Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Readme
Create private keys and certificates with node.js
Install with npm
npm install pem
or use yarn
yarn add pem
:warning: Please make sure you have openssl
or libressl
already installed on your system/container, without
them pem
will not work.
Here are some examples for creating an SSL key/cert on the fly, and running an HTTPS server on port 443. 443 is the standard HTTPS port, but requires root permissions on most systems. To get around this, you could use a higher port number, like 4300, and use https://localhost:4300 to access your server.
var https = require('https')
var pem = require('pem')
pem.createCertificate({ days: 1, selfSigned: true }, function (err, keys) {
if (err) {
throw err
}
https.createServer({ key: keys.clientKey, cert: keys.certificate }, function (req, res) {
res.end('o hai!')
}).listen(443)
})
var https = require('https')
var pem = require('pem')
var express = require('express')
pem.createCertificate({ days: 1, selfSigned: true }, function (err, keys) {
if (err) {
throw err
}
var app = express()
app.get('/', function (req, res) {
res.send('o hai!')
})
https.createServer({ key: keys.clientKey, cert: keys.certificate }, app).listen(443)
})
Please have a look into the API documentation.
we had to clean up a bit
You can specify custom OpenSSL extensions using the config
or extFile
options for createCertificate
(or using csrConfigFile
with createCSR
).
extFile
and csrConfigFile
should be paths to the extension files. While config
will generate a temporary file from the supplied file contents.
If you specify config
then the v3_req
section of your config file will be used.
The following would be an example of a Certificate Authority extensions file:
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
commonName = Common Name
commonName_max = 64
[v3_req]
basicConstraints = critical,CA:TRUE
While the following would specify subjectAltNames in the resulting certificate:
[req]
req_extensions = v3_req
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = host1.example.com
DNS.2 = host2.example.com
DNS.3 = host3.example.com
Note that createCertificate
and createCSR
supports the altNames
option which would be easier to use in most cases.
:warning: Warning: If you specify altNames
the custom extensions file will not be passed to OpenSSL.
In some systems the openssl
executable might not be available by the default name or it is not included in $PATH. In this case you can define the location of the executable yourself as a one time action after you have loaded the pem module:
var pem = require('pem')
pem.config({
pathOpenSSL: '/usr/local/bin/openssl'
})
// do something with the pem module
For more details, search in test/pem.spec.js
: Create CSR with specialchars config file
If you use special chars like:
-!$%^&*()_+|~=`{}[]:/;<>?,.@#
You should know that the result mey have escaped characters when you read it in your application. Will try to fix this in the future, but not sure.
MIT
FAQs
Create private keys and certificates with node.js and io.js
The npm package pem receives a total of 242,555 weekly downloads. As such, pem popularity was classified as popular.
We found that pem demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.