Switch parse-pki-cert from node-forge to PKI.js

This replaces the implementation of parse-pki-cert to use PKI.js rather
than node-forge for two reasons:

 - PKI.js uses Web Crypto rather than maintaining a built-in
   implementation of several algorithms.
 - node-forge presently lacks support for ECDSA and Ed25519
   certificates.

Related: #13680

Signed-off-by: Alexander Scheel <[email protected]>

ui/app/helpers/parse-pki-cert.js

@@ -1,24 +1,53 @@
 import { helper } from '@ember/component/helper';
-import { pki } from 'node-forge';
+import * as asn1js from 'asn1js';
+import { fromBase64, stringToArrayBuffer } from 'pvutils';
+import { Certificate } from 'pkijs';
 
 export function parsePkiCert([model]) {
   // model has to be the responseJSON from PKI serializer
   if (!model.certificate) {
     return;
   }
   let cert;
-  // node-forge cannot parse EC (elliptical curve) certs
-  // set canParse to false if unable to convert a Forge cert from PEM
   try {
-    cert = pki.certificateFromPem(model.certificate);
+    let cert_base64 = model.certificate.replace(/(-----(BEGIN|END) CERTIFICATE-----|\n)/g, '');
+    let cert_der = fromBase64(cert_base64);
+    let cert_asn1 = asn1js.fromBER(stringToArrayBuffer(cert_der));
+    cert = new Certificate({ schema: cert_asn1.result });
   } catch (error) {
+    console.log('Error parsing certificate:', error, model.certificate);
     return {
       can_parse: false,
     };
   }
-  const commonName = cert?.subject.getField('CN') ? cert.subject.getField('CN').value : null;
-  const expiryDate = cert?.validity.notAfter;
-  const issueDate = cert?.validity.notBefore;
+
+  // We wish to get the CN element out of this certificate's subject. A
+  // subject is a list of RDNs, where each RDN is a (type, value) tuple
+  // and where a type is an OID. The OID for CN can be found here:
+  //
+  //    http://oid-info.com/get/2.5.4.3
+  //    https://datatracker.ietf.org/doc/html/rfc5280#page-112
+  //
+  // Each value is then encoded as another ASN.1 object; in the case of a
+  // CommonName field, this is usually a PrintableString, BMPString, or a
+  // UTF8String. Regardless of encoding, it should be present in the
+  // valueBlock's value field if it is renderable.
+  const commonNameOID = '2.5.4.3';
+  const commonNames = cert?.subject?.typesAndValues
+    .filter((rdn) => rdn?.type === commonNameOID)
+    .map((rdn) => rdn?.value?.valueBlock?.value);
+
+  // Theoretically, there might be multiple (or no) CommonNames -- but Vault
+  // presently refuses to issue certificates without CommonNames in most
+  // cases. For now, return the first CommonName we find. Alternatively, we
+  // might update our callers to handle multiple, or join them using some
+  // separator like ','.
+  const commonName = commonNames ? (commonNames.length ? commonNames[0] : null) : null;
+
+  // Date instances are stored in the value field as the notAfter/notBefore
+  // field themselves are Time values.
+  const expiryDate = cert?.notAfter?.value;
+  const issueDate = cert?.notBefore?.value;
   return {
     can_parse: true,
     common_name: commonName,