added SAN support

Author: larryboymi

README.md

@@ -25,11 +25,11 @@ your environment:
 | *Variable*                 | *Description*         |
 | :--------------------- |:--------------|
 | `acme-directory-url`            | Change to production url - https://acme-v01.api.letsencrypt.org if ready for real certificate.  |
-| `acme-domains`            | Array of domains to receive certificates for.  |
 | `acme-account-email`            | Email of user requesting certificate.  |
 | `s3-account-bucket`            | An S3 bucket to place account keys/config data into. You will need to create this bucket and assign the [IAM role](AWS.md) to read/write.  |
 | `s3-cert-bucket`            | An S3 bucket to place domain certificate data into. You will need to create this bucket and assign the [IAM role](AWS.md) to read/write.  |
 | `s3-folder`            | A folder within the above buckets to place the files under, in case there are other contents of these buckets.  |
+| `certificate-info`            | Object containing certificate information mapping certificate names to domains.  |
 
 ## Execution
 Follow these steps to get started:

ROADMAP.md

@@ -13,4 +13,4 @@ Please feel free to file issues on this repository if you have questions, concer
 * ~~"                                                               " ELB's.~~
 ~~* Different run modes: local file writing via nodejs vs Lambda + S3.~~
 * Tests
-* Support SAN in same certificate (let's encrypt allows up to 100 names per certificate)
+* ~~Support SAN in same certificate (let's encrypt allows up to 100 names per certificate)~~

app.js

@@ -2,26 +2,30 @@ const generateCertificate = require('./src/acme/generateCertificate')
 const isExpired = require('./src/util/isExpired')
 const config = require('./config/default.json')
 
-const single = (domain) =>
-  isExpired(domain)
+const single = (key, domains) =>
+  isExpired(key)
   .then((expired) =>
     (expired
-      ? generateCertificate(domain)
+      ? generateCertificate({key, domains})
       : {
         err: false,
-        msg: `Certificate for ${domain} is still valid, going back to bed.`
+        msg: `Certificate for ${key} is still valid, going back to bed.`
       }
     )
   )
   .catch((err) => ({
     err: true,
-    msg: `Updating cert for ${domain}, received err ${err}, ${err.stack}`
+    msg: `Updating cert for ${key}, received err ${err}, ${err.stack}`
   }))
 
-const certificates = (domains) => domains.map(single)
+const certificates = (certDefinitions) =>
+  Object.keys(certDefinitions)
+  .map((certKey) =>
+    single(certKey, certDefinitions[certKey])
+  )
 
 const updateCertificates = (options, context) =>
-  Promise.all(certificates(config['acme-domains']))
+  Promise.all(certificates(config['certificate-info']))
   .then((msgs) => context.succeed(msgs))
 
-module.exports = { handler : updateCertificates }
+module.exports = { handler: updateCertificates }

bin/local.js

@@ -1,10 +1,10 @@
-var cert = require("../app.js")
+const cert = require('../app.js')
 
-var testContext = {
-  succeed: function succeed(data) {
+const testContext = {
+  succeed: (data) => {
     console.log(data)
     process.exit(0)
   }
-};
+}
 
 cert.handler({}, testContext)

bin/write_pems.js

@@ -3,34 +3,33 @@ const config = require('../config/default.json')
 const fs = require('fs')
 
 const testContext = {
-  succeed: function succeed(data) {
+  succeed: (data) => {
     console.log(data)
     process.exit(0)
   }
 }
 
-const getPEMsForDomain = (domain) =>
+const getPEMsForCertInfo = (key) =>
   readFile(
     config['s3-cert-bucket'],
     config['s3-folder'],
-    `${domain}.json`
+    `${key}.json`
   )
   .then((data) => JSON.parse(data.Body.toString()))
   .then((certJSON) => {
-    console.log(`About to write PEM files for ${domain}..`)
+    console.log(`About to write PEM files for ${key}..`)
     try {
-      fs.writeFileSync(`./${domain}.pem`, certJSON.cert.toString())
-      fs.writeFileSync(`./${domain}-chain.pem`, certJSON.issuerCert.toString())
-      fs.writeFileSync(`./${domain}-key.pem`, certJSON.key.privateKeyPem.toString())
+      fs.writeFileSync(`./${key}.pem`, certJSON.cert.toString())
+      fs.writeFileSync(`./${key}-chain.pem`, certJSON.issuerCert.toString())
+      fs.writeFileSync(`./${key}-key.pem`, certJSON.key.privateKeyPem.toString())
     } catch (e) {
-      console.log(JSON.stringify(e.stack))
+      console.error('Error writing pem files', e)
     }
   })
   .catch()
 
 const getAllPEMs = (sync) =>
-  Promise.all(config['acme-domains'].map(getPEMsForDomain))
+  Promise.all(Object.keys(config['certificate-info']).map(getPEMsForCertInfo))
   .then(() => sync.succeed('Wrote PEM files..'))
 
-
 getAllPEMs(testContext)

config/default.json

@@ -2,9 +2,12 @@
   "s3-account-bucket": "<your-s3-account-config-bucket>",
   "s3-cert-bucket": "<your-s3-ssl-cert-bucket>",
   "s3-folder": "<folder-under-bucket>",
+  "certificate-info": {
+    "cert-name1": ["<first-domain-needing-certificate>", "<second-domain-needing-certificate>"],
+    "cert-name2": ["<third-domain-needing-certificate>", "<fourth-domain-needing-certificate>"]
+  },
   "acme-dns-retry": 30,
   "acme-dns-retry-delay-ms": 2000,
-  "acme-domains": ["<domain-needing-certificate>", "<optional-second-domain>"],
   "acme-account-file": "<where-to-save-generated-account-registration>",
   "acme-account-email": "<email-of-responsible-person>",
   "acme-account-key-bits": 2048,

package.json

@@ -23,12 +23,11 @@
   "author": "Larry Anderson",
   "license": "ISC",
   "dependencies": {
-    "aws-sdk": "~2.4.14",
+    "aws-sdk": "^2.20.0",
     "es6-promisify": "^4.1.0",
     "node-forge": "^0.6.45",
     "rsa-compat": "^1.2.7",
-    "superagent": "~1.8.4",
-    "superagent-promise": "^1.1.0"
+    "superagent": "^3.5.0"
   },
   "devDependencies": {
     "archiver": "^1.2.0",

src/acme/authorize/getChallenges.js

@@ -12,14 +12,22 @@ const validateChallenges = (domain, accountKeyPair, challengeResponse) => {
   ])
 }
 
-const getChallenges = (domain, keypair, authzUrl) =>
-  sendSignedRequest({
-    resource: 'new-authz',
-    identifier: {
-      type: 'dns',
-      value: domain
-    }
-  }, keypair, authzUrl)
-  .then((data) => validateChallenges(domain, keypair, data.body))
+const getChallenges = (domains, keypair, authzUrl) =>
+  Promise.all(
+    domains.map((domain) =>
+      sendSignedRequest({
+        resource: 'new-authz',
+        identifier: {
+          type: 'dns',
+          value: domain
+        }
+      }, keypair, authzUrl)
+      .then((data) => validateChallenges(domain, keypair, data.body))
+    )
+  )
+  .catch((err) => {
+    console.error('Experienced error getting challenges', err)
+    throw err
+  })
 
 module.exports = getChallenges

src/acme/authorize/sendDNSChallengeValidation.js

@@ -8,7 +8,7 @@ const sendDNSChallengeValidation = (dnsChallenge, acctKeyPair) =>
     }, acctKeyPair, dnsChallenge.uri)
     .then((data) => data.body)
     .catch((e) => {
-      console.log(`Couldn't send DNS challenge verification ${JSON.stringify(e)}.`)
+      console.error(`Couldn't send DNS challenge verification.`, e)
       throw e
     })
 

src/acme/authorize/updateDNSChallenge.js

@@ -17,7 +17,7 @@ const updateDNSChallenge = (domain, dnsChallenge, acctKeyPair) =>
   .then((id) => updateTXTRecord(id, domain, urlB64(getTokenDigest(dnsChallenge, acctKeyPair))))
   .then((updated) => validateDNSChallenge(domain, dnsChallenge, acctKeyPair))
   .catch((e) => {
-    console.log(`Couldn't write token digest to DNS record.`)
+    console.error(`Couldn't write token digest to DNS record.`, e)
     throw e
   })