root
/
acme.js
mirror of https://github.com/therootcompany/acme.js
2
0
Fork 1
Code Issues 8 Releases Wiki Activity

backports: POST-as-GET, error handling, etc

This commit is contained in:
AJ ONeal 2019-10-22 19:50:08 -06:00
parent d25fa6756c
commit b1046222dc
6 changed files with 317 additions and 296 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@ -152,11 +152,11 @@ ACME Accounts are key and device based, with an email address as a backup identi
A public account key must be registered before an SSL certificate can be requested. A public account key must be registered before an SSL certificate can be requested.
```js ```js
var accountPrivateKey; var accountPrivateJwk;
var account; var account;
Keypairs.generate({ kty: 'EC' }).then(function(pair) { Keypairs.generate({ kty: 'EC' }).then(function(pair) {
accountPrivateKey = pair.private; accountPrivateJwk = pair.private;
return acme.accounts return acme.accounts
.create({ .create({
@ -169,7 +169,7 @@ Keypairs.generate({ kty: 'EC' }).then(function(pair) {
return Promise.resolve(tos); return Promise.resolve(tos);
} }
}, },
accountKeypair: { privateKeyJwk: pair.private }, accountKey: pair.private,
subscriberEmail: $('.js-email-input').value subscriberEmail: $('.js-email-input').value
}) })
.then(function(_account) { .then(function(_account) {
@ -224,7 +224,7 @@ var certinfo = await acme.certificates.create({
return tos; return tos;
}, },
account: account, account: account,
accountKeypair: { privateKeyJwk: accountPrivateKey }, accountKey: accountPrivateJwk,
csr: csr, csr: csr,
domains: sortedDomains, domains: sortedDomains,
challenges: challenges, // must be implemented challenges: challenges, // must be implemented

300
acme.js
View File

@ -13,7 +13,7 @@ var CSR = require('@root/csr');
var sha2 = require('@root/keypairs/lib/node/sha2.js'); var sha2 = require('@root/keypairs/lib/node/sha2.js');
var http = require('./lib/node/http.js'); var http = require('./lib/node/http.js');
var native = require('./native.js'); var native = require('./lib/native.js');
ACME.formatPemChain = function formatPemChain(str) { ACME.formatPemChain = function formatPemChain(str) {
return ( return (
@ -60,7 +60,7 @@ ACME.challengeTests = {
"Got: '" + "Got: '" +
keyAuth + keyAuth +
"'\n" + "'\n" +
'See https://git.coolaj86.com/coolaj86/acme-v2.js/issues/4' 'See https://git.rootprojects.org/root/acme.js/issues/4'
); );
err.code = 'E_FAIL_DRY_CHALLENGE'; err.code = 'E_FAIL_DRY_CHALLENGE';
throw err; throw err;
@ -87,7 +87,7 @@ ACME.challengeTests = {
"' does not return '" + "' does not return '" +
ch.dnsAuthorization + ch.dnsAuthorization +
"'\n" + "'\n" +
'See https://git.coolaj86.com/coolaj86/acme-v2.js/issues/4' 'See https://git.rootprojects.org/root/acme.js/issues/4'
); );
err.code = 'E_FAIL_DRY_CHALLENGE'; err.code = 'E_FAIL_DRY_CHALLENGE';
throw err; throw err;
@ -96,12 +96,12 @@ ACME.challengeTests = {
}; };
ACME._directory = function(me) { ACME._directory = function(me) {
// GET-as-GET ok
// TODO cache the directory URL // TODO cache the directory URL
// GET-as-GET ok
return me.request({ method: 'GET', url: me.directoryUrl, json: true }); return me.request({ method: 'GET', url: me.directoryUrl, json: true });
}; };
ACME._getNonce = function(me) { ACME._getNonce = function(me) {
// GET-as-GET, HEAD-as-HEAD ok
var nonce; var nonce;
while (true) { while (true) {
nonce = me._nonces.shift(); nonce = me._nonces.shift();
@ -117,9 +117,12 @@ ACME._getNonce = function(me) {
if (nonce) { if (nonce) {
return Promise.resolve(nonce.nonce); return Promise.resolve(nonce.nonce);
} }
return me
.request({ method: 'HEAD', url: me._directoryUrls.newNonce }) // HEAD-as-HEAD ok
.then(function(resp) { return ACME._request(me, {
method: 'HEAD',
url: me._directoryUrls.newNonce
}).then(function(resp) {
return resp.headers['replay-nonce']; return resp.headers['replay-nonce'];
}); });
}; };
@ -147,31 +150,26 @@ ACME._setNonce = function(me, nonce) {
} }
*/ */
ACME._registerAccount = function(me, options) { ACME._registerAccount = function(me, options) {
if (me.debug) { //#console.debug('[ACME.js] accounts.create');
console.debug('[acme-v2] accounts.create');
}
return new Promise(function(resolve, reject) {
function agree(tosUrl) { function agree(tosUrl) {
var err; var err;
if (me._tos !== tosUrl) { if (me._tos !== tosUrl) {
err = new Error( err = new Error("You must agree to the ToS at '" + me._tos + "'");
"You must agree to the ToS at '" + me._tos + "'"
);
err.code = 'E_AGREE_TOS'; err.code = 'E_AGREE_TOS';
reject(err); throw err;
return;
} }
return ACME._importKeypair(me, options.accountKeypair).then( return ACME._importKeypair(
function(pair) { me,
options.accountKey || options.accountKeypair
).then(function(pair) {
var contact; var contact;
if (options.contact) { if (options.contact) {
contact = options.contact.slice(0); contact = options.contact.slice(0);
} else if (options.subscriberEmail || options.email) { } else if (options.subscriberEmail || options.email) {
contact = [ contact = [
'mailto:' + 'mailto:' + (options.subscriberEmail || options.email)
(options.subscriberEmail || options.email)
]; ];
} }
var accountRequest = { var accountRequest = {
@ -204,14 +202,10 @@ ACME._registerAccount = function(me, options) {
url: me._directoryUrls.newAccount, url: me._directoryUrls.newAccount,
protected: { kid: false, jwk: pair.public }, protected: { kid: false, jwk: pair.public },
payload: Enc.strToBuf(payload) payload: Enc.strToBuf(payload)
}) }).then(function(resp) {
.then(function(resp) {
var account = resp.body; var account = resp.body;
if ( if (resp.statusCode < 200 || resp.statusCode >= 300) {
resp.statusCode < 200 ||
resp.statusCode >= 300
) {
if ('string' !== typeof account) { if ('string' !== typeof account) {
account = JSON.stringify(account); account = JSON.stringify(account);
} }
@ -221,24 +215,16 @@ ACME._registerAccount = function(me, options) {
' ' + ' ' +
account + account +
'\n' + '\n' +
JSON.stringify(accountRequest) payload
); );
} }
var location = resp.headers.location; var location = resp.headers.location;
// the account id url // the account id url
options._kid = location; options._kid = location;
if (me.debug) { //#console.debug('[DEBUG] new account location:');
console.debug( //#console.debug(location);
'[DEBUG] new account location:' //#console.debug(resp);
);
}
if (me.debug) {
console.debug(location);
}
if (me.debug) {
console.debug(resp);
}
/* /*
{ {
@ -250,46 +236,29 @@ ACME._registerAccount = function(me, options) {
if (!account) { if (!account) {
account = { _emptyResponse: true }; account = { _emptyResponse: true };
} }
// https://git.coolaj86.com/coolaj86/acme-v2.js/issues/8 // https://git.rootprojects.org/root/acme.js/issues/8
if (!account.key) { if (!account.key) {
account.key = {}; account.key = {};
} }
account.key.kid = options._kid; account.key.kid = options._kid;
return account; return account;
})
.then(resolve, reject);
}); });
} });
); });
} }
if (me.debug) { return Promise.resolve()
console.debug('[acme-v2] agreeToTerms'); .then(function() {
//#console.debug('[ACME.js] agreeToTerms');
var agreeToTerms = options.agreeToTerms;
if (true === agreeToTerms) {
agreeToTerms = function(tos) {
return tos;
};
} }
if (1 === options.agreeToTerms.length) { return agreeToTerms(me._tos);
// newer promise API })
return Promise.resolve(options.agreeToTerms(me._tos)).then( .then(agree);
agree,
reject
);
} else if (2 === options.agreeToTerms.length) {
// backwards compat cb API
return options.agreeToTerms(me._tos, function(err, tosUrl) {
if (!err) {
agree(tosUrl);
return;
}
reject(err);
});
} else {
reject(
new Error(
'agreeToTerms has incorrect function signature.' +
' Should be fn(tos) { return Promise<tos>; }'
)
);
}
});
}; };
/* /*
POST /acme/new-order HTTP/1.1 POST /acme/new-order HTTP/1.1
@ -312,14 +281,11 @@ ACME._registerAccount = function(me, options) {
} }
*/ */
ACME._getChallenges = function(me, options, authUrl) { ACME._getChallenges = function(me, options, authUrl) {
if (me.debug) { //#console.debug('\n[DEBUG] getChallenges\n');
console.debug('\n[DEBUG] getChallenges\n');
}
// TODO POST-as-GET
return ACME._jwsRequest(me, { return ACME._jwsRequest(me, {
options: options, options: options,
protected: {}, protected: { kid: options._kid },
payload: '', payload: '',
url: authUrl url: authUrl
}).then(function(resp) { }).then(function(resp) {
@ -361,13 +327,14 @@ ACME._testChallenges = function(me, options) {
// memoized so that it doesn't run until it's first called // memoized so that it doesn't run until it's first called
var getThumbnail = function() { var getThumbnail = function() {
var thumbPromise = ACME._importKeypair(me, options.accountKeypair).then( var thumbPromise = ACME._importKeypair(
function(pair) { me,
options.accountKey || options.accountKeypair
).then(function(pair) {
return me.Keypairs.thumbprint({ return me.Keypairs.thumbprint({
jwk: pair.public jwk: pair.public
}); });
} });
);
getThumbnail = function() { getThumbnail = function() {
return thumbPromise; return thumbPromise;
}; };
@ -624,9 +591,7 @@ ACME._postChallenge = function(me, options, auth) {
} }
*/ */
function deactivate() { function deactivate() {
if (me.debug) { //#console.debug('[ACME.js] deactivate:');
console.debug('[acme-v2.js] deactivate:');
}
return ACME._jwsRequest(me, { return ACME._jwsRequest(me, {
options: options, options: options,
url: ch.url, url: ch.url,
@ -647,7 +612,7 @@ ACME._postChallenge = function(me, options, auth) {
if (count >= MAX_POLL) { if (count >= MAX_POLL) {
return Promise.reject( return Promise.reject(
new Error( new Error(
"[acme-v2] stuck in bad pending/processing state for '" + "[ACME.js] stuck in bad pending/processing state for '" +
altname + altname +
"'" "'"
) )
@ -656,13 +621,14 @@ ACME._postChallenge = function(me, options, auth) {
count += 1; count += 1;
if (me.debug) { //#console.debug('\n[DEBUG] statusChallenge\n');
console.debug('\n[DEBUG] statusChallenge\n'); // POST-as-GET
} return ACME._jwsRequest(me, {
// TODO POST-as-GET options: options,
return me url: ch.url,
.request({ method: 'GET', url: ch.url, json: true }) protected: { kid: options._kid },
.then(function(resp) { payload: Enc.binToBuf('')
}).then(function(resp) {
if ('processing' === resp.body.status) { if ('processing' === resp.body.status) {
if (me.debug) { if (me.debug) {
console.debug('poll: again', ch.url); console.debug('poll: again', ch.url);
@ -699,12 +665,13 @@ ACME._postChallenge = function(me, options, auth) {
var errmsg; var errmsg;
if (!resp.body.status) { if (!resp.body.status) {
errmsg = errmsg =
"[acme-v2] (E_STATE_EMPTY) empty challenge state for '" + "[ACME.js] (E_STATE_EMPTY) empty challenge state for '" +
altname + altname +
"':"; "':" +
JSON.stringify(resp.body);
} else if ('invalid' === resp.body.status) { } else if ('invalid' === resp.body.status) {
errmsg = errmsg =
"[acme-v2] (E_STATE_INVALID) challenge state for '" + "[ACME.js] (E_STATE_INVALID) challenge state for '" +
altname + altname +
"': '" + "': '" +
//resp.body.status + //resp.body.status +
@ -712,7 +679,7 @@ ACME._postChallenge = function(me, options, auth) {
"'"; "'";
} else { } else {
errmsg = errmsg =
"[acme-v2] (E_STATE_UKN) challenge state for '" + "[ACME.js] (E_STATE_UKN) challenge state for '" +
altname + altname +
"': '" + "': '" +
resp.body.status + resp.body.status +
@ -724,9 +691,7 @@ ACME._postChallenge = function(me, options, auth) {
} }
function respondToChallenge() { function respondToChallenge() {
if (me.debug) { //#console.debug('[ACME.js] responding to accept challenge:');
console.debug('[acme-v2.js] responding to accept challenge:');
}
return ACME._jwsRequest(me, { return ACME._jwsRequest(me, {
options: options, options: options,
url: ch.url, url: ch.url,
@ -787,9 +752,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) {
var payload = JSON.stringify(body); var payload = JSON.stringify(body);
function pollCert() { function pollCert() {
if (me.debug) { //#console.debug('[ACME.js] pollCert:');
console.debug('[acme-v2.js] pollCert:');
}
return ACME._jwsRequest(me, { return ACME._jwsRequest(me, {
options: options, options: options,
url: options._finalize, url: options._finalize,
@ -870,7 +833,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) {
"'\n" + "'\n" +
JSON.stringify(resp.body, null, 2) + JSON.stringify(resp.body, null, 2) +
'\n\n' + '\n\n' +
'Please open an issue at https://git.coolaj86.com/coolaj86/acme-v2.js' 'Please open an issue at https://git.rootprojects.org/root/acme.js'
) )
); );
} }
@ -889,7 +852,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) {
"'\n" + "'\n" +
JSON.stringify(resp.body, null, 2) + JSON.stringify(resp.body, null, 2) +
'\n\n' + '\n\n' +
'Please open an issue at https://git.coolaj86.com/coolaj86/acme-v2.js' 'Please open an issue at https://git.rootprojects.org/root/acme.js'
) )
); );
}); });
@ -904,9 +867,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) {
// finalizeOrder // finalizeOrder
// getCertificate // getCertificate
ACME._getCertificate = function(me, options) { ACME._getCertificate = function(me, options) {
if (me.debug) { //#console.debug('[ACME.js] DEBUG get cert 1');
console.debug('[acme-v2] DEBUG get cert 1');
}
// Prefer this order for efficiency: // Prefer this order for efficiency:
// * http-01 is the fasest // * http-01 is the fasest
@ -1027,9 +988,8 @@ ACME._getCertificate = function(me, options) {
return ACME._testChallenges(me, options); return ACME._testChallenges(me, options);
}) })
.then(function() { .then(function() {
if (me.debug) { //#console.debug('[ACME.js] certificates.create');
console.debug('[acme-v2] certificates.create');
}
var certOrder = { var certOrder = {
// raw wildcard syntax MUST be used here // raw wildcard syntax MUST be used here
identifiers: options.domains identifiers: options.domains
@ -1084,7 +1044,7 @@ ACME._getCertificate = function(me, options) {
if (!options._authorizations) { if (!options._authorizations) {
return Promise.reject( return Promise.reject(
new Error( new Error(
"[acme-v2.js] authorizations were not fetched for '" + "[ACME.js] authorizations were not fetched for '" +
options.domains.join() + options.domains.join() +
"':\n" + "':\n" +
JSON.stringify(resp.body) JSON.stringify(resp.body)
@ -1092,21 +1052,22 @@ ACME._getCertificate = function(me, options) {
); );
} }
if (me.debug) { if (me.debug) {
console.debug('[acme-v2] POST newOrder has authorizations'); console.debug('[ACME.js] POST newOrder has authorizations');
} }
setAuths = options._authorizations.slice(0); setAuths = options._authorizations.slice(0);
var accountKeyThumb; var accountKeyThumb;
function setThumbnail() { function setThumbnail() {
return ACME._importKeypair(me, options.accountKeypair).then( return ACME._importKeypair(
function(pair) { me,
options.accountKey || options.accountKeypair
).then(function(pair) {
return me.Keypairs.thumbprint({ return me.Keypairs.thumbprint({
jwk: pair.public jwk: pair.public
}).then(function(_thumb) { }).then(function(_thumb) {
accountKeyThumb = _thumb; accountKeyThumb = _thumb;
}); });
} });
);
} }
function setNext() { function setNext() {
@ -1219,22 +1180,18 @@ ACME._getCertificate = function(me, options) {
} }
function retrieveCerts(order) { function retrieveCerts(order) {
if (me.debug) { //#console.debug('ACME.js: order was finalized');
console.debug('acme-v2: order was finalized');
} // POST-as-GET
// TODO POST-as-GET return ACME._jwsRequest(me, {
return me options: options,
.request({
method: 'GET',
url: options._certificate, url: options._certificate,
protected: { kid: options._kid },
payload: Enc.binToBuf(''),
json: true json: true
}) }).then(function(resp) {
.then(function(resp) { //#console.debug('ACME.js: csr submitted and cert received:');
if (me.debug) {
console.debug(
'acme-v2: csr submitted and cert received:'
);
}
// https://github.com/certbot/certbot/issues/5721 // https://github.com/certbot/certbot/issues/5721
var certsarr = ACME.splitPemChain( var certsarr = ACME.splitPemChain(
ACME.formatPemChain(resp.body || '') ACME.formatPemChain(resp.body || '')
@ -1248,9 +1205,7 @@ ACME._getCertificate = function(me, options) {
//, privkey: privkeyPem //, privkey: privkeyPem
chain: certsarr.join('\n') chain: certsarr.join('\n')
}; };
if (me.debug) { //#console.debug(certs);
console.debug(certs);
}
return certs; return certs;
}); });
} }
@ -1360,6 +1315,24 @@ ACME.create = function create(me) {
} }
} }
}; };
me.orders = {
// create + get challlenges
request: function(options) {
try {
return ACME._createOrder(me, options);
} catch (e) {
return Promise.reject(e);
}
},
// set challenges, check challenges, finalize order, return order
complete: function(options) {
try {
return ACME._finalizeOrder(me, options);
} catch (e) {
return Promise.reject(e);
}
}
};
me.certificates = { me.certificates = {
create: function(options) { create: function(options) {
try { try {
@ -1384,19 +1357,30 @@ ACME._jwsRequest = function(me, bigopts) {
bigopts.protected.kid = bigopts.options._kid; bigopts.protected.kid = bigopts.options._kid;
} }
} }
// this will shasum the thumbnail the 2nd time // this will shasum the thumbnail the 2nd time
return me.Keypairs.signJws({ return me.Keypairs.signJws({
jwk: bigopts.options.accountKeypair.privateKeyJwk, jwk:
bigopts.options.accountKey ||
bigopts.options.accountKeypair.privateKeyJwk,
protected: bigopts.protected, protected: bigopts.protected,
payload: bigopts.payload payload: bigopts.payload
}).then(function(jws) { })
if (me.debug) { .then(function(jws) {
console.debug('[acme-v2] ' + bigopts.url + ':'); //#console.debug('[ACME.js] url: ' + bigopts.url + ':');
} //#console.debug(jws);
if (me.debug) {
console.debug(jws);
}
return ACME._request(me, { url: bigopts.url, json: jws }); return ACME._request(me, { url: bigopts.url, json: jws });
})
.catch(function(e) {
if (/badNonce$/.test(e.urn)) {
// retry badNonces
var retryable = bigopts._retries >= 2;
if (!retryable) {
bigopts._retries = (bigopts._retries || 0) + 1;
return ACME._jwsRequest(me, bigopts);
}
}
throw e;
}); });
}); });
}; };
@ -1414,13 +1398,41 @@ ACME._request = function(me, opts) {
} }
} }
return me.request(opts).then(function(resp) { return me.request(opts).then(function(resp) {
if (resp.toJSON) {
resp = resp.toJSON(); resp = resp.toJSON();
}
if (resp.headers['replay-nonce']) { if (resp.headers['replay-nonce']) {
ACME._setNonce(me, resp.headers['replay-nonce']); ACME._setNonce(me, resp.headers['replay-nonce']);
} }
var e;
var err;
if (resp.body) {
err = resp.body.error;
e = new Error('');
if (400 === resp.body.status) {
err = { type: resp.body.type, detail: resp.body.detail };
}
if (err) {
e.status = resp.body.status;
e.code = 'E_ACME';
if (e.status) {
e.message = '[' + e.status + '] ';
}
e.detail = err.detail;
e.message += err.detail || JSON.stringify(err);
e.urn = err.type;
e.uri = resp.body.url;
e._rawError = err;
e._rawBody = resp.body;
throw e;
}
}
return resp; return resp;
}); });
}; };
// A very generic, swappable request lib // A very generic, swappable request lib
ACME._defaultRequest = function(opts) { ACME._defaultRequest = function(opts) {
// Note: normally we'd have to supply a User-Agent string, but not here in a browser // Note: normally we'd have to supply a User-Agent string, but not here in a browser
@ -1446,14 +1458,20 @@ ACME._defaultRequest = function(opts) {
ACME._importKeypair = function(me, kp) { ACME._importKeypair = function(me, kp) {
var jwk = kp.privateKeyJwk; var jwk = kp.privateKeyJwk;
if (kp.kty) {
jwk = kp;
kp = {};
}
var pub;
var p; var p;
if (jwk) { if (jwk) {
// nix the browser jwk extras // nix the browser jwk extras
jwk.key_ops = undefined; jwk.key_ops = undefined;
jwk.ext = undefined; jwk.ext = undefined;
pub = me.Keypairs.neuter({ jwk: jwk });
p = Promise.resolve({ p = Promise.resolve({
private: jwk, private: jwk,
public: me.Keypairs.neuter({ jwk: jwk }) public: pub
}); });
} else { } else {
p = me.Keypairs.import({ pem: kp.privateKeyPem }); p = me.Keypairs.import({ pem: kp.privateKeyPem });
@ -1617,3 +1635,5 @@ function pluckZone(zonenames, dnsHost) {
return b.length - a.length; return b.length - a.length;
})[0]; })[0];
} }
// TODO accountKey vs accountKeypair

0
browser.js → lib/browser.js
View File

0
native.js → lib/native.js
View File

2
package.json
View File

@ -5,7 +5,7 @@
"homepage": "https://rootprojects.org/acme/", "homepage": "https://rootprojects.org/acme/",
"main": "acme.js", "main": "acme.js",
"browser": { "browser": {
"./native.js": "./browser.js", "./lib/native.js": "./lib/browser.js",
"./lib/node/sha2.js": "./lib/browser/sha2.js", "./lib/node/sha2.js": "./lib/browser/sha2.js",
"./lib/node/http.js": "./lib/browser/http.js" "./lib/node/http.js": "./lib/browser/http.js"
}, },

7
tests/index.js
View File

@ -88,9 +88,10 @@ async function happyPath(accKty, srvKty, rnd) {
} }
var accountKeypair = await Keypairs.generate({ kty: accKty }); var accountKeypair = await Keypairs.generate({ kty: accKty });
var accountKey = accountKeypair.private;
if (config.debug) { if (config.debug) {
console.info('Account Key Created'); console.info('Account Key Created');
console.info(JSON.stringify(accountKeypair, null, 2)); console.info(JSON.stringify(accountKey, null, 2));
console.info(); console.info();
console.info(); console.info();
} }
@ -98,7 +99,7 @@ async function happyPath(accKty, srvKty, rnd) {
var account = await acme.accounts.create({ var account = await acme.accounts.create({
agreeToTerms: agree, agreeToTerms: agree,
// TODO detect jwk/pem/der? // TODO detect jwk/pem/der?
accountKeypair: { privateKeyJwk: accountKeypair.private }, accountKey: accountKey,
subscriberEmail: config.email subscriberEmail: config.email
}); });
@ -176,7 +177,7 @@ async function happyPath(accKty, srvKty, rnd) {
var results = await acme.certificates.create({ var results = await acme.certificates.create({
account: account, account: account,
accountKeypair: { privateKeyJwk: accountKeypair.private }, accountKey: accountKey,
csr: csr, csr: csr,
domains: domains, domains: domains,
challenges: challenges, // must be implemented challenges: challenges, // must be implemented