"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.SelfSignedPkiGenerator = void 0;
const node_forge_1 = require("node-forge");
const uuid_1 = require("uuid");
const cactus_common_1 = require("@hyperledger/cactus-common");
/**
 * Do not use this for anything in a production deployment. It's meant as a helper
 * class for development and testing purposes (enhancing developer experience).
 *
 * Secure by default is one of our core design principles and it's much harder to
 * enforce/implement that it sounds when you also do not want to ruin the ease
 * of use of the software. Dynamically pre-provisioning PKI is notoriously
 * complicated and error prone to the average user/developer.
 *
 */
class SelfSignedPkiGenerator {
    create(commonName, parent) {
        const keyPair = node_forge_1.pki.rsa.generateKeyPair(4096);
        const privateKeyPem = node_forge_1.pki.privateKeyToPem(keyPair.privateKey);
        const certificate = node_forge_1.pki.createCertificate();
        this.configureCertificateParameters(keyPair, certificate, commonName);
        if (parent) {
            certificate.setIssuer(parent.certificate.subject.attributes);
            certificate.publicKey = keyPair.publicKey;
            // certificate.privateKey = keyPair.privateKey;
            certificate.sign(parent.keyPair.privateKey, node_forge_1.md.sha512.create());
            if (!parent.certificate.verify(certificate)) {
                throw new Error("Could not verify newly generated certificate");
            }
        }
        else {
            certificate.sign(keyPair.privateKey, node_forge_1.md.sha512.create());
        }
        const certificatePem = node_forge_1.pki.certificateToPem(certificate);
        return { keyPair, certificate, certificatePem, privateKeyPem };
    }
    configureCertificateParameters(keyPair, certificate, commonName) {
        // 20 octets max for serial numbers of certs as per the standard
        const serialNumber = cactus_common_1.Strings.replaceAll(uuid_1.v4(), "-", "").substring(0, 19);
        certificate.serialNumber = serialNumber;
        certificate.publicKey = keyPair.publicKey;
        certificate.privateKey = keyPair.privateKey;
        certificate.validity.notBefore = new Date();
        certificate.validity.notAfter = new Date();
        const nextYear = certificate.validity.notBefore.getFullYear() + 1;
        certificate.validity.notAfter.setFullYear(nextYear);
        const certificateFields = [
            {
                shortName: "CN",
                name: "commonName",
                value: commonName,
            },
            {
                name: "countryName",
                value: "Universe",
            },
            {
                shortName: "ST",
                value: "Milky Way",
            },
            {
                shortName: "L",
                name: "localityName",
                value: "Planet Earth",
            },
            {
                shortName: "O",
                name: "organizationName",
                value: "Hyperledger",
            },
            {
                shortName: "OU",
                value: "Cactus",
            },
            {
                name: "unstructuredName",
                value: "Cactus Dummy Self Signed Certificates",
            },
        ];
        certificate.setSubject(certificateFields);
        certificate.setIssuer(certificateFields);
        certificate.setExtensions([
            {
                name: "basicConstraints",
                cA: true,
            },
            {
                name: "keyUsage",
                keyCertSign: true,
                digitalSignature: true,
                nonRepudiation: true,
                keyEncipherment: true,
                dataEncipherment: true,
            },
            {
                name: "extKeyUsage",
                serverAuth: true,
                clientAuth: true,
                codeSigning: true,
                emailProtection: true,
                timeStamping: true,
            },
            {
                name: "nsCertType",
                client: true,
                server: true,
                email: true,
                objsign: true,
                sslCA: true,
                emailCA: true,
                objCA: true,
            },
            {
                name: "subjectAltName",
                altNames: [
                    {
                        type: 7,
                        ip: "127.0.0.1",
                    },
                ],
            },
            {
                name: "subjectKeyIdentifier",
            },
        ]);
        return certificate;
    }
}
exports.SelfSignedPkiGenerator = SelfSignedPkiGenerator;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VsZi1zaWduZWQtcGtpLWdlbmVyYXRvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9tYWluL3R5cGVzY3JpcHQvY29uZmlnL3NlbGYtc2lnbmVkLXBraS1nZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkNBQXFDO0FBQ3JDLCtCQUFvQztBQUNwQyw4REFBcUQ7QUFpQnJEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQWEsc0JBQXNCO0lBQzFCLE1BQU0sQ0FBQyxVQUFrQixFQUFFLE1BQWE7UUFDN0MsTUFBTSxPQUFPLEdBQW9CLGdCQUFHLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMvRCxNQUFNLGFBQWEsR0FBVyxnQkFBRyxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdEUsTUFBTSxXQUFXLEdBQUcsZ0JBQUcsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBRTVDLElBQUksQ0FBQyw4QkFBOEIsQ0FBQyxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3RFLElBQUksTUFBTSxFQUFFO1lBQ1YsV0FBVyxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUM3RCxXQUFXLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUM7WUFDMUMsK0NBQStDO1lBQy9DLFdBQVcsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsZUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBRWhFLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRTtnQkFDM0MsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO2FBQ2pFO1NBQ0Y7YUFBTTtZQUNMLFdBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxlQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7U0FDMUQ7UUFFRCxNQUFNLGNBQWMsR0FBRyxnQkFBRyxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxhQUFhLEVBQUUsQ0FBQztJQUNqRSxDQUFDO0lBRU0sOEJBQThCLENBQ25DLE9BQXdCLEVBQ3hCLFdBQTRCLEVBQzVCLFVBQWtCO1FBRWxCLGdFQUFnRTtRQUNoRSxNQUFNLFlBQVksR0FBRyx1QkFBTyxDQUFDLFVBQVUsQ0FBQyxTQUFNLEVBQUUsRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM1RSxXQUFXLENBQUMsWUFBWSxHQUFHLFlBQVksQ0FBQztRQUN4QyxXQUFXLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUM7UUFDMUMsV0FBVyxDQUFDLFVBQVUsR0FBRyxPQUFPLENBQUMsVUFBVSxDQUFDO1FBQzVDLFdBQVcsQ0FBQyxRQUFRLENBQUMsU0FBUyxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDNUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxRQUFRLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUUzQyxNQUFNLFFBQVEsR0FBRyxXQUFXLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxXQUFXLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDbEUsV0FBVyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXBELE1BQU0saUJBQWlCLEdBQTRCO1lBQ2pEO2dCQUNFLFNBQVMsRUFBRSxJQUFJO2dCQUNmLElBQUksRUFBRSxZQUFZO2dCQUNsQixLQUFLLEVBQUUsVUFBVTthQUNsQjtZQUNEO2dCQUNFLElBQUksRUFBRSxhQUFhO2dCQUNuQixLQUFLLEVBQUUsVUFBVTthQUNsQjtZQUNEO2dCQUNFLFNBQVMsRUFBRSxJQUFJO2dCQUNmLEtBQUssRUFBRSxXQUFXO2FBQ25CO1lBQ0Q7Z0JBQ0UsU0FBUyxFQUFFLEdBQUc7Z0JBQ2QsSUFBSSxFQUFFLGNBQWM7Z0JBQ3BCLEtBQUssRUFBRSxjQUFjO2FBQ3RCO1lBQ0Q7Z0JBQ0UsU0FBUyxFQUFFLEdBQUc7Z0JBQ2QsSUFBSSxFQUFFLGtCQUFrQjtnQkFDeEIsS0FBSyxFQUFFLGFBQWE7YUFDckI7WUFDRDtnQkFDRSxTQUFTLEVBQUUsSUFBSTtnQkFDZixLQUFLLEVBQUUsUUFBUTthQUNoQjtZQUNEO2dCQUNFLElBQUksRUFBRSxrQkFBa0I7Z0JBQ3hCLEtBQUssRUFBRSx1Q0FBdUM7YUFDL0M7U0FDRixDQUFDO1FBRUYsV0FBVyxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBRTFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUV6QyxXQUFXLENBQUMsYUFBYSxDQUFDO1lBQ3hCO2dCQUNFLElBQUksRUFBRSxrQkFBa0I7Z0JBQ3hCLEVBQUUsRUFBRSxJQUFJO2FBQ1Q7WUFDRDtnQkFDRSxJQUFJLEVBQUUsVUFBVTtnQkFDaEIsV0FBVyxFQUFFLElBQUk7Z0JBQ2pCLGdCQUFnQixFQUFFLElBQUk7Z0JBQ3RCLGNBQWMsRUFBRSxJQUFJO2dCQUNwQixlQUFlLEVBQUUsSUFBSTtnQkFDckIsZ0JBQWdCLEVBQUUsSUFBSTthQUN2QjtZQUNEO2dCQUNFLElBQUksRUFBRSxhQUFhO2dCQUNuQixVQUFVLEVBQUUsSUFBSTtnQkFDaEIsVUFBVSxFQUFFLElBQUk7Z0JBQ2hCLFdBQVcsRUFBRSxJQUFJO2dCQUNqQixlQUFlLEVBQUUsSUFBSTtnQkFDckIsWUFBWSxFQUFFLElBQUk7YUFDbkI7WUFDRDtnQkFDRSxJQUFJLEVBQUUsWUFBWTtnQkFDbEIsTUFBTSxFQUFFLElBQUk7Z0JBQ1osTUFBTSxFQUFFLElBQUk7Z0JBQ1osS0FBSyxFQUFFLElBQUk7Z0JBQ1gsT0FBTyxFQUFFLElBQUk7Z0JBQ2IsS0FBSyxFQUFFLElBQUk7Z0JBQ1gsT0FBTyxFQUFFLElBQUk7Z0JBQ2IsS0FBSyxFQUFFLElBQUk7YUFDWjtZQUNEO2dCQUNFLElBQUksRUFBRSxnQkFBZ0I7Z0JBQ3RCLFFBQVEsRUFBRTtvQkFDUjt3QkFDRSxJQUFJLEVBQUUsQ0FBQzt3QkFDUCxFQUFFLEVBQUUsV0FBVztxQkFDaEI7aUJBQ0Y7YUFDRjtZQUNEO2dCQUNFLElBQUksRUFBRSxzQkFBc0I7YUFDN0I7U0FDRixDQUFDLENBQUM7UUFFSCxPQUFPLFdBQVcsQ0FBQztJQUNyQixDQUFDO0NBQ0Y7QUE3SEQsd0RBNkhDIn0=