Added completely new Let's Encrypt system.
Ylian Saint-Hilaire committed
Mar 5, 2020 at 01:39 UTC
fea2120849eeb076f086916c43fad92ae3827757
5 files changed
+246
-22
MeshCentralServer.njsproj
+2
@@ -316,6 +316,7 @@
316
<Folder Include="typings\" />
317
<Folder Include="typings\globals\" />
318
<Folder Include="typings\globals\connect-redis\" />
319
+ <Folder Include="typings\globals\cookie-session\" />
320
<Folder Include="typings\globals\express-handlebars\" />
321
<Folder Include="typings\globals\express-session\" />
322
<Folder Include="typings\globals\node-forge\" />
@@ -325,6 +326,7 @@
326
</ItemGroup>
327
<ItemGroup>
328
<TypeScriptCompile Include="typings\globals\connect-redis\index.d.ts" />
329
+ <TypeScriptCompile Include="typings\globals\cookie-session\index.d.ts" />
330
<TypeScriptCompile Include="typings\globals\express-handlebars\index.d.ts" />
331
<TypeScriptCompile Include="typings\globals\express-session\index.d.ts" />
332
<TypeScriptCompile Include="typings\globals\node-forge\index.d.ts" />
letsEncrypt.js
+196
-2
@@ -14,8 +14,8 @@
14
/*jshint esversion: 6 */
15
'use strict';
16
17
+// GreenLock Implementation
18
var globalLetsEncrypt = null;
18
-
19
module.exports.CreateLetsEncrypt = function (parent) {
20
try {
21
// Get the GreenLock version
@@ -44,6 +44,7 @@ module.exports.CreateLetsEncrypt = function (parent) {
44
var obj = {};
45
globalLetsEncrypt = obj;
46
obj.parent = parent;
47
+ obj.lib = 'greenlock';
48
obj.path = require('path');
49
obj.redirWebServerHooked = false;
50
obj.leDomains = null;
@@ -322,4 +323,197 @@ module.exports.create = function (options) {
323
};
324
325
return manager;
325
-};
\ No newline at end of file
326
+};
327
+
328
+
329
+// ACME-Client Implementation
330
+var globalLetsEncrypt = null;
331
+module.exports.CreateLetsEncrypt2 = function (parent) {
332
+ const acme = require('acme-client');
333
+
334
+ var obj = {};
335
+ obj.lib = 'acme-client';
336
+ obj.fs = require('fs');
337
+ obj.path = require('path');
338
+ obj.parent = parent;
339
+ obj.forge = obj.parent.certificateOperations.forge;
340
+ obj.leDomains = null;
341
+ obj.challenges = {};
342
+ obj.runAsProduction = false;
343
+ obj.redirWebServerHooked = false;
344
+
345
+ // Setup the certificate storage paths
346
+ obj.certPath = obj.path.join(obj.parent.datapath, 'letsencrypt-certs');
347
+ try { obj.parent.fs.mkdirSync(obj.certPath); } catch (e) { }
348
+
349
+ // Hook up GreenLock to the redirection server
350
+ if (obj.parent.config.settings.rediraliasport === 80) { obj.redirWebServerHooked = true; }
351
+ else if ((obj.parent.config.settings.rediraliasport == null) && (obj.parent.redirserver.port == 80)) { obj.redirWebServerHooked = true; }
352
+
353
+ // Deal with HTTP challenges
354
+ function challengeCreateFn(authz, challenge, keyAuthorization) { if (challenge.type === 'http-01') { obj.challenges[challenge.token] = keyAuthorization; } }
355
+ function challengeRemoveFn(authz, challenge, keyAuthorization) { if (challenge.type === 'http-01') { delete obj.challenges[challenge.token]; } }
356
+ obj.challenge = function (token, hostname, func) { func(obj.challenges[token]); }
357
+
358
+ // Get the current certificate
359
+ obj.getCertificate = function(certs, func) {
360
+ obj.runAsProduction = (obj.parent.config.letsencrypt.production === true);
361
+ parent.debug('cert', "LE: Getting certs from local store (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
362
+ if (certs.CommonName.indexOf('.') == -1) { console.log("ERROR: Use --cert to setup the default server name before using Let's Encrypt."); func(certs); return; }
363
+ if (obj.parent.config.letsencrypt == null) { func(certs); return; }
364
+ if (obj.parent.config.letsencrypt.email == null) { console.log("ERROR: Let's Encrypt email address not specified."); func(certs); return; }
365
+ if ((obj.parent.redirserver == null) || ((typeof obj.parent.config.settings.rediraliasport === 'number') && (obj.parent.config.settings.rediraliasport !== 80)) || ((obj.parent.config.settings.rediraliasport == null) && (obj.parent.redirserver.port !== 80))) { console.log("ERROR: Redirection web server must be active on port 80 for Let's Encrypt to work."); func(certs); return; }
366
+ if (obj.redirWebServerHooked !== true) { console.log("ERROR: Redirection web server not setup for Let's Encrypt to work."); func(certs); return; }
367
+ if ((obj.parent.config.letsencrypt.rsakeysize != null) && (obj.parent.config.letsencrypt.rsakeysize !== 2048) && (obj.parent.config.letsencrypt.rsakeysize !== 3072)) { console.log("ERROR: Invalid Let's Encrypt certificate key size, must be 2048 or 3072."); func(certs); return; }
368
+
369
+ // Get the list of domains
370
+ obj.leDomains = [ certs.CommonName ];
371
+ if (obj.parent.config.letsencrypt.names != null) {
372
+ if (typeof obj.parent.config.letsencrypt.names == 'string') { obj.parent.config.letsencrypt.names = obj.parent.config.letsencrypt.names.split(','); }
373
+ obj.parent.config.letsencrypt.names.map(function (s) { return s.trim(); }); // Trim each name
374
+ if ((typeof obj.parent.config.letsencrypt.names != 'object') || (obj.parent.config.letsencrypt.names.length == null)) { console.log("ERROR: Let's Encrypt names must be an array in config.json."); func(certs); return; }
375
+ obj.leDomains = obj.parent.config.letsencrypt.names;
376
+ }
377
+
378
+ // Read TLS certificate from the configPath
379
+ var certFile = obj.path.join(obj.certPath, (obj.runAsProduction ? 'production.crt' : 'staging.crt'));
380
+ var keyFile = obj.path.join(obj.certPath, (obj.runAsProduction ? 'production.key' : 'staging.key'));
381
+ if (obj.fs.existsSync(certFile) && obj.fs.existsSync(keyFile)) {
382
+ parent.debug('cert', "LE: Reading certificate files");
383
+
384
+ // Read the certificate and private key
385
+ var certPem = obj.fs.readFileSync(certFile).toString('utf8');
386
+ var cert = obj.forge.pki.certificateFromPem(certPem);
387
+ var keyPem = obj.fs.readFileSync(keyFile).toString('utf8');
388
+ var key = obj.forge.pki.privateKeyFromPem(keyPem);
389
+
390
+ // Decode the certificate common and alt names
391
+ obj.certNames = [cert.subject.getField('CN').value];
392
+ var altNames = cert.getExtension('subjectAltName');
393
+ if (altNames) { for (i = 0; i < altNames.altNames.length; i++) { var acn = altNames.altNames[i].value.toLowerCase(); if (obj.certNames.indexOf(acn) == -1) { obj.certNames.push(acn); } } }
394
+
395
+ // Decode the certificate expire time
396
+ obj.certExpire = cert.validity.notAfter;
397
+
398
+ // Use this certificate when possible on any domain
399
+ if (obj.certNames.indexOf(certs.CommonName) >= 0) {
400
+ certs.web.cert = certPem;
401
+ certs.web.key = keyPem;
402
+ //certs.web.ca = [results.pems.chain];
403
+ }
404
+ for (var i in obj.parent.config.domains) {
405
+ if ((obj.parent.config.domains[i].dns != null) && (obj.parent.certificateOperations.compareCertificateNames(obj.certNames, obj.parent.config.domains[i].dns))) {
406
+ certs.dns[i].cert = certPem;
407
+ certs.dns[i].key = keyPem;
408
+ //certs.dns[i].ca = [results.pems.chain];
409
+ }
410
+ }
411
+ } else {
412
+ parent.debug('cert', "LE: No certificate files found");
413
+ }
414
+ func(certs);
415
+ obj.checkRenewCertificate();
416
+ }
417
+
418
+ // Check if we need to get a new certificate
419
+ // Return 0 = CertOK, 1 = Request:NoCert, 2 = Request:Expire, 3 = Request:MissingNames
420
+ obj.checkRenewCertificate = function () {
421
+ parent.debug('cert', "LE: Checking certificate");
422
+ if (obj.certNames == null) {
423
+ parent.debug('cert', "LE: Got no certificates, asking for one now.");
424
+ obj.requestCertificate();
425
+ return 1;
426
+ } else {
427
+ // Look at the existing certificate to see if we need to renew it
428
+ var daysLeft = Math.floor((obj.certExpire - new Date()) / 86400000);
429
+ parent.debug('cert', "LE: Certificate has " + daysLeft + " day(s) left.");
430
+ if (daysLeft < 45) {
431
+ parent.debug('cert', "LE: Asking for new certificate because of expire time.");
432
+ obj.requestCertificate();
433
+ return 2;
434
+ } else {
435
+ var missingDomain = false;
436
+ for (var i in obj.leDomains) {
437
+ if (obj.parent.certificateOperations.compareCertificateNames(obj.certNames, obj.leDomains[i]) == false) {
438
+ parent.debug('cert', "LE: Missing name " + obj.leDomains[i] + ".");
439
+ missingDomain = true;
440
+ }
441
+ }
442
+ if (missingDomain) {
443
+ parent.debug('cert', "LE: Asking for new certificate because of missing names.");
444
+ obj.requestCertificate();
445
+ return 3;
446
+ } else {
447
+ parent.debug('cert', "LE: Certificate is ok.");
448
+ }
449
+ }
450
+ }
451
+ return 0;
452
+ }
453
+
454
+ obj.requestCertificate = function () {
455
+ // Create a private key
456
+ parent.debug('cert', "LE: Generating private key...");
457
+ acme.forge.createPrivateKey().then(function (accountKey) {
458
+ // Create the ACME client
459
+ parent.debug('cert', "LE: Setting up ACME client...");
460
+ obj.client = new acme.Client({
461
+ directoryUrl: obj.runAsProduction ? acme.directory.letsencrypt.production : acme.directory.letsencrypt.staging,
462
+ accountKey: accountKey
463
+ });
464
+
465
+ // Create Certificate Request (CSR)
466
+ parent.debug('cert', "LE: Creating certificate request...");
467
+ acme.forge.createCsr({
468
+ commonName: obj.leDomains[0],
469
+ altNames: obj.leDomains
470
+ }).then(function (r) {
471
+ var csr = r[1];
472
+ obj.tempPrivateKey = r[0];
473
+ parent.debug('cert', "LE: Requesting certificate from Let's Encrypt...");
474
+ obj.client.auto({
475
+ csr,
476
+ email: obj.parent.config.letsencrypt.email,
477
+ termsOfServiceAgreed: true,
478
+ challengeCreateFn,
479
+ challengeRemoveFn
480
+ }).then(function (cert) {
481
+ parent.debug('cert', "LE: Got certificate.");
482
+
483
+ // Save certificate and private key to PEM files
484
+ var certFile = obj.path.join(obj.certPath, (obj.runAsProduction ? 'production.crt' : 'staging.crt'));
485
+ var keyFile = obj.path.join(obj.certPath, (obj.runAsProduction ? 'production.key' : 'staging.key'));
486
+ obj.fs.writeFileSync(certFile, cert);
487
+ obj.fs.writeFileSync(keyFile, obj.tempPrivateKey);
488
+ delete obj.tempPrivateKey;
489
+
490
+ // Cause a server restart
491
+ parent.debug('cert', "LE: Performing server restart...");
492
+ obj.parent.performServerCertUpdate();
493
+ }, function (err) {
494
+ parent.debug('cert', "LE: Failed to obtain certificate: " + err.message);
495
+ });
496
+ }, function (err) {
497
+ parent.debug('cert', "LE: Failed to generate certificate request: " + err.message);
498
+ });
499
+ }, function (err) {
500
+ parent.debug('cert', "LE: Failed to generate private key: " + err.message);
501
+ });
502
+ }
503
+
504
+ // Return the status of this module
505
+ obj.getStats = function () {
506
+ var r = {
507
+ lib: 'acme-client',
508
+ leDomains: obj.leDomains,
509
+ challenges: obj.challenges,
510
+ production: obj.runAsProduction,
511
+ webServer: obj.redirWebServerHooked,
512
+ certPath: obj.certPath,
513
+ };
514
+ if (obj.certExpire) { r.daysLeft = Math.floor((obj.certExpire - new Date()) / 86400000); }
515
+ return r;
516
+ }
517
+
518
+ return obj;
519
+}
\ No newline at end of file
meshcentral.js
+13
-3
@@ -1072,7 +1072,11 @@ function CreateMeshCentralServer(config, args) {
1072
obj.StartEx3(certs); // Just use the configured certificates
1073
} else if ((obj.config.letsencrypt != null) && (obj.config.letsencrypt.nochecks == true)) {
1074
// Use Let's Encrypt with no checking
1075
- obj.letsencrypt = require('./letsencrypt.js').CreateLetsEncrypt(obj);
1075
+ if (obj.config.letsencrypt.lib == 'acme-client') {
1076
+ obj.letsencrypt = require('./letsencrypt.js').CreateLetsEncrypt2(obj);
1077
+ } else {
1078
+ obj.letsencrypt = require('./letsencrypt.js').CreateLetsEncrypt(obj);
1079
+ }
1080
obj.letsencrypt.getCertificate(certs, obj.StartEx3); // Use Let's Encrypt with no checking, use at your own risk.
1081
} else {
1082
// Check Let's Encrypt settings
@@ -1084,7 +1088,13 @@ function CreateMeshCentralServer(config, args) {
1088
else if (obj.config.letsencrypt.email.trim() !== obj.config.letsencrypt.email) { leok = false; addServerWarning("Invalid Let's Encrypt email address."); }
1089
else {
1090
var le = require('./letsencrypt.js');
1087
- try { obj.letsencrypt = le.CreateLetsEncrypt(obj); } catch (ex) { }
1091
+ try {
1092
+ if (obj.config.letsencrypt.lib == 'acme-client') {
1093
+ obj.letsencrypt = le.CreateLetsEncrypt2(obj);
1094
+ } else {
1095
+ obj.letsencrypt = le.CreateLetsEncrypt(obj);
1096
+ }
1097
+ } catch (ex) { console.log(ex); }
1098
if (obj.letsencrypt == null) { addServerWarning("Unable to setup GreenLock module."); leok = false; }
1099
}
1100
if (leok == true) {
@@ -2379,7 +2389,7 @@ function mainStart() {
2389
if (require('os').platform() == 'win32') { modules.push('node-windows'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
2390
if (ldap == true) { modules.push('ldapauth-fork'); }
2391
if (recordingIndex == true) { modules.push('image-size'); } // Need to get the remote desktop JPEG sizes to index the recodring file.
2382
- if (config.letsencrypt != null) { if ((nodeVersion < 10) || (require('crypto').generateKeyPair == null)) { addServerWarning("Let's Encrypt support requires Node v10.12 or higher.", !args.launch); } else { modules.push('greenlock@4.0.4'); } } // Add Greenlock Module
2392
+ if (config.letsencrypt != null) { if ((nodeVersion < 10) || (require('crypto').generateKeyPair == null)) { addServerWarning("Let's Encrypt support requires Node v10.12 or higher.", !args.launch); } else { modules.push((config.letsencrypt.lib == 'acme-client') ? 'acme-client' : 'greenlock@4.0.4'); } } // Add Greenlock Module or acme-client module
2393
if (config.settings.mqtt != null) { modules.push('aedes'); } // Add MQTT Modules
2394
if (config.settings.mysql != null) { modules.push('mysql'); } // Add MySQL, official driver.
2395
if (config.settings.mongodb != null) { modules.push('mongodb'); } // Add MongoDB, official driver.
meshuser.js
+28
-16
@@ -704,20 +704,26 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
704
if (parent.parent.letsencrypt == null) {
705
r = "Let's Encrypt not in use.";
706
} else {
707
- var leinfo = {};
708
- var greenLockVersion = null;
709
- try { greenLockVersion = require('greenlock/package.json').version; } catch (ex) { }
710
- if (greenLockVersion) { leinfo.greenLockVer = greenLockVersion; }
711
- leinfo.redirWebServerHooked = parent.parent.letsencrypt.redirWebServerHooked;
712
- leinfo.leDomains = parent.parent.letsencrypt.leDomains;
713
- leinfo.leResults = parent.parent.letsencrypt.leResults;
714
- leinfo.leResultsStaging = parent.parent.letsencrypt.leResultsStaging;
715
- leinfo.performRestart = parent.parent.letsencrypt.performRestart;
716
- leinfo.performMoveToProduction = parent.parent.letsencrypt.performMoveToProduction;
717
- leinfo.runAsProduction = parent.parent.letsencrypt.runAsProduction;
718
- leinfo.leDefaults = parent.parent.letsencrypt.leDefaults;
719
- leinfo.leDefaultsStaging = parent.parent.letsencrypt.leDefaultsStaging;
720
- r = JSON.stringify(leinfo, null, 4);
707
+ if (parent.parent.letsencrypt.lib == 'greenlock') {
708
+ var leinfo = {};
709
+ var greenLockVersion = null;
710
+ try { greenLockVersion = require('greenlock/package.json').version; } catch (ex) { }
711
+ if (greenLockVersion) { leinfo.greenLockVer = greenLockVersion; }
712
+ leinfo.redirWebServerHooked = parent.parent.letsencrypt.redirWebServerHooked;
713
+ leinfo.leDomains = parent.parent.letsencrypt.leDomains;
714
+ leinfo.leResults = parent.parent.letsencrypt.leResults;
715
+ leinfo.leResultsStaging = parent.parent.letsencrypt.leResultsStaging;
716
+ leinfo.performRestart = parent.parent.letsencrypt.performRestart;
717
+ leinfo.performMoveToProduction = parent.parent.letsencrypt.performMoveToProduction;
718
+ leinfo.runAsProduction = parent.parent.letsencrypt.runAsProduction;
719
+ leinfo.leDefaults = parent.parent.letsencrypt.leDefaults;
720
+ leinfo.leDefaultsStaging = parent.parent.letsencrypt.leDefaultsStaging;
721
+ r = JSON.stringify(leinfo, null, 4);
722
+ } else if (parent.parent.letsencrypt.lib == 'acme-client') {
723
+ r = JSON.stringify(parent.parent.letsencrypt.getStats(), null, 4);
724
+ } else {
725
+ r = 'Unknown module';
726
+ }
727
}
728
break;
729
}
@@ -725,8 +731,14 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
731
if (parent.parent.letsencrypt == null) {
732
r = "Let's Encrypt not in use.";
733
} else {
728
- var err = parent.parent.letsencrypt.checkRenewCertificate();
729
- if (err == null) { r = "Called Let's Encrypt certificate check."; } else { r = err; }
734
+ if (parent.parent.letsencrypt.lib == 'greenlock') {
735
+ var err = parent.parent.letsencrypt.checkRenewCertificate();
736
+ if (err == null) { r = "Called Let's Encrypt certificate check."; } else { r = err; }
737
+ } else if (parent.parent.letsencrypt.lib == 'acme-client') {
738
+ r = ["CertOK", "Request:NoCert", "Request:Expire", "Request:MissingNames"][parent.parent.letsencrypt.checkRenewCertificate()];
739
+ } else {
740
+ r = 'Unknown module';
741
+ }
742
}
743
break;
744
}
package.json
+7
-1
@@ -28,8 +28,10 @@
28
"sample-config.json"
29
],
30
"dependencies": {
31
+ "acme-client": "^3.3.1",
32
"aedes": "^0.40.1",
33
"archiver": "^3.0.0",
34
+ "archiver-zip-encrypted": "^1.0.8",
35
"body-parser": "^1.19.0",
36
"cbor": "^4.1.5",
37
"compression": "^1.7.4",
@@ -42,11 +44,15 @@
44
"ipcheck": "^0.1.0",
45
"minimist": "^1.2.0",
46
"multiparty": "^4.2.1",
47
+ "nacme": "^2.3.8",
48
"nedb": "^1.8.0",
49
"node-forge": "^0.8.4",
50
+ "node-windows": "^1.0.0-beta.1",
51
+ "otplib": "^12.0.1",
52
"ws": "^6.2.1",
53
"xmldom": "^0.1.27",
49
- "yauzl": "^2.10.0"
54
+ "yauzl": "^2.10.0",
55
+ "yubikeyotp": "^0.2.0"
56
},
57
"devDependencies": {},
58
"repository": {