TypeScript node-forge.pki类代码示例

  verifySigningChain(certChain: string | ICert[] | ICert): boolean {
    let forgeCertArray: any[] = [];

    if (typeof certChain === "string") {
      const rPEM = /\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g;
      let forgeCert: any;
      let match;

      while((match = rPEM.exec(certChain)) !== null) {
        try {
          forgeCert = forge.pki.certificateFromPem(match[0]);
        } catch (error) {
          throw new Error(``);
        }
        forgeCertArray.push(forgeCert);
      }
    } else if (Array.isArray(certChain)) {
      for (let cert of certChain) {
        if (isICert(cert)) {
          forgeCertArray.push(forge.pki.certificateFromPem(cert.pem));
        } else {
          throw new Error(``);
        }
      }
    } else if (isICert(certChain)) {
      forgeCertArray.push(forge.pki.certificateFromPem(certChain.pem));
    } else {
      throw new Error(``);
    }

    return forge.pki.verifyCertificateChain(this._forgeCAStore, forgeCertArray, true);
  }

  fingerprint(hash: "sha1" | "sha256" | "sha384" | "sha512" | "md5" = "sha1"): string {
    let md: any;
    const forgeCSR = forge.pki.certificateFromPem(this._pem, true, true);

    switch (hash) {
      case "sha1":
        md = forge.md.sha1.create();
        break;
      case "sha256":
        md = forge.md.sha256.create();
        break;
      case "sha384":
        md = forge.md.sha384.create();
        break;
      case "sha512":
        md = forge.md.sha512.create();
        break;
      case "md5":
        md = forge.md.md5.create();
        break;
      default:
        throw new Error(`Unrecognized message digest hash algorithm: ${hash}`);
    }

    const result = md
      .update(forge.asn1.toDer(forge.pki.certificateToAsn1(forgeCSR)).getBytes())
      .digest()
      .toHex();

    return result;
  }

export async function createRsaKeyPair(): Promise<KeyPair> {
  const keypair = await promisify(forge.pki.rsa.generateKeyPair)({
    bits: 2048,
  })

  return {
    public: forge.pki.publicKeyToPem(keypair.publicKey),
    private: forge.pki.privateKeyToPem(keypair.privateKey),
  }
}

  listCertsAsPEMStrings(): string[] {
    const result: string[] = [];
    const forgeCerts: any[] = this._forgeCAStore.listAllCertificates();

    for (let forgeCert of forgeCerts) {
      result.push(forge.pki.certificateToPem(forgeCert));
    }

    return result;
  }

  constructor(arg: string | ICSR) {
    if (isICSR(arg)) {
      this._publicKeyPEM = arg.publicKeyPEM;
      this._numBits = arg.numBits;
      this._pem = arg.pem;
      this._subject = arg.subject;
      this._v3Extensions = arg.v3Extensions;
      this._hash = arg.hash;
      this._challengePassword = arg.challengePassword;
      this._unstructuredName = arg.unstructuredName;
    } else if (typeof arg === "string") {
      let forgeCSR: any;

      try {
        forgeCSR = forge.pki.certificationRequestFromPem(arg, true, true);
      } catch (error) {
        throw new Error(`Could not construct CSR from given pem string "${arg}"${"\n"
        }issue: ${error.message}`);
      }
      this._publicKeyPEM = forge.pki.publicKeyToPem(forgeCSR.publicKey);
      this._numBits = forgeCSR.publicKey.n.bitLength();
      this._pem = arg;
      this._subject = DistinguishedName.forgeCSROrCertToIDN(forgeCSR, "subject");
      this._v3Extensions = forgeCSROrCertToV3ExtensionArray(forgeCSR);
      this._hash = forgeCSR.md.algorithm;

      if (forgeCSR.getAttribute({name: "challengePassword"})) {
        this._challengePassword
          = forgeCSR.getAttribute({name: "challengePassword"}).value;
      } else {
        this._challengePassword = null;
      }

      if (forgeCSR.getAttribute({name: "unstructuredName"})) {
        this._unstructuredName = forgeCSR.getAttribute({name: "unstructuredName"}).value;
      } else {
        this._unstructuredName = null;
      }

    } else {
      throw new Error(`The CSR constructor argument "${arg}" is not acceptable`);
    }
  }

  constructor(caCerts?: Array<ICert | string>) {
    this._forgeCAStore = forge.pki.createCaStore();

    if (Array.isArray(caCerts)) {
      for (let cert of caCerts) {
        this.addCert(cert);
      }
    } else if (caCerts !== null && typeof caCerts !== "undefined") {
      throw new Error(``);
    }
  }

  constructor(arg: string | ICert) {
    if (isICert(arg)) {
      this._publicKeyPEM = arg.publicKeyPEM;
      this._numBits = arg.numBits;
      this._pem = arg.pem;
      this._subject = arg.subject;
      this._issuer = arg.issuer;
      this._v3Extensions = arg.v3Extensions;
      this._serial = arg.serial;
      this._hash = arg.hash;
      this._startDate = (typeof arg.startDate === "number") ?
        new Date(arg.startDate)
        :
        arg.startDate;
      this._endDate = (typeof arg.endDate === "number") ?
        new Date(arg.endDate)
        :
        arg.endDate;
    } else if (typeof arg === "string") {
      let forgeCert: any;

      try {
        forgeCert = forge.pki.certificateFromPem(arg, true, true);
      } catch (error) {
        throw new Error(`Could not construct Cert from given pem string "${arg}"${"\n"
          }issue: ${error.message}`);
      }
      this._publicKeyPEM = forge.pki.publicKeyToPem(forgeCert.publicKey);
      this._numBits = forgeCert.publicKey.n.bitLength();
      this._pem = arg;
      this._subject = DistinguishedName.forgeCSROrCertToIDN(forgeCert, "subject");
      this._issuer = DistinguishedName.forgeCSROrCertToIDN(forgeCert, "issuer");
      this._v3Extensions = forgeCSROrCertToV3ExtensionArray(forgeCert);
      this._serial = parseInt(forgeCert.serialNumber, 16);
      this._hash = forgeCert.md.algorithm;
      this._startDate = forgeCert.validity.notBefore;
      this._endDate = forgeCert.validity.notAfter;
    } else {
      throw new Error(`The Cert constructor argument "${arg}" is not acceptable`);
    }
  }

/**
 * Converts a P12 in base64 encoding to a pem.
 * @param p12base64 String containing base64 encoded p12.
 * @returns a string containing the pem.
 */
function convertToPem(p12base64: string): string {
  const p12Der = forge.util.decode64(p12base64);
  const p12Asn1 = forge.asn1.fromDer(p12Der);
  const p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, 'notasecret');
  const bags = p12.getBags({friendlyName: 'privatekey'});
  if (bags.friendlyName) {
    const privateKey = bags.friendlyName[0].key!;
    const pem = forge.pki.privateKeyToPem(privateKey);
    return pem.replace(/\r\n/g, '\n');
  } else {
    throw new Error('Unable to get friendly name.');
  }
}

  removeCert(cert: ICert | string): ICert | null {
    let result: null | ICert;

    const removedForgeCert = this._forgeCAStore.removeCertificate(
      convertICertOrPEMStringToForgeCert(cert)
    );

    if (removedForgeCert === null) {
      result = null;
    } else {
      result = new Cert(forge.pki.certificateToPem(removedForgeCert));
    }

    return result;
  }

function convertICertOrPEMStringToForgeCert(cert: ICert | string): any {
  let certPEM: string;
  let forgeCert: any;

  if (isICert(cert)) {
    certPEM = cert.pem;
  } else if (typeof cert === "string") {
    certPEM = cert;
  } else {
    throw new Error(``);
  }

  try {
    forgeCert = forge.pki.certificateFromPem(certPEM);
  } catch (error) {
    throw new Error(``);
  }

  return forgeCert;
}