105 lines
4.3 KiB
Markdown
105 lines
4.3 KiB
Markdown
# Phase 9 Context: Cert Manager Module
|
|
|
|
**Date:** 2026-07-01
|
|
**Status:** Ready for planning
|
|
|
|
---
|
|
|
|
## <domain>
|
|
Certificate management toolkit module. Users upload or paste certificates, inspect parsed details, split fullchain/bundle files into individual certs, merge certs into chains or PFX bundles, and convert between formats. All processing server-side, fully ephemeral (no database storage).
|
|
</domain>
|
|
|
|
---
|
|
|
|
## <decisions>
|
|
|
|
### Processing & Persistence
|
|
- **Server-side API** — All crypto operations happen in the NestJS backend, not client-side JavaScript
|
|
- **Ephemeral** — No Prisma schema changes, no DB tables, no file storage. Upload → process → return result/download
|
|
- Files are held in memory during request only (multer `memoryStorage`)
|
|
|
|
### Operations
|
|
- **Inspect** — Parse any cert and return: subject, issuer, validity dates, SANs, key type/size, fingerprint (SHA-1 + SHA-256), serial, signature algorithm
|
|
- **Split** — Accept fullchain.pem or P7B bundle; return array of individual certs (each downloadable as .crt/.pem)
|
|
- **Merge** — Combine multiple certs into:
|
|
- PEM chain (concatenated)
|
|
- PFX/PKCS12 bundle (cert + optional private key, with password)
|
|
- **Convert** — Between: PEM ↔ DER ↔ PFX/P12 ↔ P7B ↔ CRT/CER
|
|
|
|
### Input Modes
|
|
- **File upload** — All formats: `.pem`, `.crt`, `.cer`, `.der`, `.pfx`, `.p12`, `.p7b`, `.p7c`
|
|
- **Text paste** — PEM/CRT content pasted directly into textarea (auto-detected via `-----BEGIN` header)
|
|
- **Password field** — Shown conditionally when format is PFX/P12 (both for reading and creating)
|
|
|
|
### Supported Formats
|
|
| Format | Read | Write |
|
|
|--------|------|-------|
|
|
| PEM (.pem, .crt, .cer) | ✓ | ✓ |
|
|
| DER (.der, .cer binary) | ✓ | ✓ |
|
|
| PFX/PKCS12 (.pfx, .p12) | ✓ with password | ✓ with password |
|
|
| P7B/PKCS7 (.p7b, .p7c) | ✓ | ✓ |
|
|
|
|
### Library
|
|
- **`node-forge`** — Battle-tested Node.js crypto library; handles PEM, DER, PFX/PKCS12, P7B/PKCS7 in one package. No native bindings needed (pure JS, Docker-friendly).
|
|
|
|
### Module Registry
|
|
- **Slug:** `cert-manager`
|
|
- **Category:** `security-tools`
|
|
- **Pattern:** Same as Domaincheck — `OnModuleInit` seed, `@UseModule('cert-manager')` guard
|
|
|
|
### UI Layout
|
|
- Tab-based: **Analysieren** | **Aufteilen** | **Zusammenführen** | **Konvertieren**
|
|
- Shared file drop zone + text area at top, tabs below for operation selection
|
|
- Password field appears conditionally (PFX/P12 detected or PFX output selected)
|
|
- Results shown inline with download buttons per cert
|
|
|
|
### API Endpoints
|
|
All under `/modules/cert-manager`:
|
|
- `POST /parse` — inspect single cert (multipart or JSON with PEM text)
|
|
- `POST /split` — split fullchain/P7B → array of certs
|
|
- `POST /merge` — merge certs → PEM chain or PFX
|
|
- `POST /convert` — convert format
|
|
|
|
### Frontend Path
|
|
- `apps/web/src/app/(portal)/modules/cert-manager/page.tsx`
|
|
- `apps/web/src/app/(portal)/modules/cert-manager/actions.ts`
|
|
|
|
</decisions>
|
|
|
|
---
|
|
|
|
## <canonical_refs>
|
|
- `.planning/ROADMAP.md` — Phase 9 definition, requirements CERT-01 through CERT-06
|
|
- `apps/api/src/domaincheck/` — Module pattern to follow (controller, seed, guard usage)
|
|
- `apps/web/src/app/(portal)/modules/domaincheck/` — Frontend module pattern
|
|
- `apps/api/src/module-registry/` — Registry service + UseModule guard
|
|
</canonical_refs>
|
|
|
|
---
|
|
|
|
## <code_context>
|
|
|
|
### Reusable Patterns
|
|
- **NestJS module registration:** `domaincheck.module.ts` → `OnModuleInit` + `seedModule()`
|
|
- **Module guard:** `@UseModule('slug')` from `module-registry/module.guard`
|
|
- **File upload:** Use `@nestjs/platform-express` multer with `memoryStorage` (no disk writes)
|
|
- **Frontend actions:** `actions.ts` with `'use server'` calling `/api-proxy/modules/[slug]/[endpoint]`
|
|
- **Frontend page:** Client component with `useTranslations`, Card layout (`rounded-lg border border-border bg-card`)
|
|
|
|
### No Prisma Changes
|
|
Phase adds zero new database tables. `node-forge` runs entirely in memory.
|
|
|
|
### Dependencies to Add
|
|
- API: `node-forge` + `@types/node-forge`
|
|
- No new frontend deps (file input + fetch already available)
|
|
</code_context>
|
|
|
|
---
|
|
|
|
## <deferred>
|
|
- Certificate expiry monitoring / alerts (would need DB + cron — separate phase)
|
|
- Certificate store / saved cert library (needs DB — separate phase)
|
|
- OCSP / CRL revocation check (nice to have, out of scope here)
|
|
- Private key generation (out of scope — cert manager, not CA)
|
|
</deferred>
|