mirror of
https://github.com/Ylianst/MeshCentral.git
synced 2025-03-09 15:40:18 +00:00
Improved alternate Let's Encrypt support.
This commit is contained in:
Ylian Saint-Hilaire
parent
fea2120849
commit
7df7576acb
5 changed files with 96 additions and 54 deletions
|
|
@ -341,6 +341,17 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
obj.challenges = {};
|
||||
obj.runAsProduction = false;
|
||||
obj.redirWebServerHooked = false;
|
||||
obj.configErr = null;
|
||||
obj.configOk = false;
|
||||
|
||||
// Let's Encrypt debug logging
|
||||
obj.log = function (str) {
|
||||
parent.debug('cert', 'LE: ' + str);
|
||||
var d = new Date();
|
||||
obj.events.push(d.toLocaleDateString() + ' ' + d.toLocaleTimeString() + ' - ' + str);
|
||||
while (obj.events.length > 200) { obj.events.shift(); } // Keep only 200 last events.
|
||||
}
|
||||
obj.events = [];
|
||||
|
||||
// Setup the certificate storage paths
|
||||
obj.certPath = obj.path.join(obj.parent.datapath, 'letsencrypt-certs');
|
||||
|
|
@ -353,18 +364,20 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
// Deal with HTTP challenges
|
||||
function challengeCreateFn(authz, challenge, keyAuthorization) { if (challenge.type === 'http-01') { obj.challenges[challenge.token] = keyAuthorization; } }
|
||||
function challengeRemoveFn(authz, challenge, keyAuthorization) { if (challenge.type === 'http-01') { delete obj.challenges[challenge.token]; } }
|
||||
obj.challenge = function (token, hostname, func) { func(obj.challenges[token]); }
|
||||
obj.challenge = function (token, hostname, func) { obj.log((obj.challenges[token] != null)?"Succesful response to challenge.":"Failed to respond to challenge."); func(obj.challenges[token]); }
|
||||
|
||||
// Get the current certificate
|
||||
obj.getCertificate = function(certs, func) {
|
||||
obj.runAsProduction = (obj.parent.config.letsencrypt.production === true);
|
||||
parent.debug('cert', "LE: Getting certs from local store (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
|
||||
if (certs.CommonName.indexOf('.') == -1) { console.log("ERROR: Use --cert to setup the default server name before using Let's Encrypt."); func(certs); return; }
|
||||
if (obj.parent.config.letsencrypt == null) { func(certs); return; }
|
||||
if (obj.parent.config.letsencrypt.email == null) { console.log("ERROR: Let's Encrypt email address not specified."); func(certs); return; }
|
||||
if ((obj.parent.redirserver == null) || ((typeof obj.parent.config.settings.rediraliasport === 'number') && (obj.parent.config.settings.rediraliasport !== 80)) || ((obj.parent.config.settings.rediraliasport == null) && (obj.parent.redirserver.port !== 80))) { console.log("ERROR: Redirection web server must be active on port 80 for Let's Encrypt to work."); func(certs); return; }
|
||||
if (obj.redirWebServerHooked !== true) { console.log("ERROR: Redirection web server not setup for Let's Encrypt to work."); func(certs); return; }
|
||||
if ((obj.parent.config.letsencrypt.rsakeysize != null) && (obj.parent.config.letsencrypt.rsakeysize !== 2048) && (obj.parent.config.letsencrypt.rsakeysize !== 3072)) { console.log("ERROR: Invalid Let's Encrypt certificate key size, must be 2048 or 3072."); func(certs); return; }
|
||||
obj.log("Getting certs from local store (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
|
||||
if (certs.CommonName.indexOf('.') == -1) { obj.configErr = "ERROR: Use --cert to setup the default server name before using Let's Encrypt."; obj.log(obj.configErr); console.log(obj.configErr); func(certs); return; }
|
||||
if (obj.parent.config.letsencrypt == null) { obj.configErr = "No Let's Encrypt configuration"; obj.log(obj.configErr); console.log(obj.configErr); func(certs); return; }
|
||||
if (obj.parent.config.letsencrypt.email == null) { obj.configErr = "ERROR: Let's Encrypt email address not specified."; obj.log(obj.configErr); console.log(obj.configErr); func(certs); return; }
|
||||
if ((obj.parent.redirserver == null) || ((typeof obj.parent.config.settings.rediraliasport === 'number') && (obj.parent.config.settings.rediraliasport !== 80)) || ((obj.parent.config.settings.rediraliasport == null) && (obj.parent.redirserver.port !== 80))) { obj.configErr = "ERROR: Redirection web server must be active on port 80 for Let's Encrypt to work."; obj.log(obj.configErr); console.log(obj.configErr); func(certs); return; }
|
||||
if (obj.redirWebServerHooked !== true) { obj.configErr = "ERROR: Redirection web server not setup for Let's Encrypt to work."; obj.log(obj.configErr); console.log(obj.configErr); func(certs); return; }
|
||||
if ((obj.parent.config.letsencrypt.rsakeysize != null) && (obj.parent.config.letsencrypt.rsakeysize !== 2048) && (obj.parent.config.letsencrypt.rsakeysize !== 3072)) { obj.configErr = "ERROR: Invalid Let's Encrypt certificate key size, must be 2048 or 3072."; obj.log(obj.configErr); console.log(obj.configErr); func(certs); return; }
|
||||
if (obj.checkInterval == null) { obj.checkInterval = setInterval(obj.checkRenewCertificate, 86400000); } // Call certificate check every 24 hours.
|
||||
obj.configOk = true;
|
||||
|
||||
// Get the list of domains
|
||||
obj.leDomains = [ certs.CommonName ];
|
||||
|
|
@ -379,7 +392,7 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
var certFile = obj.path.join(obj.certPath, (obj.runAsProduction ? 'production.crt' : 'staging.crt'));
|
||||
var keyFile = obj.path.join(obj.certPath, (obj.runAsProduction ? 'production.key' : 'staging.key'));
|
||||
if (obj.fs.existsSync(certFile) && obj.fs.existsSync(keyFile)) {
|
||||
parent.debug('cert', "LE: Reading certificate files");
|
||||
obj.log("Reading certificate files");
|
||||
|
||||
// Read the certificate and private key
|
||||
var certPem = obj.fs.readFileSync(certFile).toString('utf8');
|
||||
|
|
@ -397,54 +410,55 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
|
||||
// Use this certificate when possible on any domain
|
||||
if (obj.certNames.indexOf(certs.CommonName) >= 0) {
|
||||
obj.log("Setting LE cert for default domain.");
|
||||
certs.web.cert = certPem;
|
||||
certs.web.key = keyPem;
|
||||
//certs.web.ca = [results.pems.chain];
|
||||
}
|
||||
for (var i in obj.parent.config.domains) {
|
||||
if ((obj.parent.config.domains[i].dns != null) && (obj.parent.certificateOperations.compareCertificateNames(obj.certNames, obj.parent.config.domains[i].dns))) {
|
||||
obj.log("Setting LE cert for domain " + i + ".");
|
||||
certs.dns[i].cert = certPem;
|
||||
certs.dns[i].key = keyPem;
|
||||
//certs.dns[i].ca = [results.pems.chain];
|
||||
}
|
||||
}
|
||||
} else {
|
||||
parent.debug('cert', "LE: No certificate files found");
|
||||
obj.log("No certificate files found");
|
||||
}
|
||||
func(certs);
|
||||
obj.checkRenewCertificate();
|
||||
setTimeout(obj.checkRenewCertificate, 5000); // Hold 5 seconds and check if we need to request a certificate.
|
||||
}
|
||||
|
||||
// Check if we need to get a new certificate
|
||||
// Return 0 = CertOK, 1 = Request:NoCert, 2 = Request:Expire, 3 = Request:MissingNames
|
||||
obj.checkRenewCertificate = function () {
|
||||
parent.debug('cert', "LE: Checking certificate");
|
||||
if (obj.certNames == null) {
|
||||
parent.debug('cert', "LE: Got no certificates, asking for one now.");
|
||||
obj.log("Got no certificates, asking for one now.");
|
||||
obj.requestCertificate();
|
||||
return 1;
|
||||
} else {
|
||||
// Look at the existing certificate to see if we need to renew it
|
||||
var daysLeft = Math.floor((obj.certExpire - new Date()) / 86400000);
|
||||
parent.debug('cert', "LE: Certificate has " + daysLeft + " day(s) left.");
|
||||
obj.log("Certificate has " + daysLeft + " day(s) left.");
|
||||
if (daysLeft < 45) {
|
||||
parent.debug('cert', "LE: Asking for new certificate because of expire time.");
|
||||
obj.log("Asking for new certificate because of expire time.");
|
||||
obj.requestCertificate();
|
||||
return 2;
|
||||
} else {
|
||||
var missingDomain = false;
|
||||
for (var i in obj.leDomains) {
|
||||
if (obj.parent.certificateOperations.compareCertificateNames(obj.certNames, obj.leDomains[i]) == false) {
|
||||
parent.debug('cert', "LE: Missing name " + obj.leDomains[i] + ".");
|
||||
obj.log("Missing name \"" + obj.leDomains[i] + "\".");
|
||||
missingDomain = true;
|
||||
}
|
||||
}
|
||||
if (missingDomain) {
|
||||
parent.debug('cert', "LE: Asking for new certificate because of missing names.");
|
||||
obj.log("Asking for new certificate because of missing names.");
|
||||
obj.requestCertificate();
|
||||
return 3;
|
||||
} else {
|
||||
parent.debug('cert', "LE: Certificate is ok.");
|
||||
obj.log("Certificate is ok.");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -452,25 +466,27 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
}
|
||||
|
||||
obj.requestCertificate = function () {
|
||||
if (obj.configOk == false) { obj.log("Can't request cert, invalid configuration.");return; }
|
||||
|
||||
// Create a private key
|
||||
parent.debug('cert', "LE: Generating private key...");
|
||||
obj.log("Generating private key...");
|
||||
acme.forge.createPrivateKey().then(function (accountKey) {
|
||||
// Create the ACME client
|
||||
parent.debug('cert', "LE: Setting up ACME client...");
|
||||
obj.log("Setting up ACME client...");
|
||||
obj.client = new acme.Client({
|
||||
directoryUrl: obj.runAsProduction ? acme.directory.letsencrypt.production : acme.directory.letsencrypt.staging,
|
||||
accountKey: accountKey
|
||||
});
|
||||
|
||||
// Create Certificate Request (CSR)
|
||||
parent.debug('cert', "LE: Creating certificate request...");
|
||||
obj.log("Creating certificate request...");
|
||||
acme.forge.createCsr({
|
||||
commonName: obj.leDomains[0],
|
||||
altNames: obj.leDomains
|
||||
}).then(function (r) {
|
||||
var csr = r[1];
|
||||
obj.tempPrivateKey = r[0];
|
||||
parent.debug('cert', "LE: Requesting certificate from Let's Encrypt...");
|
||||
obj.log("Requesting certificate from Let's Encrypt...");
|
||||
obj.client.auto({
|
||||
csr,
|
||||
email: obj.parent.config.letsencrypt.email,
|
||||
|
|
@ -478,7 +494,7 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
challengeCreateFn,
|
||||
challengeRemoveFn
|
||||
}).then(function (cert) {
|
||||
parent.debug('cert', "LE: Got certificate.");
|
||||
obj.log("Got certificate.");
|
||||
|
||||
// Save certificate and private key to PEM files
|
||||
var certFile = obj.path.join(obj.certPath, (obj.runAsProduction ? 'production.crt' : 'staging.crt'));
|
||||
|
|
@ -488,16 +504,16 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
delete obj.tempPrivateKey;
|
||||
|
||||
// Cause a server restart
|
||||
parent.debug('cert', "LE: Performing server restart...");
|
||||
obj.log("Performing server restart...");
|
||||
obj.parent.performServerCertUpdate();
|
||||
}, function (err) {
|
||||
parent.debug('cert', "LE: Failed to obtain certificate: " + err.message);
|
||||
obj.log("Failed to obtain certificate: " + err.message);
|
||||
});
|
||||
}, function (err) {
|
||||
parent.debug('cert', "LE: Failed to generate certificate request: " + err.message);
|
||||
obj.log("Failed to generate certificate request: " + err.message);
|
||||
});
|
||||
}, function (err) {
|
||||
parent.debug('cert', "LE: Failed to generate private key: " + err.message);
|
||||
obj.log("Failed to generate private key: " + err.message);
|
||||
});
|
||||
}
|
||||
|
||||
|
|
@ -505,13 +521,15 @@ module.exports.CreateLetsEncrypt2 = function (parent) {
|
|||
obj.getStats = function () {
|
||||
var r = {
|
||||
lib: 'acme-client',
|
||||
configOk: obj.configOk,
|
||||
leDomains: obj.leDomains,
|
||||
challenges: obj.challenges,
|
||||
production: obj.runAsProduction,
|
||||
webServer: obj.redirWebServerHooked,
|
||||
certPath: obj.certPath,
|
||||
certPath: obj.certPath
|
||||
};
|
||||
if (obj.certExpire) { r.daysLeft = Math.floor((obj.certExpire - new Date()) / 86400000); }
|
||||
if (obj.configErr) { r.error = obj.configErr; }
|
||||
if (obj.certExpire) { r.cert = 'Present'; r.daysLeft = Math.floor((obj.certExpire - new Date()) / 86400000); } else { r.cert = 'None'; }
|
||||
return r;
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue