303 lines
18 KiB
JavaScript
303 lines
18 KiB
JavaScript
/**
|
|
* @description MeshCentral letsEncrypt module, uses GreenLock to do all the work.
|
|
* @author Ylian Saint-Hilaire
|
|
* @copyright Intel Corporation 2018-2019
|
|
* @license Apache-2.0
|
|
* @version v0.0.2
|
|
*/
|
|
|
|
/*xjslint node: true */
|
|
/*xjslint plusplus: true */
|
|
/*xjslint maxlen: 256 */
|
|
/*jshint node: true */
|
|
/*jshint strict: false */
|
|
/*jshint esversion: 6 */
|
|
'use strict';
|
|
|
|
module.exports.CreateLetsEncrypt = function (parent) {
|
|
try {
|
|
// Get the GreenLock version
|
|
var greenLockVersion = null;
|
|
try { greenLockVersion = require('greenlock/package.json').version; } catch (ex) { }
|
|
if (greenLockVersion == null) {
|
|
parent.debug('cert', "Initializing Let's Encrypt support");
|
|
} else {
|
|
parent.debug('cert', "Initializing Let's Encrypt support, using GreenLock v" + greenLockVersion);
|
|
}
|
|
|
|
// Check the current node version and support for generateKeyPair
|
|
if (require('crypto').generateKeyPair == null) { return null; }
|
|
if (Number(process.version.match(/^v(\d+\.\d+)/)[1]) < 10) { return null; }
|
|
|
|
// Try to delete the "./ursa-optional" or "./node_modules/ursa-optional" folder if present.
|
|
// This is an optional module that GreenLock uses that causes issues.
|
|
try {
|
|
const fs = require('fs');
|
|
if (fs.existsSync(parent.path.join(__dirname, 'ursa-optional'))) { fs.unlinkSync(obj.path.join(__dirname, 'ursa-optional')); }
|
|
if (fs.existsSync(parent.path.join(__dirname, 'node_modules', 'ursa-optional'))) { fs.unlinkSync(obj.path.join(__dirname, 'node_modules', 'ursa-optional')); }
|
|
} catch (ex) { }
|
|
|
|
// Get GreenLock setup and running.
|
|
const greenlock = require('greenlock');
|
|
var obj = {};
|
|
obj.parent = parent;
|
|
obj.path = require('path');
|
|
obj.redirWebServerHooked = false;
|
|
obj.leDomains = null;
|
|
obj.leResults = null;
|
|
obj.leResultsStaging = null;
|
|
obj.performRestart = false; // Indicates we need to restart the server
|
|
obj.performMoveToProduction = false; // Indicates we just got a staging certificate and need to move to production
|
|
obj.runAsProduction = false; // This starts at false and moves to true if staging cert is ok.
|
|
|
|
// Setup the certificate storage paths
|
|
obj.configPath = obj.path.join(obj.parent.datapath, 'letsencrypt3');
|
|
try { obj.parent.fs.mkdirSync(obj.configPath); } catch (e) { }
|
|
obj.configPathStaging = obj.path.join(obj.parent.datapath, 'letsencrypt3-staging');
|
|
try { obj.parent.fs.mkdirSync(obj.configPathStaging); } catch (e) { }
|
|
|
|
// Setup Let's Encrypt default configuration
|
|
obj.leDefaults = { agreeToTerms: true, store: { module: 'greenlock-store-fs', basePath: obj.configPath } };
|
|
obj.leDefaultsStaging = { agreeToTerms: true, store: { module: 'greenlock-store-fs', basePath: obj.configPathStaging } };
|
|
|
|
// Get package and maintainer email
|
|
const pkg = require('./package.json');
|
|
var maintainerEmail = null;
|
|
if (typeof pkg.author == 'string') {
|
|
// Older NodeJS
|
|
maintainerEmail = pkg.author;
|
|
var i = maintainerEmail.indexOf('<');
|
|
if (i >= 0) { maintainerEmail = maintainerEmail.substring(i + 1); }
|
|
var i = maintainerEmail.indexOf('>');
|
|
if (i >= 0) { maintainerEmail = maintainerEmail.substring(0, i); }
|
|
} else if (typeof pkg.author == 'object') {
|
|
// Latest NodeJS
|
|
maintainerEmail = pkg.author.email;
|
|
}
|
|
|
|
// Check if we need to be in debug mode
|
|
var ledebug = false;
|
|
try { ledebug = ((obj.parent.args.debug != null) || (obj.parent.args.debug.indexOf('cert'))); } catch (ex) { }
|
|
|
|
// Create the main GreenLock code module for production.
|
|
var greenlockargs = {
|
|
parent: obj,
|
|
packageRoot: __dirname,
|
|
packageAgent: pkg.name + '/' + pkg.version,
|
|
manager: obj.path.join(__dirname, 'letsencrypt.js'),
|
|
maintainerEmail: maintainerEmail,
|
|
notify: function (ev, args) { if (typeof args == 'string') { parent.debug('cert', ev + ': ' + args); } else { parent.debug('cert', ev + ': ' + JSON.stringify(args)); } },
|
|
staging: false,
|
|
debug: ledebug
|
|
};
|
|
if (obj.parent.args.debug == null) { greenlockargs.log = function (debug) { }; } // If not in debug mode, ignore all console output from greenlock (makes things clean).
|
|
obj.le = greenlock.create(greenlockargs);
|
|
|
|
// Create the main GreenLock code module for staging.
|
|
var greenlockargsstaging = {
|
|
parent: obj,
|
|
packageRoot: __dirname,
|
|
packageAgent: pkg.name + '/' + pkg.version,
|
|
manager: obj.path.join(__dirname, 'letsencrypt.js'),
|
|
maintainerEmail: maintainerEmail,
|
|
notify: function (ev, args) { if (typeof args == 'string') { parent.debug('cert', 'Notify: ' + ev + ': ' + args); } else { parent.debug('cert', 'Notify: ' + ev + ': ' + JSON.stringify(args)); } },
|
|
staging: true,
|
|
debug: ledebug
|
|
};
|
|
if (obj.parent.args.debug == null) { greenlockargsstaging.log = function (debug) { }; } // If not in debug mode, ignore all console output from greenlock (makes things clean).
|
|
obj.leStaging = greenlock.create(greenlockargsstaging);
|
|
|
|
// Hook up GreenLock to the redirection server
|
|
if (obj.parent.config.settings.rediraliasport === 80) { obj.redirWebServerHooked = true; }
|
|
else if ((obj.parent.config.settings.rediraliasport == null) && (obj.parent.redirserver.port == 80)) { obj.redirWebServerHooked = true; }
|
|
|
|
// Respond to a challenge
|
|
obj.challenge = function (token, hostname, func) {
|
|
if (obj.runAsProduction === true) {
|
|
// Production
|
|
parent.debug('cert', "Challenge " + hostname + "/" + token);
|
|
obj.le.challenges.get({ type: 'http-01', servername: hostname, token: token })
|
|
.then(function (results) { func(results.keyAuthorization); })
|
|
.catch(function (e) { console.log('LE-ERROR', e); func(null); }); // unexpected error, not related to renewal
|
|
} else {
|
|
// Staging
|
|
parent.debug('cert', "Challenge " + hostname + "/" + token);
|
|
obj.leStaging.challenges.get({ type: 'http-01', servername: hostname, token: token })
|
|
.then(function (results) { func(results.keyAuthorization); })
|
|
.catch(function (e) { console.log('LE-ERROR', e); func(null); }); // unexpected error, not related to renewal
|
|
}
|
|
}
|
|
|
|
obj.getCertificate = function(certs, func) {
|
|
parent.debug('cert', "Getting certs from local store");
|
|
if (certs.CommonName.indexOf('.') == -1) { console.log("ERROR: Use --cert to setup the default server name before using Let's Encrypt."); func(certs); return; }
|
|
if (obj.parent.config.letsencrypt == null) { func(certs); return; }
|
|
if (obj.parent.config.letsencrypt.email == null) { console.log("ERROR: Let's Encrypt email address not specified."); func(certs); return; }
|
|
if ((obj.parent.redirserver == null) || ((typeof obj.parent.config.settings.rediraliasport === 'number') && (obj.parent.config.settings.rediraliasport !== 80)) || ((obj.parent.config.settings.rediraliasport == null) && (obj.parent.redirserver.port !== 80))) { console.log("ERROR: Redirection web server must be active on port 80 for Let's Encrypt to work."); func(certs); return; }
|
|
if (obj.redirWebServerHooked !== true) { console.log("ERROR: Redirection web server not setup for Let's Encrypt to work."); func(certs); return; }
|
|
if ((obj.parent.config.letsencrypt.rsakeysize != null) && (obj.parent.config.letsencrypt.rsakeysize !== 2048) && (obj.parent.config.letsencrypt.rsakeysize !== 3072)) { console.log("ERROR: Invalid Let's Encrypt certificate key size, must be 2048 or 3072."); func(certs); return; }
|
|
|
|
// Get the list of domains
|
|
obj.leDomains = [ certs.CommonName ];
|
|
if (obj.parent.config.letsencrypt.names != null) {
|
|
if (typeof obj.parent.config.letsencrypt.names == 'string') { obj.parent.config.letsencrypt.names = obj.parent.config.letsencrypt.names.split(','); }
|
|
obj.parent.config.letsencrypt.names.map(function (s) { return s.trim(); }); // Trim each name
|
|
if ((typeof obj.parent.config.letsencrypt.names != 'object') || (obj.parent.config.letsencrypt.names.length == null)) { console.log("ERROR: Let's Encrypt names must be an array in config.json."); func(certs); return; }
|
|
obj.leDomains = obj.parent.config.letsencrypt.names;
|
|
}
|
|
|
|
if (obj.parent.config.letsencrypt.production !== true) {
|
|
// We are in staging mode, just go ahead
|
|
obj.getCertificateEx(certs, func);
|
|
} else {
|
|
// We are really in production mode
|
|
if (obj.runAsProduction === true) {
|
|
// Staging cert check must have been done already, move to production
|
|
obj.getCertificateEx(certs, func);
|
|
} else {
|
|
// Perform staging certificate check
|
|
parent.debug('cert', "Checking staging certificate " + obj.leDomains[0] + "...");
|
|
obj.leStaging.get({ servername: obj.leDomains[0] })
|
|
.then(function (results) {
|
|
if (results != null) {
|
|
// We have a staging certificate, move to production for real
|
|
parent.debug('cert', "Staging certificate is present, moving to production...");
|
|
obj.runAsProduction = true;
|
|
obj.getCertificateEx(certs, func);
|
|
} else {
|
|
// No staging certificate
|
|
parent.debug('cert', "No staging certificate present");
|
|
func(certs);
|
|
setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
|
|
}
|
|
})
|
|
.catch(function (e) {
|
|
// No staging certificate
|
|
parent.debug('cert', "No staging certificate present");
|
|
func(certs);
|
|
setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
obj.getCertificateEx = function (certs, func) {
|
|
// Get the Let's Encrypt certificate from our own storage
|
|
const xle = (obj.runAsProduction === true)? obj.le : obj.leStaging;
|
|
xle.get({ servername: obj.leDomains[0] })
|
|
.then(function (results) {
|
|
// If we already have real certificates, use them
|
|
if (results) {
|
|
if (results.site.altnames.indexOf(certs.CommonName) >= 0) {
|
|
certs.web.cert = results.pems.cert;
|
|
certs.web.key = results.pems.privkey;
|
|
certs.web.ca = [results.pems.chain];
|
|
}
|
|
for (var i in obj.parent.config.domains) {
|
|
if ((obj.parent.config.domains[i].dns != null) && (obj.parent.certificateOperations.compareCertificateNames(results.site.altnames, obj.parent.config.domains[i].dns))) {
|
|
certs.dns[i].cert = results.pems.cert;
|
|
certs.dns[i].key = results.pems.privkey;
|
|
certs.dns[i].ca = [results.pems.chain];
|
|
}
|
|
}
|
|
}
|
|
parent.debug('cert', "Got certs from local store (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
|
|
func(certs);
|
|
|
|
// Check if the Let's Encrypt certificate needs to be renewed.
|
|
setTimeout(obj.checkRenewCertificate, 60000); // Check in 1 minute.
|
|
setInterval(obj.checkRenewCertificate, 86400000); // Check again in 24 hours and every 24 hours.
|
|
return;
|
|
})
|
|
.catch(function (e) {
|
|
parent.debug('cert', "Unable to get certs from local store (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
|
|
setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
|
|
func(certs);
|
|
});
|
|
}
|
|
|
|
// Check if we need to renew the certificate, call this every day.
|
|
obj.checkRenewCertificate = function () {
|
|
parent.debug('cert', "Checking certificate for " + obj.leDomains[0] + " (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
|
|
|
|
// Setup renew options
|
|
obj.certCheckStart = Date.now();
|
|
const xle = (obj.runAsProduction === true) ? obj.le : obj.leStaging;
|
|
var renewOptions = { servername: obj.leDomains[0], altnames: obj.leDomains };
|
|
try {
|
|
xle.renew(renewOptions)
|
|
.then(function (results) {
|
|
if ((results == null) || (typeof results != 'object') || (results.length == 0) || (results[0].error != null)) {
|
|
parent.debug('cert', "Unable to get a certificate (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
|
|
} else {
|
|
parent.debug('cert', "Checks completed (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
|
|
if (obj.performRestart === true) { parent.debug('cert', "Certs changed, restarting..."); obj.parent.performServerCertUpdate(); } // Reset the server, TODO: Reset all peers
|
|
else if (obj.performMoveToProduction == true) {
|
|
parent.debug('cert', "Staging certificate received, moving to production...");
|
|
obj.runAsProduction = true;
|
|
obj.performMoveToProduction = false;
|
|
obj.performRestart = true;
|
|
setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
|
|
}
|
|
}
|
|
})
|
|
.catch(function (ex) {
|
|
parent.debug('cert', "checkCertificate exception: (" + JSON.stringify(ex) + ")");
|
|
console.log(ex);
|
|
});
|
|
} catch (ex) {
|
|
parent.debug('cert', "checkCertificate main exception: (" + JSON.stringify(ex) + ")");
|
|
console.log(ex);
|
|
}
|
|
}
|
|
|
|
return obj;
|
|
} catch (ex) { console.log(ex); } // Unable to start Let's Encrypt
|
|
return null;
|
|
};
|
|
|
|
// GreenLock v3 Manager
|
|
module.exports.create = function (options) {
|
|
var manager = { parent: options.parent };
|
|
manager.find = async function (options) {
|
|
//console.log('LE-FIND', options);
|
|
return Promise.resolve([{ subject: options.servername, altnames: options.altnames }]);
|
|
};
|
|
|
|
manager.set = function (options) {
|
|
manager.parent.parent.debug('cert', "Certificate has been set: " + JSON.stringify(options));
|
|
if (manager.parent.parent.config.letsencrypt.production == manager.parent.runAsProduction) { manager.parent.performRestart = true; }
|
|
else if ((manager.parent.parent.config.letsencrypt.production === true) && (manager.parent.runAsProduction === false)) { manager.parent.performMoveToProduction = true; }
|
|
return null;
|
|
};
|
|
|
|
manager.remove = function (options) {
|
|
manager.parent.parent.debug('cert', "Certificate has been removed: " + JSON.stringify(options));
|
|
if (manager.parent.parent.config.letsencrypt.production == manager.parent.runAsProduction) { manager.parent.performRestart = true; }
|
|
else if ((manager.parent.parent.config.letsencrypt.production === true) && (manager.parent.runAsProduction === false)) { manager.parent.performMoveToProduction = true; }
|
|
return null;
|
|
};
|
|
|
|
// set the global config
|
|
manager.defaults = async function (options) {
|
|
var r;
|
|
if (manager.parent.runAsProduction === true) {
|
|
// Production
|
|
//console.log('LE-DEFAULTS-Production', options);
|
|
if (options != null) { for (var i in options) { if (manager.parent.leDefaults[i] == null) { manager.parent.leDefaults[i] = options[i]; } } }
|
|
r = manager.parent.leDefaults;
|
|
r.subscriberEmail = manager.parent.parent.config.letsencrypt.email;
|
|
r.sites = { mainsite: { subject: manager.parent.leDomains[0], altnames: manager.parent.leDomains } };
|
|
} else {
|
|
// Staging
|
|
//console.log('LE-DEFAULTS-Staging', options);
|
|
if (options != null) { for (var i in options) { if (manager.parent.leDefaultsStaging[i] == null) { manager.parent.leDefaultsStaging[i] = options[i]; } } }
|
|
r = manager.parent.leDefaultsStaging;
|
|
r.subscriberEmail = manager.parent.parent.config.letsencrypt.email;
|
|
r.sites = { mainsite: { subject: manager.parent.leDomains[0], altnames: manager.parent.leDomains } };
|
|
}
|
|
return r;
|
|
};
|
|
|
|
return manager;
|
|
}; |