Skip to content

Commit b22b3e0

Browse files
daquinoaldodaquinoaldo
committed
IMPORTANT: Automate the certificate installation on MacOS
On MacOs, a certificate is automatically generated and installed.
1 parent a756936 commit b22b3e0

11 files changed

Lines changed: 153 additions & 17 deletions

File tree

‎.gitignore‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
1+
# MacOS
2+
.DS_STORE
3+
4+
# IDEs
15
.idea
26
*.iml
3-
.DS_STORE
7+
8+
# Node
49
node_modules
10+
11+
# Other
512
coverage
13+
cert/CA.*
14+
cert/localhost.*
15+
cert/server.csr

‎README.md‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,6 @@ Serve static files or import as module in your project.
1313
[![npm version](https://img.shields.io/npm/v/https-localhost.svg)](https://www.npmjs.com/package/https-localhost?activeTab=versions)
1414

1515

16-
### Install and trust the certificate
17-
Add the [rootCA.pem](rootCA.pem) certificate to your list of trusted certificates.
18-
This step depends on the operating system you're running:
19-
20-
- Mac OS: open Keychain Access, choose System from the left navigation bar, choose "Import items..." from the File app
21-
menu and select the file. Then double-click on the certificate and select always-trust in the Trust panel.
22-
23-
- Linux: Depending on your Linux distribution, you can use `trust`, `update-ca-certificates` or another command to mark
24-
the generated root certificate as trusted.
25-
26-
2716
### Use standalone
2817
From terminal navigate into the folder and run `sudo npm install -g` to install this tool globally.
2918

@@ -51,5 +40,27 @@ To redirect the http traffic to https use `app.redirect()`.
5140
You can also serve static files with `app.serve(path)`
5241

5342

43+
### [Optional/Linux] Install and trust the certificate
44+
After `npm install` will run a script that tries to install and validate automatically the certificate.
45+
**Actually works only on MacOS.**
46+
47+
However, this script is in beta and provided as-is, so there isn't any guarantee that will work.
48+
For that reason you can also install the certificate manually, as follows.
49+
50+
If you decide to not install it, it's fine, the package still work.
51+
However, visiting localhost there will be a invalid certificate issue.
52+
53+
To trust the certificate just add the [cert/defaultCA.pem](cert/defaultCA.pem) certificate
54+
to your list of trusted certificates.
55+
56+
This step depends on the operating system you're running:
57+
- Mac OS:
58+
open Keychain Access, choose System from the left navigation bar, choose "Import items..." from the File app
59+
menu and select the file. Then double-click on the certificate and select always-trust in the Trust panel.
60+
- Linux:
61+
Depending on your Linux distribution, you can use `trust`, `update-ca-certificates`
62+
or another command to mark the generated root certificate as trusted.
63+
64+
5465
### License
5566
[AGPL-3.0](LICENSE)

cert/server.crt renamed to cert/default.crt

File renamed without changes.

cert/server.key renamed to cert/default.key

File renamed without changes.

rootCA.pem renamed to cert/defaultCA.pem

File renamed without changes.

‎cert/generate.js‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
const exec = require("child_process").exec
2+
3+
// noinspection FallThroughInSwitchStatementJS
4+
switch (process.platform) {
5+
case "darwin": // MacOS
6+
console.log("\n----------------------------------------------\n" +
7+
"Please input your sudo password when required.\n" +
8+
"----------------------------------------------\n")
9+
exec("bash cert/generate.sh", (error, stdout, stderr) => {
10+
console.log(stdout)
11+
console.error(stderr)
12+
if (error !== null) console.error(`exec error: ${error}`)
13+
})
14+
break
15+
case "linux":
16+
console.warn("Cannot generate the localhost certificate on linux yet. " +
17+
"Coming soon.")
18+
process.exit(0)
19+
case "win32":
20+
console.warn("Cannot generate the localhost certificate on Windows.")
21+
process.exit(0)
22+
case "freebsd":
23+
console.warn("Cannot generate the localhost certificate on freebsd. " +
24+
"Help wanted.")
25+
process.exit(0)
26+
case "sunos":
27+
console.warn("Cannot generate the localhost certificate on sunos. " +
28+
"Help wanted.")
29+
process.exit(0)
30+
default:
31+
console.warn("Cannot generate the localhost certificate on your " +
32+
"platform. Contact the developer.")
33+
process.exit(0)
34+
}

‎cert/generate.sh‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/env bash
2+
3+
# capture errors and notify the user
4+
set -e
5+
trap 'if [[ $? -ne 0 ]]; then echo "ERROR: something went wrong."; fi' EXIT
6+
7+
# check the os
8+
case "$(uname -s)" in
9+
Darwin*) machine=MacOS;;
10+
Linux*) machine=Linux
11+
echo "Linux support coming soon"
12+
exit 1;;
13+
CYGWIN*) machine=Linux
14+
echo "WARNING: Support for Cygwin not guaranteed. Trying with the Linux script (coming soon)."
15+
exit 1;;
16+
MINGW*) machine=Linux
17+
echo "WARNING: Support for MinGw not guaranteed. Trying with the Linux script (coming soon)."
18+
exit 1;;
19+
*) echo "Unknown operating system."; exit 1;;
20+
esac
21+
22+
# generate the CA
23+
echo "Creating a certification authority to sign the certificate..."
24+
openssl req -x509 -newkey rsa:4096 -keyout cert/CA.key -out cert/CA.pem -days 1024 -nodes -subj "/C=US/ST=None/L=None/O=None/OU=None/CN=localhost"
25+
echo "Generated CA.key and CA.pem."
26+
27+
# install the CA
28+
case ${machine} in
29+
MacOS*)
30+
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain cert/CA.pem
31+
;;
32+
Linux*)
33+
echo "WARNING: Only Ubuntu is supported. No guarantee for other Linux distributions."
34+
sudo mkdir /usr/local/share/ca-certificates/localhost
35+
cp cert/CA.key /usr/local/share/ca-certificates/localhost/CA.key
36+
cp cert/CA.pem /usr/local/share/ca-certificates/localhost/CA.pem
37+
sudo chmod 775 /usr/local/share/ca-certificates/localhost
38+
sudo update-ca-certificates
39+
;;
40+
*) exit 1;;
41+
esac
42+
43+
# crate the certificate
44+
echo "Creating a certificate for localhost and signing with out CA..."
45+
openssl req -new -sha256 -nodes -out cert/server.csr -newkey rsa:2048 -keyout cert/localhost.key -config cert/server.conf
46+
openssl x509 -req -in cert/server.csr -CAkey cert/CA.key -CA cert/CA.pem -CAcreateserial -out cert/localhost.crt -days 1024 -sha256 -extfile cert/x509.ext
47+
echo "Generated localhost.key and localhost.crt."

‎cert/server.conf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[req]
2+
default_bits=2048
3+
prompt=no
4+
default_md=sha256
5+
distinguished_name=dn
6+
7+
[dn]
8+
C=US
9+
ST=None
10+
L=None
11+
O=None
12+
OU=None
13+
[email protected]
14+
CN=localhost

‎cert/x509.ext‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
authorityKeyIdentifier=keyid,issuer
2+
basicConstraints=CA:FALSE
3+
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
4+
subjectAltName = @alt_names
5+
6+
[alt_names]
7+
DNS.1 = localhost

‎index.js‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,21 @@ const minify = require("express-minify")
1212
/* CONFIGURE THE SERVER */
1313

1414
// SSL certificate
15-
const certOptions = {
16-
key: fs.readFileSync(path.resolve(__dirname, "cert/server.key")),
17-
cert: fs.readFileSync(path.resolve(__dirname, "cert/server.crt"))
15+
let certOptions
16+
try {
17+
certOptions = {
18+
key: fs.readFileSync(path.resolve(__dirname, "cert/localhost.key")),
19+
cert: fs.readFileSync(path.resolve(__dirname, "cert/localhost.crt"))
20+
}
21+
} catch (e) {
22+
// istanbul ignore next
23+
certOptions = {
24+
key: fs.readFileSync(path.resolve(__dirname, "cert/default.key")),
25+
cert: fs.readFileSync(path.resolve(__dirname, "cert/default.crt"))
26+
}
27+
// istanbul ignore next
28+
console.warn("Using the default certificate. " +
29+
"Validate it installing the defaultCA.pem certificate in the cert folder")
1830
}
1931

2032
// create a server with express
@@ -53,7 +65,7 @@ app.serve = function(path = process.cwd(), port = process.env.PORT || 443) {
5365
/* MAIN (running as script) */
5466

5567
// usage: `serve [<path>]` or `node index.js [<path>]`
56-
/* istanbul ignore if */
68+
// istanbul ignore if
5769
if (require.main === module) {
5870
// retrieve the static path from the process argv or use the cwd
5971
// 1st is node, 2nd is serve or index.js, 3rd (if exists) is the path

0 commit comments

Comments
 (0)