selfsigned - npm Package Compare versions

Comparing version 5.0.0 to 5.1.0

.claude/settings.local.json

 {
   "permissions": {
     "allow": [
-      "Bash(ls:*)"
+      "Bash(ls:*)",
+      "Bash(npm test)"
     ],
@@ -6,0 +7,0 @@ "deny": [],

index.d.ts

@@ -84,2 +84,7 @@ declare enum ASN1Class {
    }
+  /**
+   * Passphrase to encrypt the private key (PKCS#8 encrypted format)
+   * When provided, the private key will be encrypted using AES-256-CBC
+   */
+   passphrase?: string
 }
@@ -86,0 +91,0 @@

index.js

@@ -232,6 +232,22 @@ const { X509CertificateGenerator, X509Certificate, X509ChainBuilder, BasicConstraintsExtension, KeyUsagesExtension, KeyUsageFlags, ExtendedKeyUsageExtension, ExtendedKeyUsage, SubjectAlternativeNameExtension, GeneralName } = require("@peculiar/x509");
 
-  const privatePem =
-    '-----BEGIN PRIVATE KEY-----\n' +
-    Buffer.from(privateKeyDer).toString('base64').match(/.{1,64}/g).join('\n') +
-    '\n-----END PRIVATE KEY-----\n';
+  let privatePem;
+  if (options.passphrase) {
+    // Encrypt the private key with the passphrase using Node.js crypto
+    const keyObject = nodeCrypto.createPrivateKey({
+      key: Buffer.from(privateKeyDer),
+      format: 'der',
+      type: 'pkcs8'
+    });
+    privatePem = keyObject.export({
+      type: 'pkcs8',
+      format: 'pem',
+      cipher: 'aes-256-cbc',
+      passphrase: options.passphrase
+    });
+  } else {
+    privatePem =
+      '-----BEGIN PRIVATE KEY-----\n' +
+      Buffer.from(privateKeyDer).toString('base64').match(/.{1,64}/g).join('\n') +
+      '\n-----END PRIVATE KEY-----\n';
+  }
 
@@ -351,2 +367,3 @@ const publicPem =
  * @param {string} [options.ca.cert] CA certificate in PEM format
+ * @param {string} [options.passphrase] Passphrase to encrypt the private key (uses AES-256-CBC)
  * @returns {Promise<object>} Promise that resolves with certificate data
@@ -353,0 +370,0 @@ */

package.json

 {
   "name": "selfsigned",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "Generate self signed certificates private and public keys",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

@@ -50,3 +50,4 @@ # selfsigned
   clientCertificateKeySize: 2048, // the size for the client private key in bits (default: 2048)
-  ca: { key: '...', cert: '...' } // CA key and cert for signing (default: self-signed)
+  ca: { key: '...', cert: '...' }, // CA key and cert for signing (default: self-signed)
+  passphrase: 'secret' // encrypt the private key with a passphrase (default: none)
 });
@@ -99,2 +100,37 @@ ```
 
+### Encrypting the Private Key
+
+You can encrypt the private key with a passphrase using AES-256-CBC:
+
+```js
+const pems = await selfsigned.generate(null, {
+  passphrase: 'my-secret-passphrase'
+});
+
+// The private key will be in encrypted PKCS#8 format:
+// -----BEGIN ENCRYPTED PRIVATE KEY-----
+// ...
+// -----END ENCRYPTED PRIVATE KEY-----
+```
+
+To use the encrypted key, provide the passphrase:
+
+```js
+const crypto = require('crypto');
+
+// Decrypt the key
+const privateKey = crypto.createPrivateKey({
+  key: pems.private,
+  passphrase: 'my-secret-passphrase'
+});
+
+// Or use directly with HTTPS server
+const https = require('https');
+https.createServer({
+  key: pems.private,
+  passphrase: 'my-secret-passphrase',
+  cert: pems.cert
+}, app).listen(443);
+```
+
 ### Signing with a CA
@@ -101,0 +137,0 @@

test/tests.js

@@ -297,2 +297,42 @@ var { assert } = require('chai');
   });
+
+  it('should support passphrase for private key encryption', async function () {
+    const passphrase = 'my-secret-passphrase';
+    var pems = await generate(null, { passphrase: passphrase });
+
+    assert.ok(!!pems.private, 'has a private key');
+    assert.include(pems.private, 'ENCRYPTED', 'private key should be encrypted');
+
+    // Verify the key can be decrypted with the correct passphrase
+    const privateKey = crypto.createPrivateKey({
+      key: pems.private,
+      passphrase: passphrase
+    });
+    assert.ok(privateKey, 'should be able to decrypt private key with passphrase');
+
+    // Verify signing works with decrypted key
+    const testData = 'Hello, World!';
+    const sign = crypto.createSign('SHA256');
+    sign.update(testData);
+    sign.end();
+    const signature = sign.sign({ key: pems.private, passphrase: passphrase });
+
+    const verify = crypto.createVerify('SHA256');
+    verify.update(testData);
+    verify.end();
+    const isValid = verify.verify(pems.public, signature);
+    assert.isTrue(isValid, 'encrypted key should work for signing');
+  });
+
+  it('should fail to decrypt private key with wrong passphrase', async function () {
+    const passphrase = 'correct-passphrase';
+    var pems = await generate(null, { passphrase: passphrase });
+
+    assert.throws(() => {
+      crypto.createPrivateKey({
+        key: pems.private,
+        passphrase: 'wrong-passphrase'
+      });
+    });
+  });
 });

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

57505

5.48%

Lines of code

1099

5.37%

Number of lines in readme file

305

13.38%

Number of medium supply chain risk alerts

4

-20%

No dependency changes