feat(cert-manager): Zertifikatspaket hochladen, erkennen und in jedem Format herunterladen

Neuer erster Reiter Übersicht: mehrere Dateien oder die ZIP vom Aussteller auf einmal ablegen. Der Server erkennt jedes Teil (Server-, Zwischen-, Stammzertifikat, privater Schlüssel, CSR, auch aus PFX/P7B), fasst Duplikate zusammen, ordnet Schlüssel/CSR dem Zertifikat zu und baut die Kette. Unter jedem Teil stehen Download-Knöpfe für alle passenden Formate (crt, cer, Fullchain, p7b, pfx mit Schlüssel und Kette; key PKCS#8/PKCS#1/ DER; csr PEM/DER). Geschützte PFX lassen sich mit Passwort entsperren. Neue Endpunkte POST analyze (Dateien/ZIP, Begrenzung Anzahl und Größe vor dem Entpacken) und POST export (JSON, zustandslos). Modultexte siezen jetzt durchgehend; Gültigkeit in UTC wie im Zertifikat. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-01 15:23:34 +02:00
parent 645c5e5887
commit c07b0cfaf0
11 changed files with 1811 additions and 52 deletions
@@ -0,0 +1,268 @@
+import AdmZip from 'adm-zip';
+import * as forge from 'node-forge';
+import { beforeAll, describe, expect, it } from 'vitest';
+import { analyzeBundle, exportBundleItem, safeBaseName } from './cert-bundle';
+
+/**
+ * cert-bundle.spec (quick-261001-l4q) — Zertifikatspaket wie vom Aussteller:
+ * Stamm -> Zwischen -> Server, dazu Schluessel, CSR und PFX, als ZIP.
+ * Alles hier erzeugt (keine echten Kundendaten im Repo).
+ */
+
+interface Pki {
+  rootPem: string;
+  interPem: string;
+  leafPem: string;
+  keyPem: string;
+  csrPem: string;
+  pfx: Buffer;
+  leafModulus: string;
+}
+
+let pki: Pki;
+
+function makeCert(
+  subjectCn: string,
+  pub: forge.pki.PublicKey,
+  signer: forge.pki.PrivateKey,
+  issuer: forge.pki.CertificateField[] | null,
+  ca: boolean,
+  serial: string,
+): forge.pki.Certificate {
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = pub;
+  cert.serialNumber = serial;
+  cert.validity.notBefore = new Date(Date.now() - 86_400_000);
+  cert.validity.notAfter = new Date(Date.now() + 90 * 86_400_000);
+  const subject = [{ name: 'commonName', value: subjectCn }];
+  cert.setSubject(subject);
+  cert.setIssuer(issuer ?? subject);
+  const ext: object[] = [{ name: 'basicConstraints', cA: ca }];
+  if (!ca) ext.push({ name: 'subjectAltName', altNames: [{ type: 2, value: subjectCn }] });
+  cert.setExtensions(ext);
+  cert.sign(signer as forge.pki.rsa.PrivateKey, forge.md.sha256.create());
+  return cert;
+}
+
+beforeAll(() => {
+  const rootKeys = forge.pki.rsa.generateKeyPair(1024);
+  const interKeys = forge.pki.rsa.generateKeyPair(1024);
+  const leafKeys = forge.pki.rsa.generateKeyPair(1024);
+  const root = makeCert('Test Root CA', rootKeys.publicKey, rootKeys.privateKey, null, true, '01');
+  const inter = makeCert(
+    'Test Intermediate CA',
+    interKeys.publicKey,
+    rootKeys.privateKey,
+    root.subject.attributes,
+    true,
+    '02',
+  );
+  const leaf = makeCert(
+    'www.example.test',
+    leafKeys.publicKey,
+    interKeys.privateKey,
+    inter.subject.attributes,
+    false,
+    '03',
+  );
+
+  const csr = forge.pki.createCertificationRequest();
+  csr.publicKey = leafKeys.publicKey;
+  csr.setSubject([{ name: 'commonName', value: 'www.example.test' }]);
+  csr.sign(leafKeys.privateKey, forge.md.sha256.create());
+
+  const p12 = forge.pkcs12.toPkcs12Asn1(leafKeys.privateKey, [leaf, inter], 'geheim', {
+    algorithm: '3des',
+  });
+
+  pki = {
+    rootPem: forge.pki.certificateToPem(root),
+    interPem: forge.pki.certificateToPem(inter),
+    leafPem: forge.pki.certificateToPem(leaf),
+    keyPem: forge.pki.privateKeyInfoToPem(
+      forge.pki.wrapRsaPrivateKey(forge.pki.privateKeyToAsn1(leafKeys.privateKey)),
+    ),
+    csrPem: forge.pki.certificationRequestToPem(csr),
+    pfx: Buffer.from(forge.asn1.toDer(p12).getBytes(), 'binary'),
+    leafModulus: leafKeys.publicKey.n.toString(16),
+  };
+}, 60_000);
+
+function issuerZip(): Buffer {
+  const zip = new AdmZip();
+  zip.addFile('www.example.test/www.example.test.pem', Buffer.from(pki.leafPem + pki.interPem));
+  zip.addFile('www.example.test/www.example.test.key', Buffer.from(pki.keyPem));
+  zip.addFile('www.example.test/www.example.test.csr', Buffer.from(pki.csrPem));
+  zip.addFile('www.example.test/www.example.test.pfx', pki.pfx);
+  zip.addFile('www.example.test/.dnstxtrecord', Buffer.from('_dnsauth abc123'));
+  return zip.toBuffer();
+}
+
+describe('analyzeBundle', () => {
+  it('ZIP vom Aussteller: erkennt jedes Teil, fasst PEM/PFX zusammen, ordnet Schluessel und Kette zu', () => {
+    const r = analyzeBundle([{ originalname: 'paket.zip', buffer: issuerZip() }], 'geheim');
+
+    const kinds = r.items.map((i) => (i.kind === 'certificate' ? i.role : i.kind));
+    expect(kinds).toEqual(['end-entity', 'intermediate', 'privateKey', 'csr']);
+
+    const [leaf, inter, key, csr] = r.items;
+    expect(leaf.cn).toBe('www.example.test');
+    expect(leaf.san).toEqual(['www.example.test']);
+    // in PEM UND PFX enthalten -> ein Eintrag mit beiden Quellen
+    expect(leaf.sources.sort()).toEqual(['www.example.test.pem', 'www.example.test.pfx']);
+    expect(leaf.chainIds).toEqual([inter.id]);
+    expect(leaf.matchId).toBe(key.id);
+    expect(key.matchId).toBe(leaf.id);
+    expect(key.sources.sort()).toEqual(['www.example.test.key', 'www.example.test.pfx']);
+    expect(csr.matchId).toBe(leaf.id);
+    expect(csr.cn).toBe('www.example.test');
+    expect(leaf.baseName).toBe('www.example.test');
+
+    expect(r.locked).toEqual([]);
+    expect(r.ignored).toEqual(['.dnstxtrecord']);
+  });
+
+  it('PFX ohne passendes Passwort wird als gesperrt gemeldet, der Rest trotzdem erkannt', () => {
+    const r = analyzeBundle([{ originalname: 'paket.zip', buffer: issuerZip() }], 'falsch');
+    expect(r.locked).toEqual(['www.example.test.pfx']);
+    expect(r.items.filter((i) => i.kind === 'certificate')).toHaveLength(2);
+  });
+
+  it('Stammzertifikat wird als root erkannt und an die Kette gehaengt', () => {
+    const r = analyzeBundle(
+      [
+        {
+          originalname: 'chain.pem',
+          buffer: Buffer.from(pki.leafPem + pki.interPem + pki.rootPem),
+        },
+      ],
+      '',
+    );
+    expect(r.items.map((i) => i.role)).toEqual(['end-entity', 'intermediate', 'root']);
+    expect(r.items[0].chainIds).toHaveLength(2);
+  });
+
+  it('ohne Dateien -> 400', () => {
+    expect(() => analyzeBundle([], '')).toThrow(/No files/);
+  });
+
+  it('ZIP mit zu vielen Dateien -> 400', () => {
+    const zip = new AdmZip();
+    for (let i = 0; i < 101; i++) zip.addFile(`f${i}.txt`, Buffer.from('x'));
+    expect(() =>
+      analyzeBundle([{ originalname: 'gross.zip', buffer: zip.toBuffer() }], ''),
+    ).toThrow(/too many files/);
+  });
+});
+
+describe('exportBundleItem', () => {
+  function bundle() {
+    const r = analyzeBundle([{ originalname: 'paket.zip', buffer: issuerZip() }], 'geheim');
+    const byId = Object.fromEntries(r.items.map((i) => [i.id, i]));
+    return { items: r.items, byId };
+  }
+  const decode = (b64: string) => Buffer.from(b64, 'base64');
+
+  it('Zertifikat in jedem Format liest sich wieder ein', () => {
+    const { items, byId } = bundle();
+    const leaf = items[0];
+    const chain = leaf.chainIds.map((id) => byId[id].pem);
+    const keyPem = byId[leaf.matchId!].pem;
+    const base = { kind: leaf.kind, pem: leaf.pem, baseName: leaf.baseName, chain, keyPem };
+
+    const crt = exportBundleItem({ ...base, format: 'crt' });
+    expect(crt.filename).toBe('www.example.test.crt');
+    expect(
+      forge.pki.certificateFromPem(decode(crt.content).toString()).subject.getField('CN').value,
+    ).toBe('www.example.test');
+
+    const cer = exportBundleItem({ ...base, format: 'cer' });
+    expect(cer.filename).toBe('www.example.test.cer');
+    forge.pki.certificateFromAsn1(forge.asn1.fromDer(decode(cer.content).toString('binary')));
+
+    const full = exportBundleItem({ ...base, format: 'fullchain' });
+    expect(
+      decode(full.content)
+        .toString()
+        .match(/BEGIN CERTIFICATE/g),
+    ).toHaveLength(2);
+
+    const p7b = exportBundleItem({ ...base, format: 'p7b' });
+    const p7 = forge.pkcs7.messageFromPem(decode(p7b.content).toString());
+    expect('certificates' in p7 ? p7.certificates : []).toHaveLength(2);
+
+    const pfx = exportBundleItem({ ...base, format: 'pfx', password: 'neu' });
+    expect(pfx.filename).toBe('www.example.test.pfx');
+    const p12 = forge.pkcs12.pkcs12FromAsn1(
+      forge.asn1.fromDer(decode(pfx.content).toString('binary')),
+      'neu',
+    );
+    expect(p12.getBags({ bagType: forge.pki.oids.certBag })[forge.pki.oids.certBag]).toHaveLength(
+      2,
+    );
+    const keyBag = p12.getBags({ bagType: forge.pki.oids.pkcs8ShroudedKeyBag })[
+      forge.pki.oids.pkcs8ShroudedKeyBag
+    ]![0];
+    expect((keyBag.key as forge.pki.rsa.PrivateKey).n.toString(16)).toBe(pki.leafModulus);
+  });
+
+  it('PFX ohne Passwort -> 400', () => {
+    const { items } = bundle();
+    expect(() =>
+      exportBundleItem({ kind: 'certificate', pem: items[0].pem, format: 'pfx' }),
+    ).toThrow(/password is required/);
+  });
+
+  it('Schluessel als PKCS#8, PKCS#1 und DER', () => {
+    const { items } = bundle();
+    const key = items.find((i) => i.kind === 'privateKey')!;
+    const base = { kind: key.kind, pem: key.pem, baseName: key.baseName };
+    expect(decode(exportBundleItem({ ...base, format: 'key' }).content).toString()).toContain(
+      'BEGIN PRIVATE KEY',
+    );
+    const rsa = exportBundleItem({ ...base, format: 'key-rsa' });
+    expect(rsa.filename).toBe('www.example.test.rsa.key');
+    expect(decode(rsa.content).toString()).toContain('BEGIN RSA PRIVATE KEY');
+    const der = exportBundleItem({ ...base, format: 'key-der' });
+    const info = forge.asn1.fromDer(decode(der.content).toString('binary'));
+    expect((forge.pki.privateKeyFromAsn1(info) as forge.pki.rsa.PrivateKey).n.toString(16)).toBe(
+      pki.leafModulus,
+    );
+  });
+
+  it('CSR als PEM und DER', () => {
+    const { items } = bundle();
+    const csr = items.find((i) => i.kind === 'csr')!;
+    const der = exportBundleItem({
+      kind: 'csr',
+      pem: csr.pem,
+      baseName: csr.baseName,
+      format: 'csr-der',
+    });
+    expect(der.filename).toBe('www.example.test.csr.der');
+    forge.pki.certificationRequestFromAsn1(
+      forge.asn1.fromDer(decode(der.content).toString('binary')),
+    );
+  });
+
+  it('unpassendes Format -> 400', () => {
+    const { items } = bundle();
+    expect(() =>
+      exportBundleItem({ kind: 'csr', pem: items[3].pem, format: 'pfx', password: 'x' }),
+    ).toThrow();
+    expect(() =>
+      exportBundleItem({ kind: 'privateKey', pem: 'kein pem', format: 'key-rsa' }),
+    ).toThrow(/Failed to export/);
+  });
+});
+
+describe('safeBaseName', () => {
+  it('Platzhalter, Leerzeichen und Pfadteile werden entschaerft', () => {
+    expect(safeBaseName('*.example.de', 'x')).toBe('wildcard.example.de');
+    expect(safeBaseName('Encryption Everywhere DV TLS CA - G1', 'x')).toBe(
+      'Encryption_Everywhere_DV_TLS_CA_-_G1',
+    );
+    expect(safeBaseName('../../etc/passwd', 'x')).toBe('etc_passwd');
+    expect(safeBaseName('', 'fallback')).toBe('fallback');
+  });
+});