Create core.pki component

[heuels]

The [email protected] roadmap states that system should include support for issuing client certificates. There are a few ways of implementing it. We could use one of many openssl wrappers available or we could use one of pure-javascript libraries that provides these kind of features.

For now I tend to choose the second option.

Pure JavaScript libraries that may be used are forge and jsrsasign. However, forge does not support file signing, which we will later need to sign .mobileconfig configuration profiles (see briskhome-mobileconfig). So jsrsasign it is.

The wiki page for jsrsasign has a few valuable demos that will certainly ease the development of this component:

• JS Certificate Authority;
• Keypair and CSR generator demo;
• Online Certificate Viewer.

---

The core.pki system component should support:

• Generating public and private keys;
• Generating Certificate Signing Requests (CSR);
• Issuing client certificates;
• Authorizing the issuance of a client certificate by system administrator;
• Logging the information about the users requesting certificates and authorizing issuance;
• Storing issued certificates in either LDAP or MongoDB.

Edit (1/31): node-forge now is now being tested for being a cryptographic tool of choice. Why node-forge? Because it can generate keys asyncronously, without stopping the whole application to think about it.

This issue is to be edited to reflect the latest status of component development.

[heuels]

Signing .mobileconfig files with forge

An slightly modified excerpt from forge README:

const p7 = forge.pkcs7.createSignedData();
p7.content = forge.util.createBuffer('<plist>...</plist>', 'utf8');
p7.addSigner({
  key: privateKeyAssociatedWithCert,
  certificate: certOrCertPem,
  digestAlgorithm: forge.pki.oids.sha256,
  authenticatedAttributes: [{
    type: forge.pki.oids.contentType,
    value: forge.pki.oids.data
  }, {
    type: forge.pki.oids.messageDigest
    // value will be auto-populated at signing time
  }, {
    type: forge.pki.oids.signingTime,
    // value can also be auto-populated at signing time
    value: new Date()
  }]
});
p7.sign();

[heuels]

Creating .p12 containers with forge

const p12Asn1 = forge.pkcs12.toPkcs12Asn1(
    privateKey, certificateChain, 'password',
    {algorithm: '3des'}
);