socket-function 0.8.33 → 0.8.35

package/SocketFunction.ts

@@ -28,7 +28,6 @@ export class SocketFunction {
         type: "gzip";
     };
     public static httpETagCache = false;
-    public static rejectUnauthorized = true;
 
     public static register<
         ClassInstance extends object,
@@ -129,11 +128,12 @@ export class SocketFunction {
     }
 
     public static mountedNodeId: string = "NOTMOUNTED";
-    public static async mount(config: SocketServerConfig) {
+    public static async mount(config: SocketServerConfig & { nodeId: string }) {
         if (this.mountedNodeId !== "NOTMOUNTED") {
             throw new Error("SocketFunction already mounted, mounting twice in one thread is not allowed.");
         }
-        this.mountedNodeId = await startSocketServer(config);
+        this.mountedNodeId = config.nodeId;
+        await startSocketServer(config);
         return this.mountedNodeId;
     }
 

package/SocketFunctionTypes.ts

@@ -1,11 +1,5 @@
 module.allowclient = true;
 
-import debugbreak from "debugbreak";
-import * as tls from "tls";
-import { SenderInterface } from "./src/CallFactory";
-import { isNode } from "./src/misc";
-import { CertInfo, getNodeIdFromCert } from "./src/nodeAuthentication";
-import { getClientNodeId } from "./src/nodeCache";
 import { getCallObj } from "./src/nodeProxy";
 import { Args, MaybePromise } from "./src/types";
 
@@ -52,14 +46,14 @@ export interface SocketFunctionHook<ExposedType extends SocketExposedInterface =
     (config: HookContext<ExposedType, CallContext>): MaybePromise<void>;
 }
 export type HookContext<ExposedType extends SocketExposedInterface = SocketExposedInterface, CallContext extends CallContextType = CallContextType> = {
-    call: CallType;
+    call: FullCallType;
     context: SocketRegistered<ExposedType, CallContext>["context"];
     // If the result is overriden, we continue evaluating hooks BUT DO NOT perform the final call
     overrideResult?: unknown;
 };
 
 export type ClientHookContext<ExposedType extends SocketExposedInterface = SocketExposedInterface, CallContext extends CallContextType = CallContextType> = {
-    call: CallType;
+    call: FullCallType;
     /** If the calls takes longer than this (for ANY reason), we return with an error.
      *      - Different from reconnectTimeout, which only errors if we lose the connection.
     */
@@ -101,15 +95,6 @@ export type CallerContextBase = {
     //      a more permanent identity, you must derive it from certInfo yourself.
     nodeId: string;
 
-    /** Gives further info on the node. When we set this, we always make sure it has a verified
-     *      issuer. It may be set by app code, which should make sure the issuer is verified (not
-     *      necessarily by the machine, but just in some sense, 'verified', to secure the common name
-     *      of the cert and prevent anyone from using the same common name as someone else).
-     *  IF set, is directly used to derive nodeId (by nodeAuthentication.ts)
-     */
-    certInfo: CertInfo | undefined;
-    updateCertInfo?: (certInfo: CertInfo, callbackPort: number | undefined) => void;
-
     // The nodeId they contacted. This is useful to determine their intention (otherwise
     //  requests can be redirected to us and would accept them, even though they are being
     //  blatantly MITMed).

package/hot/HotReloadController.ts

@@ -1,3 +1,5 @@
+/// <reference path="../../typenode/index.d.ts" />
+/// <reference path="../require/RequireController.ts" />
 module.allowclient = true;
 
 import { SocketFunction } from "../SocketFunction";

package/index.d.ts

@@ -0,0 +1 @@
+/// <reference path="../typenode/index.d.ts" />

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "0.8.33",
+	"version": "0.8.35",
 	"main": "index.js",
 	"license": "MIT",
 	"note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -10,11 +10,10 @@
 		"@types/node-forge": "^1.3.1",
 		"@types/ws": "^8.5.3",
 		"cookie": "^0.5.0",
-		"debugbreak": "^0.6.5",
 		"mobx": "^6.6.2",
 		"node-forge": "https://github.com/sliftist/forge#name",
 		"preact": "^10.10.6",
-		"typenode": "^4.9.4",
+		"typenode": "^4.9.4-a",
 		"ws": "^8.8.0"
 	},
 	"scripts": {
@@ -22,6 +21,7 @@
 		"type": "yarn tsc --noEmit"
 	},
 	"devDependencies": {
+		"debugbreak": "^0.6.5",
 		"typedev": "^0.1.0"
 	}
 }

package/require/RequireController.ts

@@ -216,7 +216,7 @@ class RequireControllerBase {
             //require(rootPath);
             let clientModule = require.cache[resolvedPath];
             if (!clientModule) {
-                clientModule = createNotFoundModule(`Module ${pathRequest} (resolved to ${resolvedPath}) was not included serverside.`);
+                clientModule = createNotFoundModule(`Module ${pathRequest} (resolved to ${JSON.stringify(resolvedPath)}) was not included serverside. Resolve root ${JSON.stringify(this.rootResolvePath)} (set by call to setRequireBootRequire), resolve search paths: ${JSON.stringify(searchPaths)})}`);
             }
             if (!clientModule.allowclient) {
                 clientModule = createNotFoundModule(`Module ${pathRequest} (resolved to ${resolvedPath}) is not allowed clientside (set module.allowclient in it, or call setFlag when it is imported).`);

package/src/CallFactory.ts

@@ -1,8 +1,8 @@
-import { CallerContext, CallerContextBase, CallType } from "../SocketFunctionTypes";
+import { CallerContext, CallerContextBase, CallType, FullCallType } from "../SocketFunctionTypes";
 import * as ws from "ws";
 import { performLocalCall } from "./callManager";
 import { convertErrorStackToError, formatNumberSuffixed, isNode } from "./misc";
-import { createWebsocketFactory, getNodeIdFromCert, getTLSSocket } from "./nodeAuthentication";
+import { createWebsocketFactory, getTLSSocket } from "./nodeAuthentication";
 import { SocketFunction } from "../SocketFunction";
 import { gzip } from "zlib";
 import * as tls from "tls";
@@ -10,7 +10,7 @@ import { getClientNodeId, getNodeIdLocation, registerNodeClient } from "./nodeCa
 
 const retryInterval = 2000;
 
-type InternalCallType = CallType & {
+type InternalCallType = FullCallType & {
     seqNum: number;
     isReturn: false;
     compress: boolean;
@@ -77,16 +77,7 @@ export async function createCallFactory(
 
     let callerContext: CallerContextBase = {
         nodeId,
-        localNodeId,
-        certInfo: webSocketBase?.socket?.getPeerCertificate(true),
-        updateCertInfo: (certRaw, port) => {
-            let nodeId = getNodeIdFromCert(certRaw, port);
-            if (!nodeId) {
-                return;
-            }
-            callerContext.nodeId = nodeId;
-            callerContext.certInfo = certRaw;
-        }
+        localNodeId
     };
 
     let callFactory: CallFactory = {
@@ -99,6 +90,7 @@ export async function createCallFactory(
 
             let seqNum = nextSeqNum++;
             let fullCall: InternalCallType = {
+                nodeId,
                 isReturn: false,
                 args: call.args,
                 classGuid: call.classGuid,

package/src/callHTTPHandler.ts

@@ -1,6 +1,6 @@
 import http from "http";
 import tls from "tls";
-import { CallerContext, CallType } from "../SocketFunctionTypes";
+import { CallerContext, CallType, FullCallType } from "../SocketFunctionTypes";
 import { isDataImmutable, performLocalCall } from "./callManager";
 import { SocketFunction } from "../SocketFunction";
 import { gzip } from "zlib";
@@ -79,7 +79,6 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
 
         let caller: CallerContext = {
             nodeId,
-            certInfo: undefined,
             localNodeId,
         };
 
@@ -112,7 +111,8 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
             args = JSON.parse(payload.toString())["args"] as unknown[];
         }
 
-        let call: CallType = {
+        let call: FullCallType = {
+            nodeId,
             classGuid,
             functionName,
             args,

package/src/callManager.ts

@@ -1,4 +1,4 @@
-import { CallContextType, CallerContext, CallType, ClientHookContext, HookContext, SocketExposedInterface, SocketExposedInterfaceClass, SocketExposedShape, SocketFunctionClientHook, SocketFunctionHook, SocketRegistered } from "../SocketFunctionTypes";
+import { CallContextType, CallerContext, CallType, ClientHookContext, FullCallType, HookContext, SocketExposedInterface, SocketExposedInterfaceClass, SocketExposedShape, SocketFunctionClientHook, SocketFunctionHook, SocketRegistered } from "../SocketFunctionTypes";
 import { _setSocketContext } from "../SocketFunction";
 
 let classes: {
@@ -14,7 +14,7 @@ let globalClientHooks: SocketFunctionClientHook[] = [];
 
 export async function performLocalCall(
     config: {
-        call: CallType;
+        call: FullCallType;
         caller: CallerContext;
     }
 ): Promise<unknown> {
@@ -92,7 +92,7 @@ export function unregisterGlobalClientHook(hook: SocketFunctionClientHook) {
 }
 
 export async function runClientHooks(
-    callType: CallType,
+    callType: FullCallType,
     hooks: SocketExposedShape[""],
 ): Promise<ClientHookContext> {
     let context: ClientHookContext = { call: callType };
@@ -106,7 +106,7 @@ export async function runClientHooks(
 }
 
 async function runServerHooks(
-    callType: CallType,
+    callType: FullCallType,
     context: SocketRegistered["context"],
     hooks: SocketExposedShape[""],
 ): Promise<HookContext> {

package/src/certStore.ts

@@ -1,50 +1,24 @@
-import * as os from "os";
-import * as fs from "fs/promises";
-import * as fsSync from "fs";
-import * as child_process from "child_process";
 import * as tls from "tls";
-import { SocketFunction } from "../SocketFunction";
-import { isNode, isNodeTrue, sha256Hash } from "./misc";
-import { lazy } from "./caching";
 
 let trustedCerts = new Set<string>();
-let loadedTrustedCerts = false;
 let watchCallbacks = new Set<(certs: string[]) => void>();
 
-let storePath = isNodeTrue() && process.argv[1].replaceAll("\\", "/").split("/").slice(0, -1).join("/") + "/certstore/";
-if (isNode()) {
-    if (!fsSync.existsSync(storePath)) {
-        fsSync.mkdirSync(storePath);
-    }
-}
-
 /** Must be populated before the server starts */
-export async function trustUserCertificate(cert: string) {
+export function trustCertificate(cert: string | Buffer) {
+    cert = cert.toString();
     if (trustedCerts.has(cert)) return;
     trustedCerts.add(cert);
-    await fs.writeFile(storePath + sha256Hash(Buffer.from(cert)) + ".cer", cert);
-    let certs = getTrustedUserCertificates();
+    let certs = getTrustedCertificates();
     for (let callback of watchCallbacks) {
         callback(certs);
     }
 }
-export const loadTrustedUserCertificates = lazy(async () => {
-    let files = await fs.readdir(storePath);
-    for (let file of files) {
-        let cert = await fs.readFile(storePath + file, "utf8");
-        trustedCerts.add(cert);
-    }
-    loadedTrustedCerts = true;
-});
-export function getTrustedUserCertificates(): string[] {
-    if (!loadedTrustedCerts) {
-        throw new Error("Must call loadTrustedUserCertificates (and await it) before calling getTrustedUserCertificates");
-    }
-    return Array.from(trustedCerts);
+export function getTrustedCertificates(): string[] {
+    return tls.rootCertificates.concat(Array.from(trustedCerts));
 }
 
-export function watchUserCertificates(callback: (certs: string[]) => void) {
+export function watchTrustedCertificates(callback: (certs: string[]) => void) {
     watchCallbacks.add(callback);
-    callback(getTrustedUserCertificates());
+    callback(getTrustedCertificates());
     return () => watchCallbacks.delete(callback);
 }

package/src/nodeAuthentication.ts

@@ -1,88 +1,15 @@
 import ws from "ws";
 import tls from "tls";
-import net from "net";
-import { getAppFolder } from "./storagePath";
-import fs from "fs";
-import child_process from "child_process";
-import { cacheWeak, lazy } from "./caching";
-import https from "https";
-import debugbreak from "debugbreak";
-import crypto from "crypto";
-import { isNode, sha256Hash } from "./misc";
-import { getArgs } from "./args";
+import { isNode } from "./misc";
 import { SenderInterface } from "./CallFactory";
-import { SocketFunction } from "../SocketFunction";
-import { getTrustedUserCertificates } from "./certStore";
-import { getClientNodeId, getNodeId, getNodeIdLocation } from "./nodeCache";
+import { getTrustedCertificates } from "./certStore";
+import { getNodeIdLocation } from "./nodeCache";
 
-export type CertInfo = { raw: Buffer | string; issuerCertificate: { raw: Buffer | string } };
-
-let certKeyPairOverride: { key: Buffer; cert: Buffer } | undefined;
-export function getCertKeyPair(): { key: Buffer; cert: Buffer } {
-    if (certKeyPairOverride) return certKeyPairOverride;
-    return getCertKeyPairBase();
-}
-const getCertKeyPairBase = lazy((): { key: Buffer; cert: Buffer } => {
-    // https://nodejs.org/en/knowledge/HTTP/servers/how-to-create-a-HTTPS-server/
-
-    let folder = getAppFolder();
-    let identityPrefix = getArgs().identity || "";
-    let keyPath = folder + identityPrefix + "key.pem";
-    let certPath = folder + identityPrefix + "cert.pem";
-    if (!fs.existsSync(keyPath) || !fs.existsSync(certPath)) {
-        child_process.execSync(`openssl genrsa -out "${keyPath}"`);
-        child_process.execSync(`openssl req -new -key "${keyPath}" -out csr.pem -subj "/CN=notused"`);
-        child_process.execSync(`openssl x509 -req -days 9999 -in csr.pem -signkey "${keyPath}" -out "${certPath}"`);
-        fs.rmSync("csr.pem");
-    }
-
-    let key = fs.readFileSync(keyPath);
-    let cert = fs.readFileSync(certPath);
-    return { key, cert };
-});
-
-export function overrideCertKeyPair<T>(certKey: { key: Buffer; cert: Buffer; }, code: () => T): T {
-    if (!isNode()) {
-        throw new Error(`Cannot override cert/key pair in browser`);
-    }
-    let prevOverride = certKeyPairOverride;
-    certKeyPairOverride = certKey;
-    try {
-        return code();
-    } finally {
-        certKeyPairOverride = prevOverride;
-    }
-}
 
 export function getTLSSocket(webSocket: ws.WebSocket) {
     return (webSocket as any)._socket as tls.TLSSocket;
 }
 
-export async function getOwnNodeId() {
-    if (!isNode()) {
-        throw new Error(`Clientside nodeIds are not exposed to the client`);
-    }
-
-    // This is BASICALLY just sha256Hash(getCertKeyPari().cert), however... I'm not 100% the format
-    //  is the same, we would have to verify it. It isn't that important, other nodes know our nodeId,
-    //  and clients don't really have a reason to use this anyway (they can't verify it, they can only
-    //  really verify with a location).
-    throw new Error(`TODO: Implement getOwnNodeId`);
-}
-
-export function getNodeIdFromCert(certRaw: { raw: Buffer | string } | undefined, callbackPort: number | undefined) {
-    if (!certRaw?.raw) return undefined;
-    let cert = new crypto.X509Certificate(certRaw.raw);
-    if (!callbackPort) {
-        return getClientNodeId(cert.subject);
-    }
-    let subject = cert.subject;
-    if (subject.startsWith("CN=")) {
-        subject = subject.slice("CN=".length);
-    }
-    return getNodeId(subject, callbackPort);
-}
-
 /** NOTE: We create a factory, which embeds the key/cert information. Otherwise retries might use
  *      a different key/cert context.
  */
@@ -98,8 +25,6 @@ export function createWebsocketFactory(): (nodeId: string) => SenderInterface {
             return new WebSocket(`wss://${address}:${port}`);
         };
     } else {
-        let { key, cert } = getCertKeyPair();
-        let rejectUnauthorized = SocketFunction.rejectUnauthorized;
         return (nodeId: string) => {
             let location = getNodeIdLocation(nodeId);
             if (!location) throw new Error(`Cannot connect to ${nodeId}, no address known`);
@@ -107,10 +32,7 @@ export function createWebsocketFactory(): (nodeId: string) => SenderInterface {
 
             console.log(`Connecting to ${address}:${port}`);
             let webSocket = new ws.WebSocket(`wss://${address}:${port}`, {
-                cert,
-                key,
-                rejectUnauthorized,
-                ca: tls.rootCertificates.concat(getTrustedUserCertificates()),
+                ca: tls.rootCertificates.concat(getTrustedCertificates()),
             });
             let result = Object.assign(webSocket, { socket: undefined as tls.TLSSocket | undefined });
             webSocket.once("upgrade", e => {

package/src/tlsParsing.ts

@@ -0,0 +1,97 @@
+export function parseTLSHello(buffer: Buffer): {
+    extensions: {
+        type: number;
+        data: Buffer;
+    }[];
+} {
+    let output: {
+        extensions: {
+            type: number;
+            data: Buffer;
+        }[];
+    } = {
+        extensions: []
+    };
+
+    try {
+        let pos = 0;
+
+        function readShort() {
+            let high = buffer[pos++];
+            let low = buffer[pos++];
+            return high * 256 + low;
+        }
+
+        let type = buffer[pos++];
+        let version = readShort();
+
+        var contentLength = readShort();
+
+        let clientMessageType = buffer[pos++];
+        // High length byte (how would this be used if contentLength is only 2 bytes?)
+        pos++;
+        let clientMessageLength = readShort();
+
+        // Client version
+        let clientVersion = readShort();
+
+        // Client random
+        pos += 32;
+
+        // Session id
+        let sessionIdLength = buffer[pos++];
+        pos += sessionIdLength;
+
+
+        let cipherSuiteLength = readShort();
+        pos += cipherSuiteLength;
+
+        let compressionLength = buffer[pos++];
+        pos += compressionLength;
+
+        let extensionsLength = readShort();
+        let extensionsEnd = pos + extensionsLength;
+        while (pos < extensionsEnd) {
+            let extensionType = readShort();
+            let length = readShort();
+
+            output.extensions.push({
+                type: extensionType, data: viewSliceBuffer(buffer, pos, length)
+            });
+
+            pos += length;
+        }
+    } catch { }
+
+    return output;
+}
+
+export const SNIType = 0x0;
+export function parseSNIExtension(data: Buffer): string[] {
+    let pos = 0;
+    function readShort() {
+        let high = data[pos++];
+        let low = data[pos++];
+        return high * 256 + low;
+    }
+
+    let snis: string[] = [];
+
+    try {
+        while (pos < data.length) {
+            let len = readShort();
+            let end = pos + len;
+            let type = data[pos++];
+            let len2 = readShort();
+            snis.push(viewSliceBuffer(data, pos, len2).toString());
+            pos = end;
+        }
+    } catch { }
+
+    return snis;
+}
+
+function viewSliceBuffer(data: Buffer, index: number, count?: number) {
+    count = count ?? (data.length - index);
+    return Buffer.from(data.buffer, data.byteOffset + index, count);
+}

package/src/webSocketServer.ts

@@ -3,97 +3,106 @@ import http from "http";
 import net from "net";
 import tls from "tls";
 import * as ws from "ws";
-import { getCertKeyPair, getNodeIdFromCert } from "./nodeAuthentication";
 import { getNodeIdsFromRequest, httpCallHandler } from "./callHTTPHandler";
 import { SocketFunction } from "../SocketFunction";
-import { getTrustedUserCertificates, loadTrustedUserCertificates, watchUserCertificates } from "./certStore";
+import { getTrustedCertificates, watchTrustedCertificates } from "./certStore";
 import { createCallFactory } from "./CallFactory";
+import { parseSNIExtension, parseTLSHello, SNIType } from "./tlsParsing";
+import debugbreak from "debugbreak";
 
 export type SocketServerConfig = (
-    {
+    https.ServerOptions & {
+        nodeId?: string;
+
+        key: string | Buffer;
+        cert: string | Buffer;
+
         port: number;
+
         // public sets ip to "0.0.0.0", otherwise it defaults to "127.0.0.1", which
         //  causes the server to only accept local connections.
         public?: boolean;
         ip?: string;
-    } & (
-        https.ServerOptions
-    )
+
+        /** If the SNI matches this domain, we use a different key/cert. */
+        SNICerts?: {
+            [domain: string]: https.ServerOptions;
+        };
+    }
 );
 
 export async function startSocketServer(
     config: SocketServerConfig
-): Promise<string> {
-    let isSecure = "cert" in config || "key" in config || "pfx" in config;
-    if (!isSecure) {
-        let { key, cert } = getCertKeyPair();
-        config.key = key;
-        config.cert = cert;
-    }
-
-    await loadTrustedUserCertificates();
-
-    // TODO: Only allow unauthorized for ip certificates, and then for domains use the domain as the nodeId,
-    //  so it is easy to read, and consistent.
-    let options: https.ServerOptions = {
-        ...config,
-        rejectUnauthorized: SocketFunction.rejectUnauthorized,
-        requestCert: true,
-    };
+): Promise<void> {
 
-    let httpsServer = https.createServer(options);
-    watchUserCertificates(() => {
-        options.ca = tls.rootCertificates.concat(getTrustedUserCertificates());
-        httpsServer.setSecureContext(options);
+    const webSocketServer = new ws.Server({
+        noServer: true,
     });
 
-    httpsServer.on("connection", socket => {
-        console.log("Client connection established");
-        socket.on("error", e => {
-            console.log(`Client socket error ${e.message}`);
-        });
-        socket.on("close", () => {
-            console.log("Client socket closed");
+    function setupHTTPSServer(options: https.ServerOptions) {
+        let httpsServer = https.createServer(options);
+        watchTrustedCertificates(() => {
+            options.ca = getTrustedCertificates();
+            httpsServer.setSecureContext(options);
         });
-    });
-    httpsServer.on("error", e => {
-        console.error(`Connection attempt error ${e.message}`);
-    });
-    httpsServer.on("tlsClientError", e => {
-        console.error(`TLS client error ${e.message}`);
-    });
 
+        httpsServer.on("connection", socket => {
+            console.log("Client connection established");
+            socket.on("error", e => {
+                console.log(`Client socket error ${e.message}`);
+            });
+            socket.on("close", () => {
+                console.log("Client socket closed");
+            });
+        });
+        httpsServer.on("error", e => {
+            console.error(`Connection attempt error ${e.message}`);
+        });
+        httpsServer.on("tlsClientError", e => {
+            console.error(`TLS client error ${e.message}`);
+        });
 
-    httpsServer.on("request", httpCallHandler);
+        httpsServer.on("request", httpCallHandler);
 
-    const webSocketServer = new ws.Server({
-        noServer: true,
-    });
-    httpsServer.on("upgrade", (request, socket, upgradeHead) => {
-        socket.on("error", e => {
-            console.log(`Client socket error ${e.message}`);
-        });
+        httpsServer.on("upgrade", (request, socket, upgradeHead) => {
+            socket.on("error", e => {
+                console.log(`Client socket error ${e.message}`);
+            });
 
-        let originHeader = request.headers["origin"];
-        if (originHeader) {
-            try {
-                let host = new URL("ws://" + request.headers["host"]).hostname;
-                let origin = new URL(originHeader).hostname;
-                if (host !== origin) {
-                    throw new Error(`Invalid cross thread request, ${JSON.stringify(host)} !== ${JSON.stringify(origin)}`);
+            let originHeader = request.headers["origin"];
+            if (originHeader) {
+                try {
+                    let host = new URL("ws://" + request.headers["host"]).hostname;
+                    let origin = new URL(originHeader).hostname;
+                    if (host !== origin) {
+                        throw new Error(`Invalid cross thread request, ${JSON.stringify(host)} !== ${JSON.stringify(origin)}`);
+                    }
+                } catch (e) {
+                    console.error(e);
+                    return;
                 }
-            } catch (e) {
-                console.error(e);
-                return;
             }
-        }
-        webSocketServer.handleUpgrade(request, socket, upgradeHead, (ws) => {
-            const { nodeId, localNodeId } = getNodeIdsFromRequest(request);
-            createCallFactory(ws, nodeId, localNodeId).catch(e => {
-                console.error(`Error in creating call factory, ${e.stack}`);
+            webSocketServer.handleUpgrade(request, socket, upgradeHead, (ws) => {
+                const { nodeId, localNodeId } = getNodeIdsFromRequest(request);
+                createCallFactory(ws, nodeId, localNodeId).catch(e => {
+                    console.error(`Error in creating call factory, ${e.stack}`);
+                });
             });
         });
-    });
+        return httpsServer;
+    }
+
+    // TODO: Only allow unauthorized for ip certificates, and then for domains use the domain as the nodeId,
+    //  so it is easy to read, and consistent.
+    let options: https.ServerOptions = {
+        ...config,
+    };
+
+    const mainHTTPSServer = setupHTTPSServer(options);
+    let sniServers = new Map<string, https.Server>();
+    for (let [domain, obj] of Object.entries(config.SNICerts || {})) {
+        sniServers.set(domain, setupHTTPSServer(obj));
+    }
 
     let httpServer = http.createServer({}, async function (req, res) {
         let url = new URL("http://" + req.headers.host + req.url);
@@ -114,7 +123,15 @@ export async function startSocketServer(
         socket.once("data", buffer => {
             // All HTTPS requests start with 22, and no HTTP requests start with 22,
             //  so we just need to read the first byte.
-            let server = buffer[0] === 22 ? httpsServer : httpServer;
+
+            let server: https.Server | http.Server;
+            if (buffer[0] !== 22) {
+                server = httpServer;
+            } else {
+                let data = parseTLSHello(buffer);
+                let sni = data.extensions.filter(x => x.type === SNIType).flatMap(x => parseSNIExtension(x.data))[0];
+                server = sniServers.get(sni) || mainHTTPSServer;
+            }
 
             // NOTE: Messages aren't dequeued until the current handler finishes, so we don't need to pause the socket or anything.
             server.emit("connection", socket);
@@ -148,11 +165,5 @@ export async function startSocketServer(
 
     let port = (realServer.address() as net.AddressInfo).port;
 
-    console.log(`Started Listening on ${host}:${port}`);
-
-    let serverNodeId = getNodeIdFromCert({ raw: config.cert as Buffer | string }, port);
-    if (!serverNodeId) {
-        throw new Error(`Something is wrong with our cert, we don't have a nodeId?`);
-    }
-    return serverNodeId;
+    console.log(`Started Listening on ${config.nodeId || host}:${port}`);
 }