TLS certificate object documentation and support for EC certificates #24358

sam-github · 2018-11-14T04:45:22Z

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

nodejs-github-bot · 2018-11-14T04:45:23Z

@sam-github build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/1606/pipeline

sam-github · 2018-11-14T04:46:34Z

I didn't add support for DH or DSA certs because its untestable until #10747 lands, we don't have any of those kind of certs in our fixtures.

sam-github · 2018-11-14T17:43:10Z

ci-lite: https://ci.nodejs.org/job/node-test-pull-request-lite-pipeline/1614/

sam-github · 2018-11-14T17:57:29Z

ci: https://ci.nodejs.org/job/node-test-pull-request/18613/

tniessen · 2018-11-14T19:25:10Z

I am actually not sure how this aligns with my proposal for key objects... IMO it would make more sense to expose properties of the key via a key object, not using the certificate, but on the other hand, I am not sure whether we should expose those fields at all.

bnoordhuis

LGTM modulo comments.

src/node_crypto.cc

doc/api/tls.md

sam-github · 2018-11-14T23:44:56Z

@tniessen re:

I am actually not sure how this aligns with my proposal for key objects... IMO it would make more sense to expose properties of the key via a key object, not using the certificate, but on the other hand, I am not sure whether we should expose those fields at all.

I think it aligns fine with key objects. The key info in the cert is already present, but mostly for debugging. I don't think that has much to do with the keyObjects you are working on. It would be possible to add a keyObject property to the cert object, but the overhead might not make sense for TLS. It could be optional.

More interestingly, I notice your keyObjects don't allow access to any of the key properties, so a key object isn't a replacement for how the cert objects expose the public key material. Perhaps that is deliberate - key material might not be present if the key is on hardware? Even if the key isn't exposed, it seems to me that the key size, and the ec curve/nist name are all properties that would be useful.

If you are considering exposing some information about the asym keys (alg, size, curve, etc) from keyObjects, then it would make sense that the property names you use are aligned with the property names used in cert objects.

Is that something you see a place for? You could do it later, but it would be good if you at least liked the names used here so that using the same names won't cause any pain.

sam-github · 2018-11-15T02:32:44Z

ci: https://ci.nodejs.org/job/node-test-pull-request/18626/

sam-github · 2018-11-15T03:18:39Z

ci: https://ci.nodejs.org/job/node-test-pull-request/18629/

sam-github · 2018-11-15T18:18:28Z

@tniessen PTAL

sam-github · 2018-11-15T18:20:06Z

ci: https://ci.nodejs.org/job/node-test-pull-request/18654/

vsemozhetbyt

Some nits.

doc/api/tls.md

sam-github · 2018-11-15T21:37:17Z

@vsemozhetbyt PTAL

ci: https://ci.nodejs.org/job/node-test-pull-request/18659/

doc/api/tls.md

nornagon

I know this already got merged, I'm commenting here because I'm working on boringssl integration in Electron and wanted to ask some questions :)

nornagon · 2018-12-19T22:34:09Z

src/node_crypto.cc

+      CHECK_NULL(pub);
+    }
+
+    if (EC_GROUP_get_asn1_flag(group) != 0) {


I think this check for asn1_flag is unnecessary? It should be enough to just check nid != 0—if the curve has a name, nid will be non-zero, and if it doesn't, nid will be zero. No need to also check the asn1_flag, right?

(The reason I'm asking is because EC_GROUP_get_asn1_flag doesn't exist in BoringSSL and I'm working on BoringSSL integration downstream in Electron.)

The code was directly copied from

node/deps/openssl/openssl/crypto/ec/eck_prn.c

Lines 97 to 119 in 9dfbc39

if (EC_GROUP_get_asn1_flag(x)) {

/* the curve parameter are given by an asn1 OID */

int nid;

const char *nname;

if (!BIO_indent(bp, off, 128))

goto err;

nid = EC_GROUP_get_curve_name(x);

if (nid == 0)

goto err;

if (BIO_printf(bp, "ASN1 OID: %s", OBJ_nid2sn(nid)) <= 0)

goto err;

if (BIO_printf(bp, "\n") <= 0)

goto err;

nname = EC_curve_nid2nist(nid);

if (nname) {

if (!BIO_indent(bp, off, 128))

goto err;

if (BIO_printf(bp, "NIST CURVE: %s\n", nname) <= 0)

goto err;

}

} else {

but reading through the docs, yes, I suppose just trying to get the nid would work. I'll update this.

see: #25345

nornagon · 2018-12-19T22:34:41Z

src/node_crypto.cc

+                    OneByteString(env->isolate(), sn)).FromJust();
+        }
+      }
+      if (nid != 0) {


Merge these two conditionals?

PR-URL: nodejs#24358 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Tobias Nießen <tniessen@tnie.de>

X.509 certs are provided to the user in a parsed object form by a number of TLS APIs. Include public key info for elliptic curves as well, not just RSA. - pubkey: the public key - bits: the strength of the curve - asn1Curve: the ASN.1 OID for the curve - nistCurve: the NIST nickname for the curve, if it has one PR-URL: nodejs#24358 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Tobias Nießen <tniessen@tnie.de>

For symmetricality with the EC public key info, and because its useful. PR-URL: nodejs#24358 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Notable Changes: * console,util: * `console` functions now handle symbols as defined in the spec. nodejs#23708 * The inspection `depth` default is now back at 2. nodejs#24326 * dgram,net: * Added ipv6Only option for `net` and `dgram`. nodejs#23798 * http: * Chosing between the http parser is now possible per runtime flag. nodejs#24739 * readline: * The `readline` module now supports async iterators. nodejs#23916 * repl: * The multiline history feature is removed. nodejs#24804 * tls: * Added min/max protocol version options. nodejs#24405 * The X.509 public key info now includes the RSA bit size and the elliptic curve. nodejs#24358 * url: * `pathToFileURL()` now supports LF, CR and TAB. nodejs#23720 * Windows: * Tools are not installed using Boxstarter anymore. nodejs#24677 * The install-tools scripts or now included in the dist. nodejs#24233 * Added new collaborator: * [antsmartian](https://github.com/antsmartian) - Anto Aravinth. nodejs#24655 PR-URL: nodejs#24854

Remove XXX, there has been an EC specific cert property since nodejs#24358

Remove XXX, there has been an EC specific cert property since #24358 PR-URL: #26598 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>

Remove XXX, there has been an EC specific cert property since nodejs#24358 PR-URL: nodejs#26598 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>

Remove XXX, there has been an EC specific cert property since #24358 PR-URL: #26598 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>

- docs incorrectly mention issuerCert, should be issuerCertificate Fix for Commit: a856406c2dc#diff-f6e3a86962eaf0897ab59e88b418e64fR678 Fix for PR: #24358

PR-URL: #41477 Refs: #24358 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: nodejs#41477 Refs: nodejs#24358 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: #41477 Refs: #24358 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. labels Nov 14, 2018

sam-github mentioned this pull request Nov 14, 2018

tls: get the local certificate after tls handshake #24261

Closed

4 tasks

sam-github force-pushed the tls-cert-details branch from 3617edc to 9fd7f91 Compare November 14, 2018 04:51

sam-github changed the title ~~Tls cert details~~ TLS certificate object documentation and support for EC certificates Nov 14, 2018

sam-github force-pushed the tls-cert-details branch from 9fd7f91 to 79694d2 Compare November 14, 2018 17:41

sam-github requested review from bnoordhuis and tniessen November 14, 2018 17:43

bnoordhuis approved these changes Nov 14, 2018

View reviewed changes

sam-github force-pushed the tls-cert-details branch from de8d226 to ccfe3aa Compare November 15, 2018 02:31

sam-github force-pushed the tls-cert-details branch from ccfe3aa to bbf888a Compare November 15, 2018 03:15

sam-github force-pushed the tls-cert-details branch from bbf888a to b6056de Compare November 15, 2018 18:13

sam-github added semver-minor PRs that contain new features and should be released in the next minor version. tls Issues and PRs related to the tls subsystem. doc Issues and PRs related to the documentations. labels Nov 15, 2018

vsemozhetbyt reviewed Nov 15, 2018

View reviewed changes

doc/api/tls.md Outdated Show resolved Hide resolved

doc/api/tls.md Outdated Show resolved Hide resolved

doc/api/tls.md Outdated Show resolved Hide resolved

doc/api/tls.md Outdated Show resolved Hide resolved

doc/api/tls.md Outdated Show resolved Hide resolved

sam-github force-pushed the tls-cert-details branch from b6056de to 6d860df Compare November 15, 2018 21:36

bnoordhuis mentioned this pull request Nov 15, 2018

generate more certs, and more test coverage using them #24374

Closed

4 tasks

vsemozhetbyt reviewed Nov 15, 2018

View reviewed changes

doc/api/tls.md Outdated Show resolved Hide resolved

This was referenced Dec 8, 2018

2018-12-07 Version 11.4.0 (Current) @BridgeAR beevelop/docker-android-nodejs#264

Closed

2018-12-07 Version 11.4.0 (Current) @BridgeAR beevelop/docker-android-nodejs#265

Closed

nornagon reviewed Dec 19, 2018

View reviewed changes

refack pushed a commit to refack/node that referenced this pull request Jan 14, 2019

doc: describe certificate object properties

6ea3a56

PR-URL: nodejs#24358 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Tobias Nießen <tniessen@tnie.de>

sam-github added a commit to sam-github/node that referenced this pull request Mar 11, 2019

test: use EC cert property now that it exists

5fa1d67

Remove XXX, there has been an EC specific cert property since nodejs#24358

sam-github mentioned this pull request Mar 11, 2019

test: use EC cert property now that it exists #26598

Closed

3 tasks

srl295 mentioned this pull request Mar 26, 2019

doc: correct typo: cert.issuerCertificate #26934

Closed

3 tasks

srl295 added a commit that referenced this pull request Mar 28, 2019

doc: correct typo: cert.issuerCertificate

36e5fd2

- docs incorrectly mention issuerCert, should be issuerCertificate Fix for Commit: a856406c2dc#diff-f6e3a86962eaf0897ab59e88b418e64fR678 Fix for PR: #24358

targos pushed a commit that referenced this pull request Mar 28, 2019

doc: correct typo: cert.issuerCertificate

908fc8e

- docs incorrectly mention issuerCert, should be issuerCertificate Fix for Commit: a856406c2dc#diff-f6e3a86962eaf0897ab59e88b418e64fR678 Fix for PR: #24358

targos pushed a commit that referenced this pull request Mar 29, 2019

doc: correct typo: cert.issuerCertificate

c2500d4

- docs incorrectly mention issuerCert, should be issuerCertificate Fix for Commit: a856406c2dc#diff-f6e3a86962eaf0897ab59e88b418e64fR678 Fix for PR: #24358

targos pushed a commit that referenced this pull request Mar 30, 2019

doc: correct typo: cert.issuerCertificate

a821a96

- docs incorrectly mention issuerCert, should be issuerCertificate Fix for Commit: a856406c2dc#diff-f6e3a86962eaf0897ab59e88b418e64fR678 Fix for PR: #24358

BethGriggs pushed a commit that referenced this pull request Apr 5, 2019

doc: correct typo: cert.issuerCertificate

2794e88

- docs incorrectly mention issuerCert, should be issuerCertificate Fix for Commit: a856406c2dc#diff-f6e3a86962eaf0897ab59e88b418e64fR678 Fix for PR: #24358

tniessen mentioned this pull request Jan 11, 2022

doc: remove extraneous colon in legacy subject #41477

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TLS certificate object documentation and support for EC certificates #24358

TLS certificate object documentation and support for EC certificates #24358

sam-github commented Nov 14, 2018 •

edited

Loading

nodejs-github-bot commented Nov 14, 2018

sam-github commented Nov 14, 2018

sam-github commented Nov 14, 2018

sam-github commented Nov 14, 2018

tniessen commented Nov 14, 2018

bnoordhuis left a comment

sam-github commented Nov 14, 2018

sam-github commented Nov 15, 2018

sam-github commented Nov 15, 2018

sam-github commented Nov 15, 2018

sam-github commented Nov 15, 2018

vsemozhetbyt left a comment

sam-github commented Nov 15, 2018

nornagon left a comment

nornagon Dec 19, 2018

sam-github Jan 4, 2019

nornagon Jan 4, 2019

sam-github Jan 4, 2019

nornagon Dec 19, 2018

	if (EC_GROUP_get_asn1_flag(x)) {
	/* the curve parameter are given by an asn1 OID */
	int nid;
	const char *nname;

	if (!BIO_indent(bp, off, 128))
	goto err;

	nid = EC_GROUP_get_curve_name(x);
	if (nid == 0)
	goto err;
	if (BIO_printf(bp, "ASN1 OID: %s", OBJ_nid2sn(nid)) <= 0)
	goto err;
	if (BIO_printf(bp, "\n") <= 0)
	goto err;
	nname = EC_curve_nid2nist(nid);
	if (nname) {
	if (!BIO_indent(bp, off, 128))
	goto err;
	if (BIO_printf(bp, "NIST CURVE: %s\n", nname) <= 0)
	goto err;
	}
	} else {

TLS certificate object documentation and support for EC certificates #24358

TLS certificate object documentation and support for EC certificates #24358

Conversation

sam-github commented Nov 14, 2018 • edited Loading

Checklist

nodejs-github-bot commented Nov 14, 2018

sam-github commented Nov 14, 2018

sam-github commented Nov 14, 2018

sam-github commented Nov 14, 2018

tniessen commented Nov 14, 2018

bnoordhuis left a comment

Choose a reason for hiding this comment

sam-github commented Nov 14, 2018

sam-github commented Nov 15, 2018

sam-github commented Nov 15, 2018

sam-github commented Nov 15, 2018

sam-github commented Nov 15, 2018

vsemozhetbyt left a comment

Choose a reason for hiding this comment

sam-github commented Nov 15, 2018

nornagon left a comment

Choose a reason for hiding this comment

nornagon Dec 19, 2018

Choose a reason for hiding this comment

sam-github Jan 4, 2019

Choose a reason for hiding this comment

nornagon Jan 4, 2019

Choose a reason for hiding this comment

sam-github Jan 4, 2019

Choose a reason for hiding this comment

nornagon Dec 19, 2018

Choose a reason for hiding this comment

sam-github commented Nov 14, 2018 •

edited

Loading