npm start fails with below: <div class="snippet-c

Waiting on this: <a class="issue-link js-issue-link" data-error-text="Failed to load t

Actually I just noticed selfsigned <a href="https://g

Looks like <a href="https://github.com/choojs/bankai/blob/858a25bba8c37e79c14bb8115c23

Turns out the default expiration for <a href="https://github.com/jfromaniello/selfsign

SSL key too small, project doesn't start about bankai HOT 6 OPEN

Jake-Gillberg commented on June 1, 2024 3

SSL key too small, project doesn't start

from bankai.

Comments (6)

blahah commented on June 1, 2024 2

Waiting on this: jfromaniello/selfsigned#35

from bankai.

blahah commented on June 1, 2024 1

It's definitely sub-optimal to be failing because the key is too weak. Any secured linux distro will enforce the SSL DEFAULT@SECLEVEL=2, and compromising the security of the whole system for the sake of one module seems problematic.

This appears to be a NodeJS core TLS module issue?

from bankai.

blahah commented on June 1, 2024 1

Actually I just noticed selfsigned hardcodes one side of the cert to be 1024. I am making a PR to that project to respect keySize for both keys, which we should wait for before considering this fixed.

from bankai.

goto-bus-stop commented on June 1, 2024

I think bankai's createKeys function can probably be updated to fix this somehow? I don't really know what it would look like, but if anyone's interested in trying to contribute a fix, this is probably the place to investigate!

bankai/lib/http-server.js

Lines 110 to 179 in 858a25b

 function createKeys (cb) { 

 mkdirp(CONFIG_DIR, function (err) { 

 if (err) return cb(err) 

 fs.readdir(CONFIG_DIR, function (err, files) { 

 if (err) return cb(err) 

 var keys = {} 

 // check if both files exist 

 if (files.indexOf(KEY_NAME) !== -1 && files.indexOf(CERT_NAME) !== -1) { 

 return async.parallel([ 

 function (done) { 

 fs.readFile(CERT_LOCATION, function (err, buf) { 

 if (err) return done(err) 

 keys.cert = buf 

 done() 

 }) 

 }, 

 function (done) { 

 fs.readFile(KEY_LOCATION, function (err, buf) { 

 if (err) return done(err) 

 keys.key = buf 

 done() 

 }) 

 } 

 ], function (err) { 

 if (err) return cb(err) 

 cb(null, keys) 

 }) 

 } 

 var opts = { 

 days: 2048, 

 algorithm: 'sha256', 

 extensions: [ 

 { 

 name: 'subjectAltName', 

 altNames: [ 

 { 

 type: 2, // DNSName 

 value: 'localhost' 

 } 

 ] 

 } 

 ] 

 } 

 selfsigned.generate([{ name: 'commonName', value: 'localhost' }], opts, function (err, keys) { 

 if (err) return cb(err) 

 keys = { 

 key: keys.private, 

 cert: keys.cert 

 } 

 async.parallel([ 

 function (done) { 

 fs.writeFile(KEY_LOCATION, keys.key, done) 

 }, 

 function (done) { 

 fs.writeFile(CERT_LOCATION, keys.cert, done) 

 } 

 ], function (err) { 

 if (err) return cb(err) 

 cb(null, keys) 

 }) 

 }) 

 }) 

 }) 

 }

from bankai.

blahah commented on June 1, 2024

Looks like a fix was pre-emptively attempted in the past, but a typo led to it not working (keySize rather than days should have been set to 2048).

It's better to have keys expire frequently BTW, especially in this sort of situation where they are easily regenerated by trusted applications. I'd recommend using a 90 day expiry the same as LetsEncrypt. This protects to some extent against key exfiltration by malware, bots etc. by limit the amount of time an exfiltrated key can be used maliciously.

PR incoming...

from bankai.

blahah commented on June 1, 2024

Turns out the default expiration for selfsigned, which is doing the cert generation, is 30 days, which is more secure. So in my PR I've just switched days for keySize, meaning days will default to 30 which I suspect was the intention of the original edit.

from bankai.

SSL key too small, project doesn't start about bankai HOT 6 OPEN

Comments (6)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	function createKeys (cb) {
	mkdirp(CONFIG_DIR, function (err) {
	if (err) return cb(err)

	fs.readdir(CONFIG_DIR, function (err, files) {
	if (err) return cb(err)
	var keys = {}

	// check if both files exist
	if (files.indexOf(KEY_NAME) !== -1 && files.indexOf(CERT_NAME) !== -1) {
	return async.parallel([
	function (done) {
	fs.readFile(CERT_LOCATION, function (err, buf) {
	if (err) return done(err)
	keys.cert = buf
	done()
	})
	},
	function (done) {
	fs.readFile(KEY_LOCATION, function (err, buf) {
	if (err) return done(err)
	keys.key = buf
	done()
	})
	}
	], function (err) {
	if (err) return cb(err)
	cb(null, keys)
	})
	}

	var opts = {
	days: 2048,
	algorithm: 'sha256',
	extensions: [
	{
	name: 'subjectAltName',
	altNames: [
	{
	type: 2, // DNSName
	value: 'localhost'
	}
	]
	}
	]
	}

	selfsigned.generate([{ name: 'commonName', value: 'localhost' }], opts, function (err, keys) {
	if (err) return cb(err)

	keys = {
	key: keys.private,
	cert: keys.cert
	}

	async.parallel([
	function (done) {
	fs.writeFile(KEY_LOCATION, keys.key, done)
	},
	function (done) {
	fs.writeFile(CERT_LOCATION, keys.cert, done)
	}
	], function (err) {
	if (err) return cb(err)
	cb(null, keys)
	})
	})
	})
	})
	}