1// Copyright Joyent, Inc. and other Node contributors.
2//
3// Permission is hereby granted, free of charge, to any person obtaining a
4// copy of this software and associated documentation files (the
5// "Software"), to deal in the Software without restriction, including
6// without limitation the rights to use, copy, modify, merge, publish,
7// distribute, sublicense, and/or sell copies of the Software, and to permit
8// persons to whom the Software is furnished to do so, subject to the
9// following conditions:
10//
11// The above copyright notice and this permission notice shall be included
12// in all copies or substantial portions of the Software.
13//
14// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
17// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
18// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
19// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
20// USE OR OTHER DEALINGS IN THE SOFTWARE.
21
22'use strict';
23const common = require('../common');
24const fixtures = require('../common/fixtures');
25if (!common.hasCrypto) {
26  common.skip('missing crypto');
27}
28const crypto = require('crypto');
29
30// Verify that detailed getPeerCertificate() return value has all certs.
31
32const {
33  assert, connect, debug, keys
34} = require(fixtures.path('tls-connect'));
35
36function sha256(s) {
37  return crypto.createHash('sha256').update(s);
38}
39
40connect({
41  client: { rejectUnauthorized: false },
42  server: keys.agent1,
43}, function(err, pair, cleanup) {
44  assert.ifError(err);
45  const socket = pair.client.conn;
46  const localCert = socket.getCertificate();
47  assert.deepStrictEqual(localCert, {});
48  let peerCert = socket.getPeerCertificate();
49  assert.ok(!peerCert.issuerCertificate);
50
51  peerCert = socket.getPeerCertificate(true);
52  debug('peerCert:\n', peerCert);
53
54  assert.ok(peerCert.issuerCertificate);
55  assert.strictEqual(peerCert.ca, false);
56  assert.strictEqual(peerCert.issuerCertificate.ca, true);
57  assert.strictEqual(peerCert.subject.emailAddress, 'ry@tinyclouds.org');
58  assert.strictEqual(peerCert.serialNumber, '147D36C1C2F74206DE9FAB5F2226D78ADB00A426');
59  assert.strictEqual(peerCert.exponent, '0x10001');
60  assert.strictEqual(peerCert.bits, 2048);
61  // The conversion to bits is odd because modulus isn't a buffer, its a hex
62  // string. There are two hex chars for every byte of modulus, and 8 bits per
63  // byte.
64  assert.strictEqual(peerCert.modulus.length / 2 * 8, peerCert.bits);
65  assert.strictEqual(
66    peerCert.fingerprint,
67    '8B:89:16:C4:99:87:D2:13:1A:64:94:36:38:A5:32:01:F0:95:3B:53'
68  );
69  assert.strictEqual(
70    peerCert.fingerprint256,
71    '2C:62:59:16:91:89:AB:90:6A:3E:98:88:A6:D3:C5:58:58:6C:AE:FF:9C:33:' +
72    '22:7C:B6:77:D3:34:E7:53:4B:05',
73  );
74  assert.strictEqual(
75    peerCert.fingerprint512,
76    '0B:6F:D0:4D:6B:22:53:99:66:62:51:2D:2C:96:F2:58:3F:95:1C:CC:4C:44:' +
77    '9D:B5:59:AA:AD:A8:F6:2A:24:8A:BB:06:A5:26:42:52:30:A3:37:61:30:A9:' +
78    '5A:42:63:E0:21:2F:D6:70:63:07:96:6F:27:A7:78:12:08:02:7A:8B'
79  );
80
81  // SHA256 fingerprint of the public key
82  assert.strictEqual(
83    sha256(peerCert.pubkey).digest('hex'),
84    '490f8da0889339df5164d500b406de0af3249c174c2b60152528940fa116e9cc'
85  );
86
87  // HPKP / RFC7469 "pin-sha256" of the public key
88  assert.strictEqual(
89    sha256(peerCert.pubkey).digest('base64'),
90    'SQ+NoIiTOd9RZNUAtAbeCvMknBdMK2AVJSiUD6EW6cw='
91  );
92
93  assert.deepStrictEqual(peerCert.infoAccess['OCSP - URI'],
94                         [ 'http://ocsp.nodejs.org/' ]);
95
96  const issuer = peerCert.issuerCertificate;
97  assert.strictEqual(issuer.issuerCertificate, issuer);
98  assert.strictEqual(issuer.serialNumber, '4AB16C8DFD6A7D0D2DFCABDF9C4B0E92C6AD0229');
99
100  return cleanup();
101});
102
103connect({
104  client: { rejectUnauthorized: false },
105  server: keys.ec,
106}, function(err, pair, cleanup) {
107  assert.ifError(err);
108  const socket = pair.client.conn;
109  let peerCert = socket.getPeerCertificate(true);
110  assert.ok(peerCert.issuerCertificate);
111
112  peerCert = socket.getPeerCertificate(true);
113  debug('peerCert:\n', peerCert);
114
115  assert.ok(peerCert.issuerCertificate);
116  assert.strictEqual(peerCert.subject.emailAddress, 'ry@tinyclouds.org');
117  assert.strictEqual(peerCert.serialNumber, '32E8197681DA33185867B52885F678BFDBA51727');
118  assert.strictEqual(peerCert.exponent, undefined);
119  assert.strictEqual(peerCert.pubKey, undefined);
120  assert.strictEqual(peerCert.modulus, undefined);
121  assert.strictEqual(
122    peerCert.fingerprint,
123    '31:EB:2C:7B:AA:39:E8:E8:F5:43:62:05:CD:64:B3:66:1E:EA:44:A3'
124  );
125  assert.strictEqual(
126    peerCert.fingerprint256,
127    'B9:27:E4:8F:C0:F5:E3:FD:A6:E5:96:11:DB:69:B8:80:94:8B:0F:6A:4C:D6:80:4F:' +
128    '87:31:3C:A3:77:6C:4C:0A'
129  );
130  assert.strictEqual(
131    peerCert.fingerprint512,
132    '45:E3:ED:6E:22:1C:3C:DD:D7:E1:65:A9:30:6E:79:0C:9F:98:B8:BC:24:BB:BA:32:' +
133    '54:4D:70:4E:78:4F:1B:97:3C:A7:F5:DB:06:F1:36:E9:53:4C:0A:D2:86:83:79:8A:' +
134    '72:2B:81:55:5D:6F:BC:A6:5B:61:85:26:6B:9D:3E:E8'
135  );
136
137  assert.strictEqual(
138    sha256(peerCert.pubkey).digest('hex'),
139    'ec68fc7d5e32cd4e1da5a7b59c0a2229be6f82fcc9bf8c8691a2262aacb14f53'
140  );
141  assert.strictEqual(peerCert.asn1Curve, 'prime256v1');
142  assert.strictEqual(peerCert.nistCurve, 'P-256');
143  assert.strictEqual(peerCert.bits, 256);
144
145  assert.strictEqual(peerCert.infoAccess, undefined);
146
147  const issuer = peerCert.issuerCertificate;
148  assert.strictEqual(issuer.issuerCertificate, issuer);
149  assert.strictEqual(issuer.serialNumber, '32E8197681DA33185867B52885F678BFDBA51727');
150
151  return cleanup();
152});
153