navy 7.0.0 → 7.1.0

package/lib/cli/__tests__/https.js

@@ -18,6 +18,8 @@ describe('cli/https', function () {
   let createCertStub;
   let generateRootCaStub;
   let removeCertStub;
+  let issueLeafCertForUrlStub;
+  let installRootCaToTrustStoreStub;
   let fsStub;
   let consoleLogStub;
   let httpsCli;
@@ -40,6 +42,12 @@ describe('cli/https', function () {
     createCertStub = sandbox.stub().resolves();
     generateRootCaStub = sandbox.stub().resolves();
     removeCertStub = sandbox.stub().resolves();
+    issueLeafCertForUrlStub = sandbox.stub().resolves({
+      certPath: '/out/host.crt',
+      keyPath: '/out/host.key',
+      caCopyPath: '/out/navy-root-ca.crt'
+    });
+    installRootCaToTrustStoreStub = sandbox.stub();
     fsStub = {
       existsSync: sandbox.stub().returns(true),
       readdirSync: sandbox.stub().returns(['web.local.crt', 'api.local.crt', 'something.txt'])
@@ -63,7 +71,11 @@ describe('cli/https', function () {
       '../util/https': {
         createCert: createCertStub,
         generateRootCa: generateRootCaStub,
-        removeCert: removeCertStub
+        removeCert: removeCertStub,
+        issueLeafCertForUrl: issueLeafCertForUrlStub
+      },
+      '../util/install-root-ca': {
+        installRootCaToTrustStore: installRootCaToTrustStoreStub
       },
       fs: fsStub
     });
@@ -205,6 +217,186 @@ describe('cli/https', function () {
         const checkedPaths = fsStub.existsSync.getCalls().map(c => c.args[0]);
         (0, _chai.expect)(checkedPaths.some(p => p === '/custom-ca/ca.crt')).to.equal(true);
       });
+      it('should accept a single string service name', async function () {
+        await httpsCli('web', {
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(createCertStub.callCount).to.equal(1);
+      });
+      it('should ignore non-string entries in a services array', async function () {
+        await httpsCli(['web', '', null, 42, 'api'], {
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(createCertStub.callCount).to.equal(2);
+      });
+      it('should treat unsupported service arg types as an empty list', async function () {
+        fsStub.existsSync.returns(false);
+        await httpsCli(42, {
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(createCertStub.called).to.equal(false);
+        (0, _chai.expect)(generateRootCaStub.called).to.equal(false);
+      });
+      it('should treat an empty string service arg as list mode', async function () {
+        fsStub.existsSync.returns(false);
+        await httpsCli('', {
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(createCertStub.called).to.equal(false);
+      });
+    });
+    describe('validation', function () {
+      async function expectNavyError(promise, messagePattern) {
+        let caught;
+        try {
+          await promise;
+        } catch (err) {
+          caught = err;
+        }
+        (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+        (0, _chai.expect)(caught.message).to.match(messagePattern);
+      }
+      it('should reject combining disable with setup', async function () {
+        await expectNavyError(httpsCli([], {
+          disable: 'web',
+          setup: true
+        }), /cannot be combined/);
+      });
+      it('should reject combining disable with all', async function () {
+        await expectNavyError(httpsCli([], {
+          disable: 'web',
+          all: true
+        }), /cannot be combined/);
+      });
+      it('should reject combining disable with issue', async function () {
+        await expectNavyError(httpsCli([], {
+          disable: 'web',
+          issue: 'https://host'
+        }), /cannot be combined/);
+      });
+      it('should reject combining setup with all', async function () {
+        await expectNavyError(httpsCli([], {
+          setup: true,
+          all: true
+        }), /Use only one/);
+      });
+      it('should reject combining setup with issue', async function () {
+        await expectNavyError(httpsCli([], {
+          setup: true,
+          issue: 'https://host'
+        }), /Use only one/);
+      });
+      it('should reject combining all with issue', async function () {
+        await expectNavyError(httpsCli([], {
+          all: true,
+          issue: 'https://host'
+        }), /Use only one/);
+      });
+    });
+    describe('setup mode', function () {
+      it('should generate the root CA and install it in the trust store', async function () {
+        getConfigStub.returns({
+          tlsRootCaDir: '/custom-ca'
+        });
+        await httpsCli([], {
+          setup: true
+        });
+        (0, _chai.expect)(generateRootCaStub.calledOnce).to.equal(true);
+        (0, _chai.expect)(installRootCaToTrustStoreStub.calledOnce).to.equal(true);
+        (0, _chai.expect)(installRootCaToTrustStoreStub.firstCall.args[0]).to.equal('/custom-ca/ca.crt');
+        const printed = consoleLogStub.getCalls().map(c => c.args[0] || '').join('\n');
+        (0, _chai.expect)(printed).to.contain('trust store');
+      });
+      it('should reject service names with setup', async function () {
+        let caught;
+        try {
+          await httpsCli(['web'], {
+            setup: true
+          });
+        } catch (err) {
+          caught = err;
+        }
+        (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+        (0, _chai.expect)(caught.message).to.contain('does not take service names');
+      });
+    });
+    describe('all mode', function () {
+      it('should enable HTTPS for every available service', async function () {
+        await httpsCli([], {
+          all: true,
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(createCertStub.callCount).to.equal(2);
+        (0, _chai.expect)(reconfigureHTTPProxyStub.calledOnce).to.equal(true);
+        const printed = consoleLogStub.getCalls().map(c => c.args[0] || '').join('\n');
+        (0, _chai.expect)(printed).to.contain('web');
+        (0, _chai.expect)(printed).to.contain('api');
+      });
+      it('should generate the root CA when cert files are missing', async function () {
+        fsStub.existsSync.callsFake(p => !p.endsWith('ca.crt') && !p.endsWith('ca.key'));
+        await httpsCli([], {
+          all: true,
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(generateRootCaStub.calledOnce).to.equal(true);
+      });
+      it('should warn and return when no services are available', async function () {
+        navyStub.getAvailableServiceNames.resolves([]);
+        await httpsCli([], {
+          all: true,
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(createCertStub.called).to.equal(false);
+        const printed = consoleLogStub.getCalls().map(c => c.args[0] || '').join('\n');
+        (0, _chai.expect)(printed).to.contain('No services found');
+      });
+      it('should reject service names with all', async function () {
+        let caught;
+        try {
+          await httpsCli(['web'], {
+            all: true
+          });
+        } catch (err) {
+          caught = err;
+        }
+        (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+        (0, _chai.expect)(caught.message).to.contain('does not take service names');
+      });
+    });
+    describe('issue mode', function () {
+      it('should issue a leaf cert for an external URL', async function () {
+        const cwdStub = sandbox.stub(process, 'cwd').returns('/current');
+        await httpsCli([], {
+          issue: 'https://external.local',
+          navy: 'env-1'
+        });
+        (0, _chai.expect)(issueLeafCertForUrlStub.calledOnce).to.equal(true);
+        (0, _chai.expect)(issueLeafCertForUrlStub.firstCall.args).to.eql(['https://external.local', '/current']);
+        const printed = consoleLogStub.getCalls().map(c => c.args[0] || '').join('\n');
+        (0, _chai.expect)(printed).to.contain('/out/host.crt');
+        (0, _chai.expect)(printed).to.contain('/out/host.key');
+        (0, _chai.expect)(printed).to.contain('/out/navy-root-ca.crt');
+        cwdStub.restore();
+      });
+      it('should honour issueOut when provided', async function () {
+        await httpsCli([], {
+          issue: 'https://external.local',
+          issueOut: '/custom/out'
+        });
+        (0, _chai.expect)(issueLeafCertForUrlStub.firstCall.args[1]).to.equal('/custom/out');
+      });
+      it('should reject service names with issue', async function () {
+        let caught;
+        try {
+          await httpsCli(['web'], {
+            issue: 'https://external.local'
+          });
+        } catch (err) {
+          caught = err;
+        }
+        (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+        (0, _chai.expect)(caught.message).to.contain('does not take service names');
+      });
     });
   });
 });

package/lib/cli/https.js

@@ -5,16 +5,64 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = _default;
+var _path = _interopRequireDefault(require("path"));
 var _chalk = _interopRequireDefault(require("chalk"));
 var _errors = require("../errors");
 var _navy = require("../navy");
 var _config = require("../config");
 var _httpProxy = require("../http-proxy");
 var _https = require("../util/https");
+var _installRootCa = require("../util/install-root-ca");
 var _fs = _interopRequireDefault(require("fs"));
+function normaliseServiceArgs(services) {
+  if (services == null) {
+    return [];
+  }
+  if (Array.isArray(services)) {
+    const result = [];
+    for (const s of services) {
+      if (typeof s === 'string' && s !== '') {
+        result.push(s);
+      }
+    }
+    return result;
+  }
+  if (typeof services === 'string') {
+    return services ? [services] : [];
+  }
+  return [];
+}
+async function issueHttpsForServices(navy, serviceNames, availableServices) {
+  const httpsReadyServices = [];
+  for (const service of serviceNames) {
+    if (!availableServices.includes(service)) {
+      console.log(`❌ ${service} not found, skipping`);
+      continue;
+    }
+    const serviceUrl = await navy.url(service);
+    try {
+      await (0, _https.createCert)({
+        serviceUrl
+      });
+      httpsReadyServices.push(service);
+    } catch (error) {
+      console.log(error);
+      throw new _errors.NavyError(`Could not generate TLS cert for ${service}`);
+    }
+  }
+  return httpsReadyServices;
+}
 async function _default(services, opts) {
   const tlsRootCaDir = (0, _config.getConfig)().tlsRootCaDir || _config.DEFAULT_TLS_ROOT_CA_DIR;
   const configDir = (0, _config.getConfigDir)();
+  const serviceList = normaliseServiceArgs(services);
+  const hasIssue = Boolean(opts.issue);
+  if (opts.disable && (opts.setup || opts.all || hasIssue)) {
+    throw new _errors.NavyError('`--disable` cannot be combined with `--setup`, `--all`, or `--issue`.');
+  }
+  if ([opts.setup, opts.all, hasIssue].filter(Boolean).length > 1) {
+    throw new _errors.NavyError('Use only one of `--setup`, `--all`, or `--issue`.');
+  }
   if (opts.disable) {
     await (0, _https.removeCert)(opts);
 
@@ -31,7 +79,60 @@ async function _default(services, opts) {
     console.log();
     return;
   }
-  if (!services || services.length === 0) {
+  if (opts.setup) {
+    if (serviceList.length > 0) {
+      throw new _errors.NavyError('`navy https --setup` does not take service names. Run `navy https <service>…` separately to issue service certificates.');
+    }
+    await (0, _https.generateRootCa)();
+    const caCrt = _path.default.join(tlsRootCaDir, 'ca.crt');
+    (0, _installRootCa.installRootCaToTrustStore)(caCrt);
+    console.log();
+    console.log(_chalk.default.green('✅ Navy root CA is installed in your trust store (where supported).'));
+    console.log(_chalk.default.dim('Browsers that use their own NSS store (e.g. Firefox) may still need the CA imported there.'));
+    console.log();
+    return;
+  }
+  if (opts.all) {
+    if (serviceList.length > 0) {
+      throw new _errors.NavyError('`navy https --all` does not take service names. Omit them, or name services without `--all`.');
+    }
+    if (!_fs.default.existsSync(`${tlsRootCaDir}/ca.crt`) || !_fs.default.existsSync(`${tlsRootCaDir}/ca.key`)) {
+      await (0, _https.generateRootCa)();
+    }
+    const navy = await (0, _navy.getNavy)(opts.navy);
+    await navy.ensurePluginsLoaded();
+    const availableServices = await navy.getAvailableServiceNames();
+    if (availableServices.length === 0) {
+      console.log();
+      console.log(_chalk.default.yellow('No services found in this navy; nothing to enable HTTPS for.'));
+      console.log();
+      return;
+    }
+    const httpsReadyServices = await issueHttpsForServices(navy, availableServices, availableServices);
+    await (0, _httpProxy.reconfigureHTTPProxy)({
+      restart: true,
+      navyFile: await navy.getNavyFile()
+    });
+    console.log();
+    console.log(_chalk.default.green(`✅ Service(s) ${httpsReadyServices.join(', ')} now accessible via HTTPS🔒`));
+    console.log();
+    return;
+  }
+  if (hasIssue) {
+    if (serviceList.length > 0) {
+      throw new _errors.NavyError('`navy https --issue` does not take service names.');
+    }
+    const outDir = opts.issueOut ? _path.default.resolve(opts.issueOut) : process.cwd();
+    const paths = await (0, _https.issueLeafCertForUrl)(String(opts.issue), outDir);
+    console.log();
+    console.log(_chalk.default.green('✅ TLS certificate issued for use outside Navy:'));
+    console.log(`   ${paths.certPath}`);
+    console.log(`   ${paths.keyPath}`);
+    console.log(`   ${paths.caCopyPath} (root CA; configure clients to trust this or append as a chain file)`);
+    console.log();
+    return;
+  }
+  if (serviceList.length === 0) {
     if (!_fs.default.existsSync(`${configDir}/tls-certs`)) return;
     const files = _fs.default.readdirSync(`${configDir}/tls-certs`);
     const urls = files.filter(file => file.endsWith('.crt')).map(crt => {
@@ -48,23 +149,7 @@ async function _default(services, opts) {
   const navy = await (0, _navy.getNavy)(opts.navy);
   await navy.ensurePluginsLoaded();
   const availableServices = await navy.getAvailableServiceNames();
-  const httpsReadyServices = [];
-  for (const service of services) {
-    if (!availableServices.includes(service)) {
-      console.log(`❌ ${service} not found, skipping`);
-      continue;
-    }
-    const serviceUrl = await navy.url(service);
-    try {
-      await (0, _https.createCert)({
-        serviceUrl
-      });
-      httpsReadyServices.push(service);
-    } catch (error) {
-      console.log(error);
-      throw new _errors.NavyError(`Could not generate TLS cert for ${service}`);
-    }
-  }
+  const httpsReadyServices = await issueHttpsForServices(navy, serviceList, availableServices);
   await (0, _httpProxy.reconfigureHTTPProxy)({
     restart: true,
     navyFile: await navy.getNavyFile()

package/lib/cli/program.js

@@ -171,7 +171,7 @@ _commander.program.command('health').option('-e, --navy [env]', `set the navy na
 _commander.program.command('wait-for-healthy [services...]').option('-e, --navy [env]', `set the navy name to be used [${defaultNavy}]`, defaultNavy).description('Waits for the given services to be healthy').action(lazyRequire('./wait-for-healthy'));
 _commander.program.command('use-tag <service> <tag>').option('-e, --navy [env]', `set the navy name to be used [${defaultNavy}]`, defaultNavy).description('Uses a specific tag for the given service').action(basicCliWrapper('useTag'));
 _commander.program.command('reset-tag <service>').option('-e, --navy [env]', `set the navy name to be used [${defaultNavy}]`, defaultNavy).description('Resets any tag override on the given service').action(basicCliWrapper('resetTag'));
-_commander.program.command('https [services...]').option('-e, --navy [env]', `set the navy name to be used [${defaultNavy}]`, defaultNavy).option('-d, --disable <service>', 'disable https (deletes cert) for a given service', null).description('Prints or enables HTTPS services').action(lazyRequire('./https')).on('--help', () => console.log(`
+_commander.program.command('https [services...]').option('-e, --navy [env]', `set the navy name to be used [${defaultNavy}]`, defaultNavy).option('-d, --disable <service>', 'disable https (deletes cert) for a given service', null).option('-s, --setup', 'generate the Navy root CA (if needed) and install it in the system trust store').option('-a, --all', 'enable HTTPS for every service in this navy').option('-i, --issue <url>', 'issue a TLS certificate and key for a URL (non-Navy service), signed with the Navy root CA').option('-o, --issue-out <dir>', 'output directory for --issue (default: current working directory)').description('Prints or enables HTTPS services').action(lazyRequire('./https')).on('--help', () => console.log(`
   Examples:
     List urls of services that listen on https:
     $ navy https
@@ -179,8 +179,18 @@ _commander.program.command('https [services...]').option('-e, --navy [env]', `se
     Enable https for mywebservice and anotherwebservice services
     $ navy https mywebservice anotherwebservice
 
+    Enable https for all services
+    $ navy https --all
+
     Disable https for mywebservice
     $ navy https -d mywebservice
+
+    Generate the Navy root CA and install it for this user (no service names)
+    $ navy https --setup
+
+    Issue a cert for an external host (writes leaf key/cert + navy-root-ca.crt)
+    $ navy https --issue https://api.example.test
+    $ navy https --issue https://api.example.test -o ./tls
   `));
 _commander.program.command('use-port <service> <internal> <external>').option('-e, --navy [env]', `set the navy name to be used [${defaultNavy}]`, defaultNavy).description('Uses a specific external port for the given service and internal port').action(basicCliWrapper('usePort'));
 _commander.program.command('reset-port <service> <internal>').option('-e, --navy [env]', `set the navy name to be used [${defaultNavy}]`, defaultNavy).description('Resets a specific external port mapping set by use-port').action(basicCliWrapper('resetPort'));

package/lib/util/__tests__/https.js

@@ -18,6 +18,7 @@ describe('util/https', function () {
   let pkiStub;
   let mdStub;
   let httpsModule;
+  let certObj;
   function loadModule() {
     httpsModule = _proxyquire.default.noCallThru()('../https', {
       '../config': {
@@ -52,9 +53,21 @@ describe('util/https', function () {
       mkdirSync: sandbox.stub(),
       unlinkSync: sandbox.stub(),
       readFileSync: sandbox.stub().returns('--PEM--'),
-      writeFileSync: sandbox.stub()
+      writeFileSync: sandbox.stub(),
+      copyFileSync: sandbox.stub()
     };
-    const certObj = {
+    const caCertFromPem = {
+      subject: {
+        attributes: [{
+          name: 'commonName',
+          value: 'ca'
+        }]
+      },
+      generateSubjectKeyIdentifier: sandbox.stub().returns({
+        getBytes: () => 'ca-subject-key-id'
+      })
+    };
+    certObj = {
       publicKey: null,
       serialNumber: null,
       validity: {
@@ -81,14 +94,7 @@ describe('util/https', function () {
       publicKeyToPem: sandbox.stub().returns('pub-pem'),
       certificateToPem: sandbox.stub().returns('cert-pem'),
       privateKeyFromPem: sandbox.stub().returns('priv-key-obj'),
-      certificateFromPem: sandbox.stub().returns({
-        subject: {
-          attributes: [{
-            name: 'commonName',
-            value: 'ca'
-          }]
-        }
-      })
+      certificateFromPem: sandbox.stub().returns(caCertFromPem)
     };
     mdStub = {
       sha256: {
@@ -297,5 +303,176 @@ describe('util/https', function () {
       }
       (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
     });
+    it('should prefer the parsed hostname over the raw certName segment', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        serviceUrl: 'https://tls-host.example.com:8443/app'
+      });
+      (0, _chai.expect)(certObj.setSubject.firstCall.args[0][0].value).to.equal('tls-host.example.com');
+    });
+    it('should keep certName when serviceUrl is not a valid URL', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        serviceUrl: 'https://bad['
+      });
+      const writtenPaths = fsStub.writeFileSync.getCalls().map(c => c.args[0]);
+      (0, _chai.expect)(writtenPaths.some(p => p.endsWith('bad[.key'))).to.equal(true);
+    });
+    it('should fall back to certName when serviceUrl has no hostname', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        serviceUrl: 'https://?q=1'
+      });
+      (0, _chai.expect)(certObj.setSubject.firstCall.args[0][0].value).to.equal('?q=1');
+    });
+    it('should wrap non-Error signing failures in NavyError', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      pkiStub.certificateFromPem.callsFake(() => {
+        const failure = 'string failure';
+        throw failure;
+      });
+      let caught;
+      try {
+        await httpsModule.createCert({
+          serviceUrl: 'https://web.local'
+        });
+      } catch (err) {
+        caught = err;
+      }
+      (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+      (0, _chai.expect)(caught.message).to.equal('string failure');
+    });
+    it('should use IP SAN when hostName is an IP address', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        hostName: '127.0.0.1'
+      });
+      const extensions = certObj.setExtensions.firstCall.args[0];
+      const sanExt = extensions.find(ext => ext.name === 'subjectAltName');
+      (0, _chai.expect)(sanExt.altNames).to.eql([{
+        type: 7,
+        ip: '127.0.0.1'
+      }]);
+    });
+  });
+  describe('hostNameFromIssueUrl', function () {
+    it('should throw when the URL is empty', function () {
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('')).to.throw(/must not be empty/);
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('   ')).to.throw(/must not be empty/);
+    });
+    it('should prepend https when no scheme is supplied', function () {
+      (0, _chai.expect)(httpsModule.hostNameFromIssueUrl('example.local')).to.equal('example.local');
+    });
+    it('should accept an explicit scheme', function () {
+      (0, _chai.expect)(httpsModule.hostNameFromIssueUrl('http://example.local')).to.equal('example.local');
+    });
+    it('should throw when the URL cannot be parsed', function () {
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('http://')).to.throw(/Invalid URL/);
+    });
+    it('should throw when no hostname can be determined', function () {
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('file:///tmp/cert.crt')).to.throw(/Could not determine a hostname/);
+    });
+  });
+  describe('issueLeafCertForUrl', function () {
+    it('should write cert, key, and CA copy files to the output dir', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      const result = await httpsModule.issueLeafCertForUrl('https://issued.local', '/out/certs');
+      (0, _chai.expect)(fsStub.mkdirSync.calledWith('/out/certs', {
+        recursive: true
+      })).to.equal(true);
+      (0, _chai.expect)(fsStub.writeFileSync.callCount).to.equal(2);
+      (0, _chai.expect)(fsStub.copyFileSync.calledOnce).to.equal(true);
+      (0, _chai.expect)(result.certPath).to.equal('/out/certs/issued.local.crt');
+      (0, _chai.expect)(result.keyPath).to.equal('/out/certs/issued.local.key');
+      (0, _chai.expect)(result.caCopyPath).to.equal('/out/certs/navy-root-ca.crt');
+    });
+    it('should sanitise unsafe characters in the output file base name', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      const result = await httpsModule.issueLeafCertForUrl('https://[::1]', '/out');
+      (0, _chai.expect)(result.certPath).to.equal('/out/___1_.crt');
+      (0, _chai.expect)(result.keyPath).to.equal('/out/___1_.key');
+    });
+    it('should wrap non-Error build failures in NavyError', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      pkiStub.certificateFromPem.callsFake(() => {
+        const failure = 'forge broke';
+        throw failure;
+      });
+      let caught;
+      try {
+        await httpsModule.issueLeafCertForUrl('https://issued.local', '/out');
+      } catch (err) {
+        caught = err;
+      }
+      (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+      (0, _chai.expect)(caught.message).to.equal('forge broke');
+    });
+    it('should wrap build failures in NavyError', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      pkiStub.certificateFromPem.throws(new Error('forge broke'));
+      let caught;
+      try {
+        await httpsModule.issueLeafCertForUrl('https://issued.local', '/out');
+      } catch (err) {
+        caught = err;
+      }
+      (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+      (0, _chai.expect)(caught.message).to.equal('forge broke');
+    });
+    it('should use IP SAN when issuing for an IP address URL', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.issueLeafCertForUrl('https://192.168.1.10', '/out');
+      const extensions = certObj.setExtensions.firstCall.args[0];
+      const sanExt = extensions.find(ext => ext.name === 'subjectAltName');
+      (0, _chai.expect)(sanExt.altNames).to.eql([{
+        type: 7,
+        ip: '192.168.1.10'
+      }]);
+    });
   });
 });

package/lib/util/__tests__/install-root-ca.js

@@ -0,0 +1,282 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+var _chai = require("chai");
+var _sinon = _interopRequireDefault(require("sinon"));
+var _proxyquire = _interopRequireDefault(require("proxyquire"));
+var _path = _interopRequireDefault(require("path"));
+var _errors = require("../../errors");
+/* eslint-env mocha */
+
+describe('util/install-root-ca', function () {
+  let sandbox;
+  let fsStub;
+  let osStub;
+  let execFileSyncStub;
+  let installRootCaModule;
+  let platformStub;
+  const caPath = '/tmp/navy/ca.crt';
+  function certutilPath(systemRoot = 'C:\\Windows') {
+    return _path.default.join(systemRoot, 'System32', 'certutil.exe');
+  }
+  function expectThrownMessage(fn, messagePattern) {
+    let caught;
+    try {
+      fn();
+    } catch (err) {
+      caught = err;
+    }
+    (0, _chai.expect)(caught).to.not.equal(undefined);
+    (0, _chai.expect)(String(caught.message)).to.match(messagePattern);
+  }
+  function loadModule() {
+    installRootCaModule = _proxyquire.default.noCallThru()('../install-root-ca', {
+      '../errors': {
+        NavyError: _errors.NavyError
+      },
+      fs: fsStub,
+      os: osStub,
+      child_process: {
+        execFileSync: execFileSyncStub
+      }
+    });
+  }
+  beforeEach(function () {
+    sandbox = _sinon.default.createSandbox();
+    fsStub = {
+      existsSync: sandbox.stub()
+    };
+    osStub = {
+      homedir: sandbox.stub().returns('/Users/tester')
+    };
+    execFileSyncStub = sandbox.stub();
+    platformStub = sandbox.stub(process, 'platform').value('darwin');
+    loadModule();
+  });
+  afterEach(function () {
+    sandbox.restore();
+  });
+  describe('caughtErrorMessage', function () {
+    it('should return nullish values as strings', function () {
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage(null)).to.equal('null');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage(undefined)).to.equal('undefined');
+    });
+    it('should return message text when it is present', function () {
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage({
+        message: 'object failed'
+      })).to.equal('object failed');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage(new Error('error failed'))).to.equal('error failed');
+    });
+    it('should fall back to String(e) when no usable message exists', function () {
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage('plain failure')).to.equal('plain failure');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage({})).to.equal('[object Object]');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage({
+        message: ''
+      })).to.equal('[object Object]');
+    });
+  });
+  describe('installRootCaToTrustStore', function () {
+    it('should throw when the CA file does not exist', function () {
+      fsStub.existsSync.returns(false);
+      expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /CA certificate not found/);
+    });
+    describe('macOS', function () {
+      beforeEach(function () {
+        platformStub.value('darwin');
+        fsStub.existsSync.callsFake(p => p === caPath || p.endsWith('login.keychain-db'));
+      });
+      it('should add the CA to the login keychain when found', function () {
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.calledOnce).to.equal(true);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal('security');
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1]).to.eql(['add-trusted-cert', '-d', '-r', 'trustRoot', '-k', '/Users/tester/Library/Keychains/login.keychain-db', caPath]);
+      });
+      it('should fall back to login.keychain when login.keychain-db is missing', function () {
+        fsStub.existsSync.callsFake(p => p === caPath || p.endsWith('login.keychain'));
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1][5]).to.equal('/Users/tester/Library/Keychains/login.keychain');
+      });
+      it('should throw when no login keychain can be found', function () {
+        fsStub.existsSync.callsFake(p => p === caPath);
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Could not find your macOS login keychain/);
+      });
+      it('should wrap security command failures in NavyError', function () {
+        execFileSyncStub.throws(new Error('security failed'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Could not add the Navy root CA/);
+      });
+      it('should use error.message when the thrown value exposes one', function () {
+        execFileSyncStub.throws({
+          message: 'security object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /security object failed/);
+      });
+      it('should stringify non-Error exec failures', function () {
+        execFileSyncStub.throws('plain failure');
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /plain failure/);
+      });
+      it('should stringify null exec failures', function () {
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+    });
+    describe('linux', function () {
+      beforeEach(function () {
+        platformStub.value('linux');
+        fsStub.existsSync.callsFake(p => p === caPath);
+      });
+      it('should install via update-ca-certificates on Debian-style systems', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.callCount).to.equal(2);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal('sudo');
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1]).to.eql(['cp', caPath, '/usr/local/share/ca-certificates/navy-dev-ca.crt']);
+        (0, _chai.expect)(execFileSyncStub.secondCall.args[1]).to.eql(['/usr/sbin/update-ca-certificates']);
+      });
+      it('should wrap Debian install failures in NavyError', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        execFileSyncStub.throws(new Error('sudo denied'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /update-ca-certificates/);
+      });
+      it('should use error.message for Debian install failures when present', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        execFileSyncStub.throws({
+          message: 'debian object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /debian object failed/);
+      });
+      it('should stringify null Debian install failures', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+      it('should install via update-ca-trust on Fedora-style systems', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.callCount).to.equal(2);
+        (0, _chai.expect)(execFileSyncStub.secondCall.args[1]).to.eql(['/usr/bin/update-ca-trust', 'extract']);
+      });
+      it('should wrap Fedora install failures in NavyError', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        execFileSyncStub.throws(new Error('trust failed'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /update-ca-trust/);
+      });
+      it('should use error.message for Fedora install failures when present', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        execFileSyncStub.throws({
+          message: 'fedora object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /fedora object failed/);
+      });
+      it('should stringify null Fedora install failures', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+      it('should throw when no supported Linux tooling is present', function () {
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Automatic Linux install needs/);
+      });
+    });
+    describe('windows', function () {
+      beforeEach(function () {
+        platformStub.value('win32');
+        fsStub.existsSync.callsFake(p => p === caPath);
+      });
+      it('should add the CA via certutil when available', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.calledOnce).to.equal(true);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal(certutil);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1]).to.eql(['-user', '-addstore', 'Root', caPath]);
+      });
+      it('should use SystemRoot from the environment when set', function () {
+        const previousSystemRoot = process.env.SystemRoot;
+        process.env.SystemRoot = 'D:\\WinRoot';
+        const certutil = certutilPath('D:\\WinRoot');
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        try {
+          installRootCaModule.installRootCaToTrustStore(caPath);
+          (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal(certutil);
+        } finally {
+          if (previousSystemRoot === undefined) {
+            delete process.env.SystemRoot;
+          } else {
+            process.env.SystemRoot = previousSystemRoot;
+          }
+        }
+      });
+      it('should throw when certutil.exe is missing', function () {
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /certutil.exe not found/);
+      });
+      it('should wrap certutil failures in NavyError', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        execFileSyncStub.throws(new Error('certutil failed'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Trusted Root store/);
+      });
+      it('should use error.message for certutil failures when present', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        execFileSyncStub.throws({
+          message: 'certutil object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /certutil object failed/);
+      });
+      it('should stringify null certutil failures', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+    });
+    it('should throw on unsupported platforms', function () {
+      platformStub.value('freebsd');
+      fsStub.existsSync.returns(true);
+      expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /not supported on freebsd/);
+    });
+  });
+});

package/lib/util/https.js

@@ -7,8 +7,13 @@ Object.defineProperty(exports, "__esModule", {
 exports.createCert = createCert;
 exports.generateRootCa = generateRootCa;
 exports.getCertsPath = getCertsPath;
+exports.hostNameFromIssueUrl = hostNameFromIssueUrl;
+exports.issueLeafCertForUrl = issueLeafCertForUrl;
 exports.removeCert = removeCert;
 var _path = _interopRequireDefault(require("path"));
+var _crypto = _interopRequireDefault(require("crypto"));
+var _net = _interopRequireDefault(require("net"));
+var _url = require("url");
 var _config = require("../config");
 var _errors = require("../errors");
 var _chalk = _interopRequireDefault(require("chalk"));
@@ -16,6 +21,136 @@ var _fs = _interopRequireDefault(require("fs"));
 var _nodeForge = require("node-forge");
 var _navy = require("../navy");
 const debug = require('debug')('navy:https');
+
+/** Random positive DER INTEGER serial (hex), for unique X.509 serialNumber fields. */
+function randomSerialHex(numBytes = 16) {
+  const buf = _crypto.default.randomBytes(numBytes);
+  buf[0] &= 0x7f;
+  return buf.toString('hex');
+}
+
+/** Hostname (or IP string) from a user-supplied URL for TLS CN/SAN. */
+function hostNameFromIssueUrl(urlString) {
+  const trimmed = (urlString || '').trim();
+  if (!trimmed) {
+    throw new _errors.NavyError('URL for --issue must not be empty.');
+  }
+  const withScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed) ? trimmed : `https://${trimmed}`;
+  let parsed;
+  try {
+    parsed = new _url.URL(withScheme);
+  } catch (e) {
+    throw new _errors.NavyError(`Invalid URL for --issue: ${urlString}`);
+  }
+  if (!parsed.hostname) {
+    throw new _errors.NavyError(`Could not determine a hostname from URL: ${urlString}`);
+  }
+  return parsed.hostname;
+}
+function safeCertFileBase(host) {
+  return host.replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+function subjectAltNamesForHost(host) {
+  if (_net.default.isIP(host)) {
+    return [{
+      type: 7,
+      ip: host
+    }];
+  }
+  return [{
+    type: 2,
+    value: host
+  }];
+}
+function buildSignedLeafPems(certName, tlsRootCaDir, sanAltNames) {
+  const caCertString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.crt`, 'utf8');
+  const caKeyString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.key`, 'utf8');
+  const privateCAKey = _nodeForge.pki.privateKeyFromPem(caKeyString);
+  const keys = _nodeForge.pki.rsa.generateKeyPair(2048);
+  const cert = _nodeForge.pki.createCertificate();
+  const caCert = _nodeForge.pki.certificateFromPem(caCertString);
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = randomSerialHex(16);
+  cert.validity.notBefore = new Date();
+  cert.validity.notBefore.setDate(cert.validity.notBefore.getDate() - 1);
+  cert.validity.notAfter = new Date();
+  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 2);
+  const attrs = [{
+    name: 'commonName',
+    value: certName
+  }, {
+    name: 'organizationName',
+    value: 'navy-dev'
+  }];
+  cert.setSubject(attrs);
+  cert.setIssuer(caCert.subject.attributes);
+  const caSubjectKeyId = caCert.generateSubjectKeyIdentifier().getBytes();
+  cert.setExtensions([{
+    name: 'basicConstraints',
+    cA: false,
+    critical: true
+  }, {
+    name: 'keyUsage',
+    digitalSignature: true,
+    keyEncipherment: true,
+    critical: true
+  }, {
+    name: 'extKeyUsage',
+    serverAuth: true
+  }, {
+    name: 'subjectAltName',
+    altNames: sanAltNames
+  }, {
+    name: 'subjectKeyIdentifier'
+  }, {
+    name: 'authorityKeyIdentifier',
+    keyIdentifier: caSubjectKeyId
+  }]);
+  cert.sign(privateCAKey, _nodeForge.md.sha256.create());
+  return {
+    privateKey: _nodeForge.pki.privateKeyToPem(keys.privateKey),
+    certificate: _nodeForge.pki.certificateToPem(cert)
+  };
+}
+
+/**
+ * Issues a leaf TLS certificate and key for an arbitrary host, signed with the Navy root CA,
+ * plus a copy of the root CA PEM for configuring trust / full chain on a non-Navy service.
+ */
+async function issueLeafCertForUrl(urlString, outputDir) {
+  const certName = hostNameFromIssueUrl(urlString);
+  const tlsRootCaDir = (0, _config.getConfig)().tlsRootCaDir || _config.DEFAULT_TLS_ROOT_CA_DIR;
+  await generateRootCa();
+  const out = _path.default.resolve(outputDir);
+  // $FlowIgnore
+  _fs.default.mkdirSync(out, {
+    recursive: true
+  });
+  const base = safeCertFileBase(certName);
+  const san = subjectAltNamesForHost(certName);
+  let pem;
+  try {
+    pem = buildSignedLeafPems(certName, tlsRootCaDir, san);
+  } catch (e) {
+    throw new _errors.NavyError(e instanceof Error ? e.message : String(e));
+  }
+  const certPath = _path.default.join(out, `${base}.crt`);
+  const keyPath = _path.default.join(out, `${base}.key`);
+  const caCertSrc = _path.default.join(tlsRootCaDir, 'ca.crt');
+  const caCopyPath = _path.default.join(out, 'navy-root-ca.crt');
+  _fs.default.writeFileSync(keyPath, pem.privateKey, {
+    mode: 0o600
+  });
+  _fs.default.writeFileSync(certPath, pem.certificate, {
+    mode: 0o644
+  });
+  _fs.default.copyFileSync(caCertSrc, caCopyPath);
+  return {
+    certPath,
+    keyPath,
+    caCopyPath
+  };
+}
 function getCertsPath(create = false) {
   const certsPath = _path.default.join((0, _config.getConfigDir)(), 'tls-certs');
   if (!_fs.default.existsSync(certsPath)) {
@@ -70,7 +205,7 @@ async function generateRootCa() {
   debug('Creating self-signed certificate...');
   const cert = _nodeForge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
-  cert.serialNumber = '01';
+  cert.serialNumber = randomSerialHex(8);
   cert.validity.notBefore = new Date();
   cert.validity.notAfter = new Date();
   cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 5);
@@ -83,13 +218,24 @@ async function generateRootCa() {
   }];
   cert.setSubject(attrs);
   cert.setIssuer(attrs);
+
+  // Trust stores (macOS keychain, NSS, Windows) expect a CA to assert keyCertSign (and
+  // usually cRLSign) on the issuer; leaf certs need SAN + keyUsage for modern TLS clients.
   cert.setExtensions([{
     name: 'basicConstraints',
-    cA: true
+    cA: true,
+    critical: true,
+    pathLenConstraint: 0
+  }, {
+    name: 'keyUsage',
+    keyCertSign: true,
+    cRLSign: true,
+    critical: true
   }, {
     name: 'subjectKeyIdentifier'
   }, {
-    name: 'authorityKeyIdentifier'
+    name: 'authorityKeyIdentifier',
+    keyIdentifier: true
   }]);
   try {
     // self-sign certificate
@@ -125,45 +271,25 @@ async function createCert(opts) {
     return;
   }
   await generateRootCa();
-  const caCertString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.crt`, 'utf8');
-  const caKeyString = _fs.default.readFileSync(`${tlsRootCaDir}/ca.key`, 'utf8');
   debug(`Generating cert for ${certName} in ${certsPath}`);
-  const privateCAKey = _nodeForge.pki.privateKeyFromPem(caKeyString);
-  const keys = _nodeForge.pki.rsa.generateKeyPair(2048);
-  const cert = _nodeForge.pki.createCertificate();
-  const caCert = _nodeForge.pki.certificateFromPem(caCertString);
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = Math.floor(Math.random() * (99 - 2) + 2).toString();
-  cert.validity.notBefore = new Date();
-  cert.validity.notBefore.setDate(cert.validity.notBefore.getDate() - 1);
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 2);
-  const attrs = [{
-    name: 'commonName',
-    value: certName
-  }, {
-    name: 'organizationName',
-    value: 'navy-dev'
-  }];
+  let commonName = certName;
+  if (opts.serviceUrl && !opts.hostName) {
+    try {
+      const hostname = new _url.URL(opts.serviceUrl).hostname;
+      if (hostname) {
+        commonName = hostname;
+      }
+    } catch (e) {
+      // keep commonName as certName
+    }
+  }
+  const san = subjectAltNamesForHost(commonName);
+  let pem;
   try {
-    cert.setSubject(attrs);
-    cert.setIssuer(caCert.subject.attributes);
-    cert.setExtensions([{
-      name: 'extKeyUsage',
-      serverAuth: true
-    }]);
-    cert.sign(privateCAKey, _nodeForge.md.sha256.create());
-
-    // PEM-format keys and cert
-    const pem = {
-      privateKey: _nodeForge.pki.privateKeyToPem(keys.privateKey),
-      certificate: _nodeForge.pki.certificateToPem(cert)
-      // publicKey: pki.publicKeyToPem(keys.publicKey),
-    };
-    _fs.default.writeFileSync(`${certsPath}/${certName}.key`, pem.privateKey);
-    _fs.default.writeFileSync(`${certsPath}/${certName}.crt`, pem.certificate);
-    // fs.writeFileSync(`${certsPath}/${certName}.pub.key`, pem.publicKey)
+    pem = buildSignedLeafPems(commonName, tlsRootCaDir, san);
   } catch (e) {
-    throw new _errors.NavyError(e);
+    throw new _errors.NavyError(e instanceof Error ? e.message : String(e));
   }
+  _fs.default.writeFileSync(`${certsPath}/${certName}.key`, pem.privateKey);
+  _fs.default.writeFileSync(`${certsPath}/${certName}.crt`, pem.certificate);
 }

package/lib/util/install-root-ca.js

@@ -0,0 +1,114 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.caughtErrorMessage = caughtErrorMessage;
+exports.installRootCaToTrustStore = installRootCaToTrustStore;
+var _child_process = require("child_process");
+var _fs = _interopRequireDefault(require("fs"));
+var _os = _interopRequireDefault(require("os"));
+var _path = _interopRequireDefault(require("path"));
+var _errors = require("../errors");
+function caughtErrorMessage(e) {
+  if (e == null) {
+    return String(e);
+  }
+  if (e.message != null && e.message !== '') {
+    return String(e.message);
+  }
+  return String(e);
+}
+function assertCaFile(caCrtPath) {
+  if (!_fs.default.existsSync(caCrtPath)) {
+    throw new _errors.NavyError(`CA certificate not found at ${caCrtPath}`);
+  }
+}
+function installMacOSUserTrust(caCrtPath) {
+  const home = _os.default.homedir();
+  const candidates = [_path.default.join(home, 'Library/Keychains/login.keychain-db'), _path.default.join(home, 'Library/Keychains/login.keychain')];
+  const keychain = candidates.find(p => _fs.default.existsSync(p));
+  if (!keychain) {
+    throw new _errors.NavyError('Could not find your macOS login keychain. Import the CA manually from Keychain Access:\n' + `  File → Import Items… → choose ${caCrtPath}\n` + 'Then double‑click the certificate and set “When using this certificate” to “Always Trust”.');
+  }
+  try {
+    (0, _child_process.execFileSync)('security', ['add-trusted-cert', '-d', '-r', 'trustRoot', '-k', keychain, caCrtPath], {
+      stdio: 'inherit'
+    });
+  } catch (e) {
+    const msg = caughtErrorMessage(e);
+    const hint = 'If this failed because the certificate is already installed, remove the old “navy-dev-ca” ' + 'entry from Keychain Access and run `navy https --setup` again.\n\n' + 'For a system‑wide trust store (requires an administrator password), run:\n' + `  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${caCrtPath}`;
+    throw new _errors.NavyError(`Could not add the Navy root CA to your login keychain.\n${hint}\n\n(${msg})`);
+  }
+}
+function installLinux(caCrtPath) {
+  const debianScript = '/usr/sbin/update-ca-certificates';
+  const fedoraScript = '/usr/bin/update-ca-trust';
+  if (_fs.default.existsSync(debianScript)) {
+    const dest = '/usr/local/share/ca-certificates/navy-dev-ca.crt';
+    try {
+      (0, _child_process.execFileSync)('sudo', ['cp', caCrtPath, dest], {
+        stdio: 'inherit'
+      });
+      (0, _child_process.execFileSync)('sudo', [debianScript], {
+        stdio: 'inherit'
+      });
+    } catch (e) {
+      const msg = caughtErrorMessage(e);
+      throw new _errors.NavyError('Could not install the Navy root CA using update-ca-certificates.\n' + `Copy ${caCrtPath} to ${dest} (with sudo) and run \`sudo update-ca-certificates\`, or consult your distro’s docs.\n\n(${msg})`);
+    }
+    return;
+  }
+  if (_fs.default.existsSync(fedoraScript)) {
+    const dest = '/etc/pki/ca-trust/source/anchors/navy-dev-ca.crt';
+    try {
+      (0, _child_process.execFileSync)('sudo', ['cp', caCrtPath, dest], {
+        stdio: 'inherit'
+      });
+      (0, _child_process.execFileSync)('sudo', [fedoraScript, 'extract'], {
+        stdio: 'inherit'
+      });
+    } catch (e) {
+      const msg = caughtErrorMessage(e);
+      throw new _errors.NavyError('Could not install the Navy root CA using update-ca-trust.\n' + `Copy ${caCrtPath} to ${dest} (with sudo) and run \`sudo update-ca-trust extract\`.\n\n(${msg})`);
+    }
+    return;
+  }
+  throw new _errors.NavyError('Automatic Linux install needs `update-ca-certificates` (Debian/Ubuntu) or `update-ca-trust` (Fedora/RHEL).\n' + 'Install the CA yourself, for example:\n' + `  sudo cp ${caCrtPath} /usr/local/share/ca-certificates/navy-dev-ca.crt && sudo update-ca-certificates`);
+}
+function installWindows(caCrtPath) {
+  const systemRoot = process.env.SystemRoot || 'C:\\Windows';
+  const certutil = _path.default.join(systemRoot, 'System32', 'certutil.exe');
+  if (!_fs.default.existsSync(certutil)) {
+    throw new _errors.NavyError(`certutil.exe not found under ${systemRoot}. Import ${caCrtPath} manually:\n` + '  certmgr.msc → Trusted Root Certification Authorities → Certificates → right‑click → All Tasks → Import');
+  }
+  try {
+    (0, _child_process.execFileSync)(certutil, ['-user', '-addstore', 'Root', caCrtPath], {
+      stdio: 'inherit'
+    });
+  } catch (e) {
+    const msg = caughtErrorMessage(e);
+    throw new _errors.NavyError('Could not add the Navy root CA to the current user’s Trusted Root store.\n' + `Open certmgr.msc and import ${caCrtPath} under Trusted Root Certification Authorities.\n\n(${msg})`);
+  }
+}
+
+/**
+ * Installs the Navy development root CA into the OS trust store where supported
+ * (macOS login keychain, Debian/Ubuntu update-ca-certificates, Fedora/RHEL update-ca-trust,
+ * Windows per-user Trusted Roots). May invoke sudo on Linux.
+ */
+function installRootCaToTrustStore(caCrtPath) {
+  const abs = _path.default.resolve(caCrtPath);
+  assertCaFile(abs);
+  const platform = process.platform;
+  if (platform === 'darwin') {
+    installMacOSUserTrust(abs);
+  } else if (platform === 'linux') {
+    installLinux(abs);
+  } else if (platform === 'win32') {
+    installWindows(abs);
+  } else {
+    throw new _errors.NavyError(`Automatic root CA install is not supported on ${platform}. Trust ${abs} manually as a root CA.`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "navy",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "description": "Quick and powerful development environments using Docker and Docker Compose",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",