FilesExpand file tree

codeql-bundle-v2.27.3

/

ca.ts

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

81 lines (71 loc) · 1.76 KB

codeql-bundle-v2.27.3

/

ca.ts

Copy path

Top

File metadata and controls

• Code
• Blame

81 lines (71 loc) · 1.76 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

import { md, pki } from "node-forge";

import { CertificateAuthority } from "./types";

const KEY_SIZE = 2048;

const KEY_EXPIRY_YEARS = 2;

const CERT_SUBJECT = [

{

name: "commonName",

value: "Dependabot Internal CA",

},

{

name: "organizationName",

value: "GitHub inc.",

},

{

shortName: "OU",

value: "Dependabot",

},

{

name: "countryName",

value: "US",

},

{

shortName: "ST",

value: "California",

},

{

name: "localityName",

value: "San Francisco",

},

];

export type Extension = {

name: string;

[key: string]: unknown;

};

const allExtensions: Extension[] = [

{ name: "basicConstraints", cA: true },

{

name: "keyUsage",

critical: true,

keyCertSign: true,

cRLSign: true,

digitalSignature: true,

},

{ name: "subjectKeyIdentifier" },

{ name: "authorityKeyIdentifier", keyIdentifier: true },

];

/**

* Generates a CA certificate for the proxy.

*

* @returns The private and public keys.

*/

export function generateCertificateAuthority(): CertificateAuthority {

const keys = pki.rsa.generateKeyPair(KEY_SIZE);

const cert = pki.createCertificate();

cert.publicKey = keys.publicKey;

cert.serialNumber = "01";

cert.validity.notBefore = new Date();

cert.validity.notAfter = new Date();

cert.validity.notAfter.setFullYear(

cert.validity.notBefore.getFullYear() + KEY_EXPIRY_YEARS,

);

cert.setSubject(CERT_SUBJECT);

cert.setIssuer(CERT_SUBJECT);

// Set the CA extensions for the certificate.

cert.setExtensions(allExtensions);

// Specifically use SHA256 to ensure consistency and compatibility.

cert.sign(keys.privateKey, md.sha256.create());

const pem = pki.certificateToPem(cert);

const key = pki.privateKeyToPem(keys.privateKey);

return { cert: pem, key };

}