@sequencemedia/certificates 1.0.0

package/README.md

@@ -0,0 +1,21 @@
+# @sequencemedia/certificates
+
+## Pre-requisites for Windows
+
+Install the latest pre-built release of OpenSSL
+
+### Install with an MSI
+
+Get an MSI from the [Win32/Win64 OpenSSL Installation Project](https://slproweb.com/products/Win32OpenSSL.html) (e.g., [3.0.7](https://slproweb.com/download/Win64OpenSSL-3_0_7.msi))
+
+### Or install with Chocolatey
+
+```
+choco install openssl
+```
+
+### Add OpenSSL to the `PATH`
+
+An [article on Medium](https://medium.com/swlh/installing-openssl-on-windows-10-and-updating-path-80992e26f6a1) also refers to the [OpenSSL Installation Project](https://slproweb.com/products/Win32OpenSSL.html) and describes (with screenshots) how to add OpenSSL to the `PATH`
+
+Once you have added OpenSSL to the `PATH`, open a console and at the command prompt enter `openssl version` to confirm the installation

package/README.txt

@@ -0,0 +1,19 @@
+https://betterprogramming.pub/how-to-create-trusted-ssl-certificates-for-your-local-development-13fd5aad29c6
+
+https://www.section.io/engineering-education/how-to-get-ssl-https-for-localhost/
+
+https://www.digicert.com/kb/ssl-support/openssl-quick-reference-guide.htm
+
+https://www.ietf.org/rfc/rfc4514.txt
+
+    String  X.500 AttributeType
+    ------  --------------------------------------------
+    CN      commonName (2.5.4.3)
+    L       localityName (2.5.4.7)
+    ST      stateOrProvinceName (2.5.4.8)
+    O       organizationName (2.5.4.10)
+    OU      organizationalUnitName (2.5.4.11)
+    C       countryName (2.5.4.6)
+    STREET  streetAddress (2.5.4.9)
+    DC      domainComponent (0.9.2342.19200300.100.1.25)
+    UID     userId (0.9.2342.19200300.100.1.1)

package/babel.config.cjs

@@ -0,0 +1,21 @@
+const debug = require('debug')
+
+const log = debug('@sequencemedia/certificates')
+
+log('`localhost` is awake')
+
+module.exports = {
+  compact: true,
+  comments: false,
+  presets: [
+    [
+      '@babel/env', {
+        targets: {
+          node: 'current'
+        },
+        useBuiltIns: 'usage',
+        corejs: 3
+      }
+    ]
+  ]
+}

package/ca-and-certs.bat

@@ -0,0 +1,16 @@
+@echo off
+
+if defined 1 (
+  set SUBJ=%1
+) else (
+  set SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+)
+
+setlocal enableextensions
+md certificates
+endlocal
+
+call scripts/bat/certificate-authority-key-pem.bat
+call scripts/bat/certificate-authority-crt.bat
+call scripts/bat/localhost-csr.bat
+call scripts/bat/localhost-crt.bat

package/ca-and-certs.mjs

@@ -0,0 +1,101 @@
+import debug from 'debug'
+import os from 'node:os'
+import ip from 'ip'
+import {
+  exec
+} from 'node:child_process'
+import PATH from './where-am-i.mjs'
+import config from './scripts/js/config.mjs'
+import ext from './scripts/js/ext.mjs'
+import toSubj from './scripts/js/to-subj.mjs'
+
+const OPTIONS = {
+  maxBuffer: 1024 * 2000,
+  shell: true,
+  stdio: 'inherit'
+}
+
+const HOSTNAME = os.hostname()
+const ADDRESS = ip.address()
+const PLATFORM = os.platform()
+
+const log = debug('@sequencemedia/certificates')
+const info = debug('@sequencemedia/certificates:info')
+const error = debug('@sequencemedia/certificates:error')
+
+function bat (params) {
+  const command = `ca-and-certs.bat "${toSubj(params)}"`
+
+  info(command)
+
+  return (
+    new Promise((resolve, reject) => {
+      exec(command, { ...OPTIONS, cwd: PATH }, (e) => (!e) ? resolve() : reject(e))
+    })
+  )
+}
+
+function sh (params) {
+  const command = `./ca-and-certs.sh "${toSubj(params)}"`
+
+  info(command)
+
+  return (
+    new Promise((resolve, reject) => {
+      exec(command, { ...OPTIONS, cwd: PATH }, (e) => (!e) ? resolve() : reject(e))
+    })
+  )
+}
+
+log('`ca-and-certs` is awake')
+
+async function app () {
+  try {
+    await ext(HOSTNAME, ADDRESS)
+
+    const {
+      country,
+      state,
+      locality,
+      organisation,
+      commonName,
+      emailAddress
+    } = config
+
+    info({
+      country,
+      state,
+      locality,
+      organisation,
+      commonName,
+      emailAddress
+    })
+
+    return (PLATFORM === 'win32')
+      ? await bat({
+        country,
+        state,
+        locality,
+        organisation,
+        commonName,
+        emailAddress
+      })
+      : await sh({
+        country,
+        state,
+        locality,
+        organisation,
+        commonName,
+        emailAddress
+      })
+  } catch ({
+    code = 'N/A',
+    message = 'N/A'
+  }) {
+    error(code, message)
+
+    process.exit(1)
+  }
+}
+
+export default app()

package/ca-and-certs.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+if [ -z "$1" ]
+then
+  SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+else
+  SUBJ=$1
+fi
+
+mkdir certificates 2> /dev/null
+
+source scripts/sh/certificate-authority-key-pem.sh
+source scripts/sh/certificate-authority-crt.sh
+source scripts/sh/localhost-csr.sh
+source scripts/sh/localhost-crt.sh

package/certs.bat

@@ -0,0 +1,10 @@
+@echo off
+
+if defined 1 (
+  set SUBJ=%1
+) else (
+  set SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+)
+
+call scripts/bat/localhost-csr.bat
+call scripts/bat/localhost-crt.bat

package/certs.mjs

@@ -0,0 +1,101 @@
+import debug from 'debug'
+import os from 'node:os'
+import ip from 'ip'
+import {
+  exec
+} from 'node:child_process'
+import PATH from './where-am-i.mjs'
+import config from './scripts/js/config.mjs'
+import ext from './scripts/js/ext.mjs'
+import toSubj from './scripts/js/to-subj.mjs'
+
+const OPTIONS = {
+  maxBuffer: 1024 * 2000,
+  shell: true,
+  stdio: 'inherit'
+}
+
+const HOSTNAME = os.hostname()
+const ADDRESS = ip.address()
+const PLATFORM = os.platform()
+
+const log = debug('@sequencemedia/certificates')
+const info = debug('@sequencemedia/certificates:info')
+const error = debug('@sequencemedia/certificates:error')
+
+function bat (params) {
+  const command = `certs.bat "${toSubj(params)}"`
+
+  info(command)
+
+  return (
+    new Promise((resolve, reject) => {
+      exec(command, { ...OPTIONS, cwd: PATH }, (e) => (!e) ? resolve() : reject(e))
+    })
+  )
+}
+
+function sh (params) {
+  const command = `./certs.sh "${toSubj(params)}"`
+
+  info(command)
+
+  return (
+    new Promise((resolve, reject) => {
+      exec(command, { ...OPTIONS, cwd: PATH }, (e) => (!e) ? resolve() : reject(e))
+    })
+  )
+}
+
+log('`certs` is awake')
+
+async function app () {
+  try {
+    await ext(HOSTNAME, ADDRESS)
+
+    const {
+      country,
+      state,
+      locality,
+      organisation,
+      commonName,
+      emailAddress
+    } = config
+
+    info({
+      country,
+      state,
+      locality,
+      organisation,
+      commonName,
+      emailAddress
+    })
+
+    return (PLATFORM === 'win32')
+      ? await bat({
+        country,
+        state,
+        locality,
+        organisation,
+        commonName,
+        emailAddress
+      })
+      : await sh({
+        country,
+        state,
+        locality,
+        organisation,
+        commonName,
+        emailAddress
+      })
+  } catch ({
+    code = 'N/A',
+    message = 'N/A'
+  }) {
+    error(code, message)
+
+    process.exit(1)
+  }
+}
+
+export default app()

package/certs.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+if [ -z "$1" ]
+then
+  SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+else
+  SUBJ=$1
+fi
+
+source scripts/sh/localhost-csr.sh
+source scripts/sh/localhost-crt.sh

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@sequencemedia/certificates",
+  "version": "1.0.0",
+  "description": "Generate root CA and self-signed certificates with OpenSSL",
+  "type": "module",
+  "author": {
+    "name": "Jonathan Perry for Sequence Media Limited",
+    "email": "sequencemedia@sequencemedia.net",
+    "url": "http://sequencemedia.net"
+  },
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/sequencemedia/certificate-authority.git"
+  },
+  "homepage": "https://github.com/sequencemedia/certificates#readme",
+  "bugs": {
+    "url": "https://github.com/sequencemedia/certificates/issues"
+  },
+  "scripts": {
+    "lint": "eslint . --ext cjs --ext mjs",
+    "lint:fix": "npm run lint -- --fix",
+    "ca-and-certs": "DEBUG=@sequencemedia/certificates:* node ca-and-certs.mjs",
+    "certs": "DEBUG=@sequencemedia/certificates:* node certs.mjs"
+  },
+  "dependencies": {
+    "debug": "^4.3.4",
+    "fs-extra": "^11.1.0",
+    "ip": "^1.1.8",
+    "nconf": "^0.12.0",
+    "os": "^0.1.2"
+  },
+  "devDependencies": {
+    "@babel/cli": "^7.20.7",
+    "@babel/core": "^7.20.12",
+    "@babel/eslint-parser": "^7.19.1",
+    "@babel/preset-env": "^7.20.2",
+    "core-js": "^3.27.1",
+    "eslint": "^8.31.0",
+    "eslint-config-standard": "^17.0.0",
+    "eslint-plugin-import": "^2.26.0",
+    "eslint-plugin-node": "^11.1.0",
+    "eslint-plugin-promise": "^6.1.1"
+  }
+}

package/scripts/bat/certificate-authority-crt.bat

@@ -0,0 +1,2 @@
+@echo off
+openssl x509 -outform pem -in certificates/certificate-authority.pem -out certificates/certificate-authority.crt

package/scripts/bat/certificate-authority-key-pem.bat

@@ -0,0 +1,5 @@
+@echo off
+if not defined SUBJ (
+  set SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+)
+openssl req -x509 -nodes -new -sha512 -days 365 -newkey rsa:4096 -keyout certificates/certificate-authority.key -out certificates/certificate-authority.pem -subj %SUBJ%

package/scripts/bat/localhost-crt.bat

@@ -0,0 +1,2 @@
+@echo off
+openssl x509 -req -sha512 -days 365 -extfile certificates/localhost.ext -CA certificates/certificate-authority.crt -CAkey certificates/certificate-authority.key -CAcreateserial -in certificates/localhost.csr -out certificates/localhost.crt

package/scripts/bat/localhost-csr.bat

@@ -0,0 +1,5 @@
+@echo off
+if not defined SUBJ (
+  set SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+)
+openssl req -new -nodes -newkey rsa:4096 -keyout certificates/localhost.key -out certificates/localhost.csr -subj %SUBJ%

package/scripts/js/config.mjs

@@ -0,0 +1,29 @@
+import debug from 'debug'
+import nconf from 'nconf'
+
+const log = debug('@sequencemedia/certificates')
+const error = debug('@sequencemedia/certificates:error')
+
+log('`config` is awake')
+
+try {
+  nconf
+    .argv()
+    .file('certificates.json')
+    .required([
+      'country',
+      'state',
+      'locality',
+      'organisation',
+      'commonName',
+      'emailAddress'
+    ])
+} catch ({
+  message = 'N/A'
+}) {
+  error(message)
+
+  process.exit(1)
+}
+
+export default nconf.get()

package/scripts/js/ext.mjs

@@ -0,0 +1,39 @@
+import debug from 'debug'
+import {
+  join
+} from 'node:path'
+import {
+  ensureDir
+} from 'fs-extra'
+import {
+  writeFile
+} from 'node:fs/promises'
+import PATH from '../../where-am-i.mjs'
+
+const CERTIFICATES = join(PATH, 'certificates')
+const FILE = join(CERTIFICATES, 'localhost.ext')
+
+const log = debug('@sequencemedia/certificates')
+
+function getExt (hostname, address) {
+  return (`
+authorityKeyIdentifier = keyid, issuer
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1
+DNS.2 = ${hostname.toLowerCase()}
+IP.3 = ${address}
+  `).trim().concat('\n')
+}
+
+log('`ext` is awake')
+
+export default async function ext (hostname, address) {
+  await ensureDir(CERTIFICATES)
+  await writeFile(FILE, getExt(hostname, address))
+}

package/scripts/js/to-subj.mjs

@@ -0,0 +1,16 @@
+import debug from 'debug'
+
+const log = debug('@sequencemedia/certificates')
+
+log('`toSubj` is awake')
+
+export default function toSubj ({
+  country,
+  state,
+  locality,
+  organisation,
+  commonName,
+  emailAddress
+}) {
+  return `/C=${country}/ST=${state}/L=${locality}/O=${organisation}/CN=${commonName}/emailAddress=${emailAddress}`
+}

package/scripts/sh/certificate-authority-crt.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+openssl x509 -outform pem \
+  -in certificates/certificate-authority.pem \
+  -out certificates/certificate-authority.crt

package/scripts/sh/certificate-authority-key-pem.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [ $# -eq 1 ]
+then
+  SUBJ=$1
+fi
+
+if [ -z "$SUBJ" ]
+then
+  SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+fi
+
+openssl req -x509 -nodes -new -sha512 \
+  -days 365 \
+  -newkey rsa:4096 \
+  -keyout certificates/certificate-authority.key \
+  -out certificates/certificate-authority.pem \
+  -subj "$SUBJ"

package/scripts/sh/localhost-crt.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+openssl x509 -req -sha512 -days 365 \
+  -extfile certificates/localhost.ext \
+  -CA certificates/certificate-authority.crt \
+  -CAkey certificates/certificate-authority.key \
+  -CAcreateserial \
+  -in certificates/localhost.csr \
+  -out certificates/localhost.crt

package/scripts/sh/localhost-csr.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+if [ $# -eq 1 ]
+then
+  SUBJ=$1
+fi
+
+if [ -z "$SUBJ" ]
+then
+  SUBJ="/C=UK/ST=England/L=Greenwich/O=Sequence Media Limited/CN=Sequence Media/emailAddress=sequencemedia@sequencemedia.net"
+fi
+
+openssl req -new -nodes -newkey rsa:4096 \
+  -keyout certificates/localhost.key \
+  -out certificates/localhost.csr \
+  -subj "$SUBJ"

package/where-am-i.mjs

@@ -0,0 +1,8 @@
+import {
+  dirname
+} from 'node:path'
+import {
+  fileURLToPath
+} from 'node:url'
+
+export default dirname(fileURLToPath(import.meta.url))