && (name.endsWith(certNames[i].substring(8, certNames[i].length - 1)) == true)) { return true; }
745
+ name = name.toLowerCase();
746
+ var xcertNames = [];
747
+ for (var i in certNames) { xcertNames.push(certNames[i].toLowerCase()); }
748
+ if (xcertNames.indexOf(name) >= 0) return true;
749
+ for (var i in xcertNames) {
750
+ if ((xcertNames[i].startsWith('*.') == true) && (name.endsWith(xcertNames[i].substring(1)) == true)) { return true; }
751
+ if (xcertNames[i].startsWith('http://*.') == true) {
752
+ if (name.endsWith(xcertNames[i].substring(8)) == true) { return true; }
753
+ if ((xcertNames[i].endsWith('/') == true) && (name.endsWith(xcertNames[i].substring(8, xcertNames[i].length - 1)) == true)) { return true; }
754
}
755
}
756
return false;
@@ -992,12 +995,13 @@ module.exports.CertificateOperations = function (parent) {
995
if (certargs == null) { commonName = r.CommonName; country = xcountry; organization = xorganization; }
996
997
// Check if we have correct certificates.
995
- if (obj.compareCertificateNames(r.CommonNames, commonName) == false) { forceWebCertGen = 1; } else { r.CommonName = commonName; }
998
+ if (obj.compareCertificateNames(r.CommonNames, commonName) == false) { console.log("Error: " + commonName + " does not match name in TLS certificate: " + r.CommonNames.join(', ')); forceWebCertGen = 1; } else { r.CommonName = commonName; }
999
if (r.AmtMpsName != mpsCommonName) { forceMpsCertGen = 1; }
1000
+ if (args.keepcerts == true) { forceWebCertGen = 0; forceMpsCertGen = 0; r.CommonName = commonName; }
1001
1002
// If the certificates matches what we want, use them.
1003
if ((forceWebCertGen == 0) && (forceMpsCertGen == 0)) {
1000
- if (func !== undefined) { func(r); }
1004
+ if (func !== null) { func(r); }
1005
return r;
1006
}
1007
}
@@ -1051,7 +1055,7 @@ module.exports.CertificateOperations = function (parent) {
1055
1056
// If the web certificate does not exist, create one
1057
var webCertAndKey, webCertificate, webPrivateKey;
1054
- if ((r.web == null) || (forceWebCertGen == 1)) {
1058
+ if ((r.web == null) || (forceWebCertGen === 1)) {
1059
console.log("Generating HTTPS certificate...");
1060
webCertAndKey = obj.IssueWebServerCertificate(rootCertAndKey, false, commonName, country, organization, null, strongCertificate);
1061
webCertificate = obj.pki.certificateToPem(webCertAndKey.cert);
@@ -1108,7 +1112,7 @@ module.exports.CertificateOperations = function (parent) {
1112
1113
// If the Intel AMT MPS certificate does not exist, create one
1114
var mpsCertAndKey, mpsCertificate, mpsPrivateKey;
1111
- if ((r.mps == null) || (forceMpsCertGen == 1)) {
1115
+ if ((r.mps == null) || (forceMpsCertGen === 1)) {
1116
console.log("Generating Intel AMT MPS certificate...");
1117
mpsCertAndKey = obj.IssueWebServerCertificate(rootCertAndKey, false, mpsCommonName, mpsCountry, mpsOrganization, null, false);
1118
mpsCertificate = obj.pki.certificateToPem(mpsCertAndKey.cert);
meshcentral-config-schema.json
+1
@@ -8,6 +8,7 @@
8
"type": "object",
9
"properties": {
10
"cert": { "type": "string", "description": "Set this to the primary DNS name of this MeshCentral server." },
11
+ "keepCerts": { "type": "boolean", "default": false, "description": "Force MeshCentral to use the HTTPS and MPS certificates even if the name does not match the expected DNS value." },
12
"mongoDb": { "type": "string", "default": null },
13
"mongoDbName": { "type": "string" },
14
"mongoDbChangeStream": { "type": "boolean", "default": false },
webserver.js
+2
-2
@@ -144,8 +144,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
144
obj.agentCertificateHashHex = parent.certificateOperations.getPublicKeyHash(obj.certificates.agent.cert);
145
obj.agentCertificateHashBase64 = Buffer.from(obj.agentCertificateHashHex, 'hex').toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
146
obj.agentCertificateAsn1 = parent.certificateOperations.forge.asn1.toDer(parent.certificateOperations.forge.pki.certificateToAsn1(parent.certificateOperations.forge.pki.certificateFromPem(parent.certificates.agent.cert))).getBytes();
147
- obj.defaultWebCertificateHash = parent.certificateOperations.getPublicKeyHashBinary(obj.certificates.webdefault.cert);
148
- obj.defaultWebCertificateFullHash = parent.certificateOperations.getCertHashBinary(obj.certificates.webdefault.cert);
147
+ obj.defaultWebCertificateHash = obj.certificates.webdefault ? parent.certificateOperations.getPublicKeyHashBinary(obj.certificates.webdefault.cert) : null;
148
+ obj.defaultWebCertificateFullHash = obj.certificates.webdefault ? parent.certificateOperations.getCertHashBinary(obj.certificates.webdefault.cert) : null;
149
150
// Compute the hash of all of the web certificates for each domain
151
for (var i in obj.parent.config.domains) {