matterbridge 3.1.4-dev-20250715-075e722 → 3.1.4-dev-20250717-d36e252

package/CHANGELOG.md

@@ -8,18 +8,23 @@ If you like this project and find it useful, please consider giving it a star on
   <img src="bmc-button.svg" alt="Buy me a coffee" width="120">
 </a>
 
-## [3.1.4] - 2025-07-??
+## [3.1.4] - 2025-07-16
 
 ### Added
 
+- [frontend]: Added support for p12 certificates. Add cert.p12 and cert.pass in the '.matterbridge/cert' directory. If both .p12 and cert.pem are present, only the .p12 will be used. See the README.md for more info.
+- [frontend]: Added support for p12 certificates with mTLS: both the server and the client must present the correct certificate. Add the parameter '-mtls'. See the README.md for more info.
+- [frontend]: Improved test units on Frontend class (total coverage 98%).
+
 ### Changed
 
 - [package]: Updated dependencies.
-- [bin]: Updated matterbridge bin.
 - [network]: Refactor network logging to improve clarity and update logging format.
 
 ### Fixed
 
+- [bin]: Updated matterbridge bin.
+
 <a href="https://www.buymeacoffee.com/luligugithub">
   <img src="bmc-button.svg" alt="Buy me a coffee" width="80">
 </a>

package/README.md

@@ -456,7 +456,7 @@ This will reset the internal storages. All commissioning informations will be lo
 
 ## How to enable HTTPS for the frontend
 
-### Provide your own certificates
+### Provide your own standard certificate, key and ca (optional)
 
 Place your own certificates in the `.matterbridge/cert` directory:
 
@@ -466,14 +466,35 @@ Place your own certificates in the `.matterbridge/cert` directory:
 
 ![image](screenshot/Screenshot%20Certificates.png)
 
+Matterbridge looks first for .p12 certificate and if it is not found it looks for cert.pem and key.pem.
+
+### Provide your own 'PKCS#12' certificate and the passphrase
+
+Place your own p12 certificate (binary file) and the passphrase (text file) in the `.matterbridge/cert` directory:
+
+- `cert.p12`
+- `cert.pass`
+
+Matterbridge looks first for .p12 certificate and if it is not found it looks for cert.pem and key.pem.
+
 ### Change the command line
 
-Add the **-ssl** parameter to the command line. If desired, you can also change the frontend port with **-frontend 443**.
+Add the **-ssl** parameter to the command line.
+
+If desired, you can also change the frontend port with **-frontend 443**.
 
 ```bash
 matterbridge -ssl -frontend 443
 ```
 
+Add the **-mtls** parameter to the command line if you want Matterbridge to request the client (your browser) to authenticate itself (this is the most secure connection possible).
+
+The browser must provide the client certificate: on Windows you need to import it in Current User → Personal → Certificates with certmgr.msc.
+
+```bash
+matterbridge -ssl -mtls -frontend 443
+```
+
 ### Restart
 
 If the certificate are correctly configured, you will be able to connect with https to the frontend.
@@ -498,6 +519,8 @@ Then, from the dots menu in the frontend, download the `matterbridge.log` and `m
 
 ![image](screenshot/Screenshot%20Debug%20Download%20Logs.png)
 
+Don't forget to unselect the debug mode when is no more needed. The network traffic and cpu usage is very high in debug mode.
+
 # Known general issues
 
 ## Session XYZ does not exist or Cannot find a session for ID XYZ

package/dist/frontend.js

@@ -2,7 +2,7 @@ import { createServer } from 'node:http';
 import https from 'node:https';
 import os from 'node:os';
 import path from 'node:path';
-import { promises as fs } from 'node:fs';
+import { existsSync, promises as fs } from 'node:fs';
 import EventEmitter from 'node:events';
 import express from 'express';
 import WebSocket, { WebSocketServer } from 'ws';
@@ -30,7 +30,6 @@ export class Frontend extends EventEmitter {
     matterbridge;
     log;
     port = 8283;
-    initializeError = false;
     expressApp;
     httpServer;
     httpsServer;
@@ -53,6 +52,7 @@ export class Frontend extends EventEmitter {
         this.expressApp.use(express.static(path.join(this.matterbridge.rootDirectory, 'frontend/build')));
         if (!hasParameter('ssl')) {
             try {
+                this.log.debug(`Creating HTTP server...`);
                 this.httpServer = createServer(this.expressApp);
             }
             catch (error) {
@@ -85,43 +85,76 @@ export class Frontend extends EventEmitter {
                         this.log.error(`Port ${this.port} is already in use`);
                         break;
                 }
-                this.initializeError = true;
                 this.emit('server_error', error);
                 return;
             });
         }
         else {
             let cert;
-            try {
-                cert = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pem'), 'utf8');
-                this.log.info(`Loaded certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pem')}`);
-            }
-            catch (error) {
-                this.log.error(`Error reading certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pem')}: ${error}`);
-                this.emit('server_error', error);
-                return;
-            }
             let key;
-            try {
-                key = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/key.pem'), 'utf8');
-                this.log.info(`Loaded key file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/key.pem')}`);
-            }
-            catch (error) {
-                this.log.error(`Error reading key file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/key.pem')}: ${error}`);
-                this.emit('server_error', error);
-                return;
-            }
             let ca;
-            try {
-                ca = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/ca.pem'), 'utf8');
-                this.log.info(`Loaded CA certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/ca.pem')}`);
+            let fullChain;
+            let pfx;
+            let passphrase;
+            let httpsServerOptions = {};
+            if (existsSync(path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.p12'))) {
+                try {
+                    pfx = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.p12'));
+                    this.log.info(`Loaded p12 certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.p12')}`);
+                }
+                catch (error) {
+                    this.log.error(`Error reading p12 certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.p12')}: ${error}`);
+                    this.emit('server_error', error);
+                    return;
+                }
+                try {
+                    passphrase = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pass'), 'utf8');
+                    passphrase = passphrase.trim();
+                    this.log.info(`Loaded p12 passphrase file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pass')}`);
+                }
+                catch (error) {
+                    this.log.error(`Error reading p12 passphrase file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pass')}: ${error}`);
+                    this.emit('server_error', error);
+                    return;
+                }
+                httpsServerOptions = { pfx, passphrase };
             }
-            catch (error) {
-                this.log.info(`CA certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/ca.pem')} not loaded: ${error}`);
+            else {
+                try {
+                    cert = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pem'), 'utf8');
+                    this.log.info(`Loaded certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pem')}`);
+                }
+                catch (error) {
+                    this.log.error(`Error reading certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/cert.pem')}: ${error}`);
+                    this.emit('server_error', error);
+                    return;
+                }
+                try {
+                    key = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/key.pem'), 'utf8');
+                    this.log.info(`Loaded key file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/key.pem')}`);
+                }
+                catch (error) {
+                    this.log.error(`Error reading key file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/key.pem')}: ${error}`);
+                    this.emit('server_error', error);
+                    return;
+                }
+                try {
+                    ca = await fs.readFile(path.join(this.matterbridge.matterbridgeDirectory, 'certs/ca.pem'), 'utf8');
+                    fullChain = `${cert}\n${ca}`;
+                    this.log.info(`Loaded CA certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/ca.pem')}`);
+                }
+                catch (error) {
+                    this.log.info(`CA certificate file ${path.join(this.matterbridge.matterbridgeDirectory, 'certs/ca.pem')} not loaded: ${error}`);
+                }
+                httpsServerOptions = { cert: fullChain ?? cert, key, ca };
+            }
+            if (hasParameter('mtls')) {
+                httpsServerOptions.requestCert = true;
+                httpsServerOptions.rejectUnauthorized = true;
             }
-            const serverOptions = { cert, key, ca };
             try {
-                this.httpsServer = https.createServer(serverOptions, this.expressApp);
+                this.log.debug(`Creating HTTPS server...`);
+                this.httpsServer = https.createServer(httpsServerOptions, this.expressApp);
             }
             catch (error) {
                 this.log.error(`Failed to create HTTPS server: ${error}`);
@@ -153,15 +186,13 @@ export class Frontend extends EventEmitter {
                         this.log.error(`Port ${this.port} is already in use`);
                         break;
                 }
-                this.initializeError = true;
                 this.emit('server_error', error);
                 return;
             });
         }
-        if (this.initializeError)
-            return;
         const wssPort = this.port;
         const wssHost = hasParameter('ssl') ? `wss://${this.matterbridge.systemInformation.ipv4Address}:${wssPort}` : `ws://${this.matterbridge.systemInformation.ipv4Address}:${wssPort}`;
+        this.log.debug(`Creating WebSocketServer on host ${CYAN}${wssHost}${db}...`);
         this.webSocketServer = new WebSocketServer(hasParameter('ssl') ? { server: this.httpsServer } : { server: this.httpServer });
         this.webSocketServer.on('connection', (ws, request) => {
             const clientIp = request.socket.remoteAddress;
@@ -492,6 +523,7 @@ export class Frontend extends EventEmitter {
                     }
                     else {
                         this.log.debug('WebSocket server closed successfully');
+                        this.emit('websocket_server_stopped');
                     }
                     resolve();
                 });
@@ -508,6 +540,7 @@ export class Frontend extends EventEmitter {
                     }
                     else {
                         this.log.debug('Http server closed successfully');
+                        this.emit('server_stopped');
                     }
                     resolve();
                 });
@@ -525,6 +558,7 @@ export class Frontend extends EventEmitter {
                     }
                     else {
                         this.log.debug('Https server closed successfully');
+                        this.emit('server_stopped');
                     }
                     resolve();
                 });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "matterbridge",
-  "version": "3.1.4-dev-20250715-075e722",
+  "version": "3.1.4-dev-20250717-d36e252",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "matterbridge",
-      "version": "3.1.4-dev-20250715-075e722",
+      "version": "3.1.4-dev-20250717-d36e252",
       "license": "Apache-2.0",
       "dependencies": {
         "@matter/main": "0.15.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "matterbridge",
-  "version": "3.1.4-dev-20250715-075e722",
+  "version": "3.1.4-dev-20250717-d36e252",
   "description": "Matterbridge plugin manager for Matter",
   "author": "https://github.com/Luligu",
   "license": "Apache-2.0",