Skip to content

Commit d26a96a

Browse files
author
Rene Bartsch
committed
Initial version.
1 parent 4d698f5 commit d26a96a

File tree

2 files changed

+191
-0
lines changed

2 files changed

+191
-0
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Do not add local compilations
2+
forge.min.js

‎batls.html

+189
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
<html>
2+
<head>
3+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
4+
<meta name="author" content="Rene Bartsch, B.Sc. Informatics, <[email protected]>">
5+
<noscript><div id="noscript">!!! Sorry, ECMAscript/Javascript not available !!!</div></noscript>
6+
<title>Blockchain-Authenticated Transport Layer Security (BATLS) - X.509 certificate generation and registration</title>
7+
8+
<!-- X.509 Forge Javascript libraries (https://github.com/digitalbazaar/forge) -->
9+
<script language="JavaScript" type="text/javascript" src="forge.min.js"></script>
10+
11+
<!-- Javascript functions -->
12+
<script language="javascript" type="text/javascript">
13+
14+
/*
15+
function registerInBlockchain(identity, fingerprint) {
16+
alert("Adding Identity: " + identity + "\nand\nFingerprint: " + fingerprint\n to blockchain);
17+
}
18+
*/
19+
20+
/**
21+
* Create a self-signed X.509 client-certificate.
22+
*
23+
* @param organizationName string X.509 OrganizationName.
24+
* @param organizationalUnitName string X.509 OrganizationalUnitName.
25+
* @param commonName string X.509 CommonName.
26+
* @param subjectAltNames string Array of X.509 Subject Alternate dnsNames without CommonName suffix.
27+
* @param password string PKCS12 Import password.
28+
* @param ttl uint Certificate Time-To-Live in seconds (NOW + TTL = X.509 certificate expiration date).
29+
*
30+
* @return string Hex-encoded fingerprint of certificate (same hash algorithm like signature algotrithm)
31+
*
32+
* @pre Digital Bazaar Forge library (https://github.com/digitalbazaar/forge) must be available/included.
33+
* @post Nothing.
34+
*
35+
*
36+
*
37+
*/
38+
function generateX509Certificate(organizationName, organizationalUnitName, commonName, subjectAltNames, password, ttl) {
39+
40+
// Create X.509 certificate object
41+
var cert = forge.pki.createCertificate();
42+
43+
// Generate 4096-bit RSA keypair
44+
// var keys = forge.pki.rsa.generateKeyPair(4096);
45+
var keys = forge.pki.rsa.generateKeyPair(512);
46+
47+
// Add public key to certificate
48+
cert.publicKey = keys.publicKey;
49+
50+
// Set serial number
51+
cert.serialNumber = '0';
52+
53+
// Set certificate start date to NOW
54+
cert.validity.notBefore = new Date();
55+
56+
// Set certificate expiration date to NOW + ttl seconds
57+
cert.validity.notAfter = new Date();
58+
cert.validity.notAfter.setSeconds(cert.validity.notAfter.getSeconds() + ttl);
59+
60+
// Set issuer and subject attributes
61+
var attrs = [{
62+
name: 'organizationName',
63+
value: organizationName
64+
}, {
65+
name: 'organizationalUnitName',
66+
value: organizationalUnitName
67+
}, {
68+
name: 'commonName',
69+
value: commonName
70+
}];
71+
cert.setIssuer(attrs);
72+
cert.setSubject(attrs);
73+
74+
75+
76+
// Create subject alternative names for extension constraints
77+
var altNames = [];
78+
if (subjectAltNames !== null) {
79+
for (index = 0; index < subjectAltNames.length; ++index) {
80+
altNames[index] = {
81+
type: 2,
82+
value: subjectAltNames[index] + "." + commonName + ".bit"
83+
}
84+
}
85+
}
86+
87+
// Add extension constraints
88+
cert.setExtensions([
89+
{
90+
name: 'basicConstraints',
91+
cA: false
92+
}, {
93+
name: 'subjectAltName',
94+
altNames: altNames
95+
}
96+
]);
97+
98+
99+
// Create SHA1 hash object (SHA256 not supported by Firefox)
100+
var hash = forge.md.sha1.create();
101+
102+
// Self-sign certificate
103+
cert.sign(keys.privateKey, hash);
104+
105+
// Wrap ASN.1 with private key into password-protected PKCS12-container (Chrome/Firefox can only handle 3DES encryption)
106+
var pkcs12 = forge.pkcs12.toPkcs12Asn1(keys.privateKey, [cert], password, {algorithm: '3des'});
107+
108+
// Clear RSA key-pair and password for security reasons
109+
// keys = null;
110+
password = null;
111+
112+
// Convert PKCS12 to DER format
113+
var pkcs12Der = forge.asn1.toDer(pkcs12).getBytes();
114+
115+
116+
// Store certificate on disk
117+
var a = document.createElement('a');
118+
a.download = 'Namecoin-' + commonName + ".p12";
119+
// a.setAttribute('href','data:application/x-x509-user-cert,' + pkcs12Der);
120+
a.setAttribute('href','data:application/x-pkcs12;base64,' + forge.util.encode64(pkcs12Der));
121+
a.appendChild(document.createTextNode('Click to Download Client Certificate'));
122+
document.body.appendChild(a);
123+
124+
/*
125+
// Import certificate into browser
126+
var iframe = document.createElement('iframe');
127+
// iframe.setAttribute('style', 'display: none;');
128+
iframe.setAttribute('src','data:application/x-x509-user-cert;base64,' + forge.util.encode64(pkcs12Der));
129+
document.body.appendChild(iframe);
130+
*/
131+
132+
133+
// Calculate and return certificate fingerprint in hexa-decimal notation
134+
var asn1 = forge.pki.certificateToAsn1(cert);
135+
var der = forge.asn1.toDer(asn1);
136+
var fingerprint = forge.md.sha1.create();
137+
fingerprint.update(der.bytes());
138+
return(fingerprint.digest().toHex());
139+
}
140+
141+
142+
function getFormData() {
143+
var rpcaddress = document.getElementById("rpcaddress").value;
144+
var rpcport = document.getElementById("rpcport").value;
145+
var rpcuser = document.getElementById("rpcuser").value;
146+
var rpcpassword = document.getElementById("rpcpassword").value;
147+
var identity = document.getElementById("identity").value;
148+
var subjectAltNames = document.getElementById("subjectAltNames").value;
149+
var password1 = document.getElementById("password1").value;
150+
var password2 = document.getElementById("password2").value;
151+
152+
alert(
153+
"\nRPCAddress: " + rpcaddress
154+
+ "\nRPCPort: " + rpcport
155+
+ "\nRPCUser: " + rpcuser
156+
+ "\nRPCPassword: " + rpcpassword
157+
+ "\nIdentity: " + identity
158+
+ "\nSubjectAltNames: " + subjectAltNames
159+
+ "\nPassword1: " + password1
160+
+ "\nPassword2: " + password2
161+
);
162+
163+
alert("Generating RSA keypair. This can take a lot of time ...");
164+
// var result = generateX509Certificate("InternetCommunity", "Namecoin", identity, ["www", "mail"], password1, (32000 * 10 * 60));
165+
var result = generateX509Certificate("InternetCommunity", "Namecoin", identity, null, password1, (32000 * 10 * 60));
166+
alert("Fingerprint: " + result);
167+
168+
}
169+
170+
</script>
171+
172+
</head>
173+
<body>
174+
<form>
175+
<div>RPCAddress: <input type="text" id="rpcaddress" name="rpcaddress" value="127.0.0.1"></div>
176+
<div>RPCPort: <input type="text" id="rpcport" name="rpcport" value="8336" ></div>
177+
<div>RPCUser: <input type="text" id="rpcuser" name="rpcuser" value="" ></div>
178+
<div>RPCPassword: <input type="text" id="rpcpassword" name="rpcpassword" value=""></div>
179+
<div>Identity: <select id="identity" name="identity">
180+
<option>JohnDoe</option>
181+
</select></div>
182+
<div>Subdomains: <input type="textarea" id="subjectAltNames" name="subjectAltNames" value="" ></div>
183+
<div>Password: <input type="password" id="password1" name="password1" value="0815"></div>
184+
<div>Repeat: <input type="password" id="password2" name="password2" value="0815"></div>
185+
<div><input type="button" value="OK" onclick="getFormData();"></div>
186+
</form>
187+
<div id="certificate"></div>
188+
</body>
189+
</html>

0 commit comments

Comments
 (0)