selfsigned - npm Package Compare versions

Comparing version 1.7.0 to 1.8.0

index.js

 var forge = require('node-forge');
-var fs = require('fs');
 
+// a hexString is considered negative if it's most significant bit is 1
+// because serial numbers use ones' complement notation
+// this RFC in section 4.1.2.2 requires serial numbers to be positive
+// http://www.ietf.org/rfc/rfc5280.txt
+function toPositiveHex(hexString){
+  var mostSiginficativeHexAsInt = parseInt(hexString[0], 16);
+  if (mostSiginficativeHexAsInt < 8){
+    return hexString;
+  }
+
+  mostSiginficativeHexAsInt -= 8;
+  return mostSiginficativeHexAsInt.toString() + hexString.substring(1);
+}
+
 function getAlgorithm(key) {
@@ -8,3 +21,2 @@ switch (key) {
       return forge.md.sha256.create();
-    case 'sha1':
     default:
@@ -29,3 +41,4 @@ return forge.md.sha1.create();
 
-    cert.serialNumber = forge.util.bytesToHex(forge.random.getBytesSync(9)); // the serial number can be decimal or hex (if preceded by 0x)
+    cert.serialNumber = toPositiveHex(forge.util.bytesToHex(forge.random.getBytesSync(9))); // the serial number can be decimal or hex (if preceded by 0x)
+
     cert.validity.notBefore = new Date();
@@ -95,3 +108,3 @@ cert.validity.notAfter = new Date();
       var clientcert = forge.pki.createCertificate();
-      clientcert.serialNumber = forge.util.bytesToHex(forge.random.getBytesSync(9));
+      clientcert.serialNumber = toPositiveHex(forge.util.bytesToHex(forge.random.getBytesSync(9)));
       clientcert.validity.notBefore = new Date();
@@ -170,4 +183,4 @@ clientcert.validity.notAfter = new Date();
   } : forge.pki.rsa.generateKeyPair(keySize);
-  
+
   return generatePem(keyPair);
 };

package.json

 {
   "name": "selfsigned",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Generate self signed certificates private and public keys",
@@ -5,0 +5,0 @@ "main": "index.js",

No alert changes

Improved metrics

Total package byte prevSize

20310

increased by2.5%

Lines of code

253

increased by4.12%

Number of low supply chain risk alerts

1

decreased by-50%

No dependency changes