self-sign 5.6.7

package/test/ca-signing.js

@@ -0,0 +1,242 @@
+var { assert } = require('chai');
+var crypto = require('crypto');
+
+describe('CA signing', function () {
+  var generate = require('../index').generate;
+
+  it('should generate certificate signed by provided CA', async function () {
+    // First generate a self-signed CA certificate
+    const ca = await generate([
+      { name: 'commonName', value: 'Test CA' },
+      { name: 'organizationName', value: 'Test Organization' }
+    ], {
+      algorithm: 'sha256'
+    },null);
+
+    // Generate a certificate signed by the CA
+    const pems = await generate([
+      { name: 'commonName', value: 'localhost' }
+    ], {
+      algorithm: 'sha256',
+      ca: {
+        key: ca.private,
+        cert: ca.cert
+      }
+    },null);
+
+    assert.ok(!!pems.private, 'has a private key');
+    assert.ok(!!pems.public, 'has a public key');
+    assert.ok(!!pems.cert, 'has a certificate');
+    assert.ok(!!pems.fingerprint, 'has fingerprint');
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    const caCert = new crypto.X509Certificate(ca.cert);
+
+    // Verify issuer is the CA, not self-signed
+    assert.include(cert.issuer, 'CN=Test CA', 'issuer should be the CA');
+    assert.include(cert.subject, 'CN=localhost', 'subject should be localhost');
+    assert.notEqual(cert.issuer, cert.subject, 'should not be self-signed');
+
+    // Verify the certificate is signed by the CA
+    assert.isTrue(cert.verify(caCert.publicKey), 'certificate should be verified by CA public key');
+  });
+
+  it('should include Subject Alternative Name extension', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256'
+    },null);
+
+    const pems = await generate([
+      { name: 'commonName', value: 'example.com' }
+    ], {
+      algorithm: 'sha256',
+      ca: { key: ca.private, cert: ca.cert }
+    },null);
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.include(cert.subjectAltName, 'DNS:example.com', 'should have DNS SAN matching CN');
+  });
+
+  it('should include IP SAN for localhost', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256'
+    },null);
+
+    const pems = await generate([
+      { name: 'commonName', value: 'localhost' }
+    ], {
+      algorithm: 'sha256',
+      ca: { key: ca.private, cert: ca.cert }
+    },null);
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.include(cert.subjectAltName, 'DNS:localhost', 'should have DNS SAN');
+    assert.include(cert.subjectAltName, 'IP Address:127.0.0.1', 'should have IP SAN for localhost');
+  });
+
+  it('should support different hash algorithms with CA signing', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256'
+    },null);
+
+    // Test sha384
+    const pems384 = await generate([{ name: 'commonName', value: 'test384.local' }], {
+      algorithm: 'sha384',
+      ca: { key: ca.private, cert: ca.cert }
+    },null);
+
+    const cert384 = new crypto.X509Certificate(pems384.cert);
+    assert.ok(cert384.publicKey, 'should generate sha384 CA-signed cert');
+
+    // Test sha512
+    const pems512 = await generate([{ name: 'commonName', value: 'test512.local' }], {
+      algorithm: 'sha512',
+      ca: { key: ca.private, cert: ca.cert }
+    },null);
+
+    const cert512 = new crypto.X509Certificate(pems512.cert);
+    assert.ok(cert512.publicKey, 'should generate sha512 CA-signed cert');
+  });
+
+  it('should respect notAfterDate option with CA signing', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256'
+    },null);
+
+    const notBefore = new Date('2025-01-01T00:00:00Z');
+    const notAfter = new Date('2025-01-31T00:00:00Z'); // 30 days validity
+    const pems = await generate([{ name: 'commonName', value: 'short-lived.local' }], {
+      algorithm: 'sha256',
+      notBeforeDate: notBefore,
+      notAfterDate: notAfter,
+      ca: { key: ca.private, cert: ca.cert }
+    });
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    const validFrom = new Date(cert.validFrom);
+    const validTo = new Date(cert.validTo);
+
+    assert.approximately(validFrom.getTime(), notBefore.getTime(), 5000, 'should use custom notBeforeDate');
+    assert.approximately(validTo.getTime(), notAfter.getTime(), 5000, 'should use custom notAfterDate');
+  });
+
+  it('should generate unique certificates with same CA', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256'
+    });
+
+    const pems1 = await generate([{ name: 'commonName', value: 'test1.local' }], {
+      algorithm: 'sha256',
+      ca: { key: ca.private, cert: ca.cert }
+    });
+
+    const pems2 = await generate([{ name: 'commonName', value: 'test2.local' }], {
+      algorithm: 'sha256',
+      ca: { key: ca.private, cert: ca.cert }
+    });
+
+    const cert1 = new crypto.X509Certificate(pems1.cert);
+    const cert2 = new crypto.X509Certificate(pems2.cert);
+
+    assert.notEqual(cert1.serialNumber, cert2.serialNumber, 'serial numbers should be unique');
+    assert.notEqual(pems1.private, pems2.private, 'private keys should be different');
+  });
+
+  it('should work with custom keySize and CA signing', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256',
+      keySize: 4096
+    });
+
+    const pems = await generate([{ name: 'commonName', value: 'bigkey.local' }], {
+      algorithm: 'sha256',
+      keySize: 4096,
+      ca: { key: ca.private, cert: ca.cert }
+    });
+
+    const privateKey = crypto.createPrivateKey(pems.private);
+    assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 4096, 'should use custom key size');
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    const caCert = new crypto.X509Certificate(ca.cert);
+    assert.isTrue(cert.verify(caCert.publicKey), 'certificate should verify with CA');
+  });
+
+  it('should support existing keyPair with CA signing', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256'
+    });
+
+    // Generate a key pair first
+    const keyPair = await generate([{ name: 'commonName', value: 'keypair.local' }], {
+      algorithm: 'sha256'
+    });
+
+    // Use existing key pair with CA signing
+    const pems = await generate([{ name: 'commonName', value: 'reused.local' }], {
+      algorithm: 'sha256',
+      keyPair: {
+        privateKey: keyPair.private,
+        publicKey: keyPair.public
+      },
+      ca: { key: ca.private, cert: ca.cert }
+    });
+
+    assert.strictEqual(pems.private, keyPair.private, 'should use provided private key');
+    assert.strictEqual(pems.public, keyPair.public, 'should use provided public key');
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    const caCert = new crypto.X509Certificate(ca.cert);
+    assert.isTrue(cert.verify(caCert.publicKey), 'certificate should verify with CA');
+  });
+
+  it('should include proper extended key usage extensions', async function () {
+    const ca = await generate([{ name: 'commonName', value: 'Test CA' }], {
+      algorithm: 'sha256'
+    });
+
+    const pems = await generate([{ name: 'commonName', value: 'server.local' }], {
+      algorithm: 'sha256',
+      ca: { key: ca.private, cert: ca.cert }
+    });
+
+    const cert = new crypto.X509Certificate(pems.cert);
+
+    // Check extended key usage (OIDs)
+    // 1.3.6.1.5.5.7.3.1 = serverAuth
+    // 1.3.6.1.5.5.7.3.2 = clientAuth
+    assert.include(cert.keyUsage, '1.3.6.1.5.5.7.3.1', 'should have serverAuth extended key usage');
+    assert.include(cert.keyUsage, '1.3.6.1.5.5.7.3.2', 'should have clientAuth extended key usage');
+  });
+
+  it('should work with PKCS#1 RSA key format', async function () {
+    // Generate a CA with PKCS#1 format key (like mkcert uses)
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 2048,
+      privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
+      publicKeyEncoding: { type: 'spki', format: 'pem' }
+    });
+
+    // Create a self-signed CA cert using the PKCS#1 key
+    const ca = await generate([{ name: 'commonName', value: 'PKCS1 CA' }], {
+      algorithm: 'sha256'
+    });
+
+    // Now test that we can use a PKCS#1 formatted key as CA
+    // Convert our generated key to PKCS#1 for testing
+    const caKeyObject = crypto.createPrivateKey(ca.private);
+    const pkcs1Key = caKeyObject.export({ type: 'pkcs1', format: 'pem' });
+
+    const pems = await generate([{ name: 'commonName', value: 'pkcs1-test.local' }], {
+      algorithm: 'sha256',
+      ca: {
+        key: pkcs1Key,
+        cert: ca.cert
+      }
+    });
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    const caCert = new crypto.X509Certificate(ca.cert);
+    assert.isTrue(cert.verify(caCert.publicKey), 'should work with PKCS#1 key format');
+  });
+});

package/test/ec-keys.js

@@ -0,0 +1,142 @@
+var { assert } = require('chai');
+var crypto = require('crypto');
+
+describe('EC keys', function () {
+  var generate = require('../index').generate;
+
+  it('should generate EC certificate with P-256 curve (default)', async function () {
+    var pems = await generate(null, { keyType: 'ec' },null);
+
+    assert.ok(!!pems.private, 'has a private key');
+    assert.ok(!!pems.public, 'has a public key');
+    assert.ok(!!pems.cert, 'has a certificate');
+    assert.ok(!!pems.fingerprint, 'has fingerprint');
+
+    const privateKey = crypto.createPrivateKey(pems.private);
+    assert.strictEqual(privateKey.asymmetricKeyType, 'ec', 'should be EC key');
+    assert.strictEqual(privateKey.asymmetricKeyDetails.namedCurve, 'prime256v1', 'should use P-256 curve');
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.ok(cert.subject, 'cert has a subject');
+  });
+
+  it('should generate EC certificate with P-384 curve', async function () {
+    var pems = await generate(null, { keyType: 'ec', curve: 'P-384' },null);
+
+    const privateKey = crypto.createPrivateKey(pems.private);
+    assert.strictEqual(privateKey.asymmetricKeyType, 'ec', 'should be EC key');
+    assert.strictEqual(privateKey.asymmetricKeyDetails.namedCurve, 'secp384r1', 'should use P-384 curve');
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.ok(cert.publicKey, 'can generate P-384 EC certs');
+  });
+
+  it('should generate EC certificate with P-521 curve', async function () {
+    var pems = await generate(null, { keyType: 'ec', curve: 'P-521' },null);
+
+    const privateKey = crypto.createPrivateKey(pems.private);
+    assert.strictEqual(privateKey.asymmetricKeyType, 'ec', 'should be EC key');
+    assert.strictEqual(privateKey.asymmetricKeyDetails.namedCurve, 'secp521r1', 'should use P-521 curve');
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.ok(cert.publicKey, 'can generate P-521 EC certs');
+  });
+
+  it('should generate valid EC key pair that work together', async function () {
+    var pems = await generate(null, { keyType: 'ec', curve: 'P-256' },null);
+
+    const testData = 'Hello, World!';
+
+    const privateKey = crypto.createPrivateKey(pems.private);
+    const publicKey = crypto.createPublicKey(pems.public);
+
+    // Sign with private key
+    const sign = crypto.createSign('SHA256');
+    sign.update(testData);
+    sign.end();
+    const signature = sign.sign(privateKey);
+
+    // Verify with public key
+    const verify = crypto.createVerify('SHA256');
+    verify.update(testData);
+    verify.end();
+    const isValid = verify.verify(publicKey, signature);
+
+    assert.isTrue(isValid, 'EC public key should verify signature from EC private key');
+  });
+
+  it('should support EC with sha256 algorithm', async function () {
+    var pems = await generate(null, { keyType: 'ec', algorithm: 'sha256' },null);
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.ok(cert.publicKey, 'can generate EC cert with sha256');
+  });
+
+  it('should support EC with sha384 algorithm', async function () {
+    var pems = await generate(null, { keyType: 'ec', curve: 'P-384', algorithm: 'sha384' },null);
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.ok(cert.publicKey, 'can generate EC cert with sha384');
+  });
+
+  it('should support EC with sha512 algorithm', async function () {
+    var pems = await generate(null, { keyType: 'ec', curve: 'P-521', algorithm: 'sha512' },null);
+
+    const cert = new crypto.X509Certificate(pems.cert);
+    assert.ok(cert.publicKey, 'can generate EC cert with sha512');
+  });
+
+  it('should generate EC client certificate', async function () {
+    var pems = await generate(null, { keyType: 'ec', clientCertificate: true },null);
+
+    assert.ok(!!pems.clientcert, 'should include a client cert');
+    assert.ok(!!pems.clientprivate, 'should include a client private key');
+    assert.ok(!!pems.clientpublic, 'should include a client public key');
+
+    const clientPrivateKey = crypto.createPrivateKey(pems.clientprivate);
+    assert.strictEqual(clientPrivateKey.asymmetricKeyType, 'ec', 'client key should be EC');
+  });
+
+  it('should support passphrase with EC keys', async function () {
+    const passphrase = 'ec-secret-passphrase';
+    var pems = await generate(null, { keyType: 'ec', passphrase: passphrase },null);
+
+    assert.include(pems.private, 'ENCRYPTED', 'EC private key should be encrypted');
+
+    const privateKey = crypto.createPrivateKey({
+      key: pems.private,
+      passphrase: passphrase
+    });
+    assert.strictEqual(privateKey.asymmetricKeyType, 'ec', 'decrypted key should be EC');
+  });
+
+  it('should support using existing EC keyPair', async function () {
+    const firstPems = await generate(null, { keyType: 'ec', curve: 'P-256' },null);
+
+    const secondPems = await generate(null, {
+      keyType: 'ec',
+      curve: 'P-256',
+      keyPair: {
+        privateKey: firstPems.private,
+        publicKey: firstPems.public
+      }
+    },null);
+
+    assert.strictEqual(firstPems.private, secondPems.private, 'should use provided EC private key');
+    assert.strictEqual(firstPems.public, secondPems.public, 'should use provided EC public key');
+  });
+
+  it('should support custom attributes with EC', async function () {
+    const attrs = [
+      { name: 'commonName', value: 'ec-test.example.com' },
+      { name: 'countryName', value: 'US' },
+      { name: 'organizationName', value: 'EC Test Corp' }
+    ];
+
+    var pems = await generate(attrs, { keyType: 'ec' },null);
+    const cert = new crypto.X509Certificate(pems.cert);
+
+    assert.include(cert.subject, 'CN=ec-test.example.com', 'should include custom CN');
+    assert.include(cert.subject, 'O=EC Test Corp', 'should include custom organization');
+  });
+});