@hello.nrfcloud.com/certificate-helpers 1.0.0

package/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2024, Nordic Semiconductor ASA | nordicsemi.no
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -0,0 +1,14 @@
+# Certificate Helpers [![npm version](https://img.shields.io/npm/v/@hello.nrfcloud.com/certificate-helpers.svg)](https://www.npmjs.com/package/@hello.nrfcloud.com/certificate-helpers)
+
+[![GitHub Actions](https://github.com/hello-nrfcloud/certificate-helpers/workflows/Test%20and%20Release/badge.svg)](https://github.com/hello-nrfcloud/certificate-helpers/actions)
+[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
+[![Renovate](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com)
+[![@commitlint/config-conventional](https://img.shields.io/badge/%40commitlint-config--conventional-brightgreen)](https://github.com/conventional-changelog/commitlint/tree/master/@commitlint/config-conventional)
+[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://github.com/prettier/prettier/)
+[![ESLint: TypeScript](https://img.shields.io/badge/ESLint-TypeScript-blue.svg)](https://github.com/typescript-eslint/typescript-eslint)
+
+Helper functions for creating device certificates.
+
+## Installation
+
+    npm i --save --save-exact @hello.nrfcloud.com/certificate-helpers

package/dist/ca.d.ts

@@ -0,0 +1,4 @@
+export declare const createCA: (destinationFolder: string, CN: string, email?: string) => Promise<{
+    privateKey: string;
+    certificate: string;
+}>;

package/dist/ca.js

@@ -0,0 +1,39 @@
+import { stat } from 'node:fs/promises';
+import run from '@bifravst/run';
+import { simulatorCALocations } from './locations.js';
+export const createCA = async (destinationFolder, CN, email) => {
+    // CA certificate
+    const certificates = simulatorCALocations(destinationFolder);
+    // Create a CA private key
+    try {
+        await stat(certificates.certificate);
+    }
+    catch {
+        await run({
+            command: 'openssl',
+            args: ['genrsa', '-out', certificates.privateKey, '2048'],
+        });
+        let sub = `/C=NO/ST=Trondelag/L=Trondheim/O=Nordic Semiconductor ASA/OU=hello.nrfcloud.com/CN=${CN}`;
+        if (email !== undefined)
+            sub = `${sub}/emailAddress=${email}`;
+        await run({
+            command: 'openssl',
+            args: [
+                'req',
+                '-x509',
+                '-new',
+                '-nodes',
+                '-key',
+                certificates.privateKey,
+                '-sha256',
+                '-days',
+                '10957',
+                '-out',
+                certificates.certificate,
+                '-subj',
+                sub,
+            ],
+        });
+    }
+    return certificates;
+};

package/dist/der.d.ts

@@ -0,0 +1 @@
+export declare const toPEM: (derLocation: string, pemLocation: string) => Promise<void>;

package/dist/der.js

@@ -0,0 +1,7 @@
+import run from '@bifravst/run';
+export const toPEM = async (derLocation, pemLocation) => {
+    await run({
+        command: 'openssl',
+        args: ['req', '-inform', 'DER', '-in', derLocation, '-out', pemLocation],
+    });
+};

package/dist/device.d.ts

@@ -0,0 +1,19 @@
+export declare const signDeviceCertificate: ({ dir, deviceId, caCertificateLocation, caPrivateKeyLocation, }: {
+    dir: string;
+    deviceId: string;
+    caCertificateLocation: string;
+    caPrivateKeyLocation: string;
+}) => Promise<void>;
+export declare const createDeviceCertificate: ({ dest, caCertificates, deviceId, }: {
+    dest: string;
+    caCertificates: {
+        privateKey: string;
+        certificate: string;
+    };
+    deviceId: string;
+}) => Promise<{
+    privateKey: string;
+    certificate: string;
+    CSR: string;
+    signedCert: string;
+}>;

package/dist/device.js

@@ -0,0 +1,78 @@
+import run from '@bifravst/run';
+import { deviceCertificateLocations } from './locations.js';
+export const signDeviceCertificate = async ({ dir, deviceId, caCertificateLocation, caPrivateKeyLocation, }) => {
+    const { CSR: deviceCSRLocation, signedCert: deviceSignedCertLocation } = deviceCertificateLocations(dir, deviceId);
+    await run({
+        command: 'openssl',
+        args: [
+            'x509',
+            '-req',
+            '-CA',
+            caCertificateLocation,
+            '-CAkey',
+            caPrivateKeyLocation,
+            '-in',
+            deviceCSRLocation,
+            '-out',
+            deviceSignedCertLocation,
+            '-days',
+            '10957',
+        ],
+    });
+};
+export const createDeviceCertificate = async ({ dest, caCertificates, deviceId, }) => {
+    const deviceCertificates = deviceCertificateLocations(dest, deviceId);
+    // Device private key
+    await run({
+        command: 'openssl',
+        args: [
+            'ecparam',
+            '-out',
+            deviceCertificates.privateKey,
+            '-name',
+            'prime256v1',
+            '-genkey',
+        ],
+    });
+    // Device certificate
+    await run({
+        command: 'openssl',
+        args: [
+            'req',
+            '-x509',
+            '-new',
+            '-nodes',
+            '-key',
+            deviceCertificates.privateKey,
+            '-sha256',
+            '-days',
+            '10957',
+            '-out',
+            deviceCertificates.certificate,
+            '-subj',
+            `/CN=${deviceId}`,
+        ],
+    });
+    // Create CSR
+    await run({
+        command: 'openssl',
+        args: [
+            'req',
+            '-key',
+            deviceCertificates.privateKey,
+            '-new',
+            '-out',
+            deviceCertificates.CSR,
+            '-subj',
+            `/CN=${deviceId}`,
+        ],
+    });
+    // Sign device cert
+    await signDeviceCertificate({
+        dir: dest,
+        deviceId,
+        caCertificateLocation: caCertificates.certificate,
+        caPrivateKeyLocation: caCertificates.privateKey,
+    });
+    return deviceCertificates;
+};

package/dist/inspect.d.ts

@@ -0,0 +1,2 @@
+export declare const inspectCert: (location: string) => Promise<string>;
+export declare const inspectString: (cert: string) => Promise<string>;

package/dist/inspect.js

@@ -0,0 +1,10 @@
+import run from '@bifravst/run';
+export const inspectCert = async (location) => run({
+    command: 'openssl',
+    args: ['x509', '-text', '-noout', '-in', location],
+});
+export const inspectString = async (cert) => run({
+    command: 'openssl',
+    args: ['x509', '-text', '-noout'],
+    input: cert,
+});

package/dist/locations.d.ts

@@ -0,0 +1,19 @@
+import type { Environment } from 'aws-cdk-lib';
+/**
+ * Provide the directory to store certificates
+ */
+export declare const ensureCertificateDir: (env: Required<Environment>) => string;
+export declare const simulatorCALocations: (certificatesDir: string) => {
+    privateKey: string;
+    certificate: string;
+};
+export declare const productionRunCALocations: (certificatesDir: string, productionRun: number) => {
+    privateKey: string;
+    certificate: string;
+};
+export declare const deviceCertificateLocations: (certificatesDir: string, deviceId: string) => {
+    privateKey: string;
+    certificate: string;
+    CSR: string;
+    signedCert: string;
+};

package/dist/locations.js

@@ -0,0 +1,29 @@
+import { mkdirSync, statSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * Provide the directory to store certificates
+ */
+export const ensureCertificateDir = (env) => {
+    const dirName = path.join(process.cwd(), 'certificates', `${env.account}@${env.region}`);
+    try {
+        statSync(dirName);
+    }
+    catch {
+        mkdirSync(dirName, { recursive: true });
+    }
+    return dirName;
+};
+export const simulatorCALocations = (certificatesDir) => ({
+    privateKey: path.join(certificatesDir, 'simulator.CA.key'),
+    certificate: path.join(certificatesDir, 'simulator.CA.pem'),
+});
+export const productionRunCALocations = (certificatesDir, productionRun) => ({
+    privateKey: path.join(certificatesDir, `production-${productionRun.toString(16)}.CA.key`),
+    certificate: path.join(certificatesDir, `production-${productionRun.toString(16)}.CA.pem`),
+});
+export const deviceCertificateLocations = (certificatesDir, deviceId) => ({
+    privateKey: path.join(certificatesDir, `${deviceId}.key`),
+    certificate: path.join(certificatesDir, `${deviceId}.pem`),
+    CSR: path.join(certificatesDir, `${deviceId}.csr`),
+    signedCert: path.join(certificatesDir, `${deviceId}.signed.pem`),
+});

package/dist/production.d.ts

@@ -0,0 +1,4 @@
+export declare const ensureProductionRunCACertificate: (dir: string, productionRun: number) => Promise<{
+    privateKey: string;
+    certificate: string;
+}>;

package/dist/production.js

@@ -0,0 +1,40 @@
+import chalk from 'chalk';
+import { stat } from 'node:fs/promises';
+import run from '@bifravst/run';
+import { productionRunCALocations } from './locations.js';
+export const ensureProductionRunCACertificate = async (dir, productionRun) => {
+    const { privateKey, certificate } = productionRunCALocations(dir, productionRun);
+    try {
+        await stat(certificate);
+    }
+    catch {
+        // Create a CA private key
+        await run({
+            command: 'openssl',
+            args: ['genrsa', '-out', privateKey, '2048'],
+        });
+        await run({
+            command: 'openssl',
+            args: [
+                'req',
+                '-x509',
+                '-new',
+                '-nodes',
+                '-key',
+                privateKey,
+                '-sha256',
+                '-days',
+                '10957',
+                '-out',
+                certificate,
+                '-subj',
+                `/OU=Cellular IoT Applications Team, CN=Production Run ${productionRun}`,
+            ],
+        });
+    }
+    console.log(chalk.yellow(`CA certificate for production run ${productionRun.toString(16)}:`), chalk.blue(certificate));
+    return {
+        privateKey,
+        certificate,
+    };
+};

package/package.json

@@ -0,0 +1,91 @@
+{
+  "name": "@hello.nrfcloud.com/certificate-helpers",
+  "version": "1.0.0",
+  "description": "Helper functions for creating device certificates.",
+  "exports": {
+    "./*": {
+      "import": {
+        "types": "./dist/*.d.ts",
+        "default": "./dist/*.js"
+      }
+    }
+  },
+  "type": "module",
+  "scripts": {
+    "test": "tsx --no-warnings --test ./src/*.spec.ts",
+    "prepare": "husky",
+    "prepublishOnly": "npx tsc --noEmit false --outDir ./dist -d"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hello-nrfcloud/certificate-helpers.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hello-nrfcloud/certificate-helpers/issues"
+  },
+  "homepage": "https://github.com/hello-nrfcloud/certificate-helpers",
+  "keywords": [
+    "aws",
+    "lambda",
+    "typescript"
+  ],
+  "author": "Nordic Semiconductor ASA | nordicsemi.no",
+  "license": "BSD-3-Clause",
+  "devDependencies": {
+    "@bifravst/eslint-config-typescript": "6.0.17",
+    "@bifravst/prettier-config": "1.0.0",
+    "@commitlint/config-conventional": "19.1.0",
+    "@types/node": "20.12.3",
+    "aws-cdk-lib": "2.135.0",
+    "husky": "9.0.11",
+    "tsx": "4.7.1"
+  },
+  "lint-staged": {
+    "*.ts": [
+      "prettier --write",
+      "eslint"
+    ],
+    "*.{md,json,yaml,yml}": [
+      "prettier --write"
+    ]
+  },
+  "engines": {
+    "node": ">=20",
+    "npm": ">=9"
+  },
+  "release": {
+    "branches": [
+      "saga",
+      {
+        "name": "!(saga)",
+        "prerelease": true
+      }
+    ],
+    "remoteTags": true,
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/npm",
+      [
+        "@semantic-release/github",
+        {
+          "successComment": false,
+          "failTitle": false
+        }
+      ]
+    ]
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "package-lock.json",
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "prettier": "@bifravst/prettier-config",
+  "dependencies": {
+    "@bifravst/run": "1.2.0"
+  }
+}