Using X509Certificate

Jeremy · 2023-08-10T20:41:41.017Z

Is there any way to parse and verify certificates in workers? It seems like it's unsupported in `node_compat`, but my only other solution is to host a NodeJS server, only for parsing certificate signed JWT tokens.

C

Cyb3r-Jak3•8/10/23, 8:44 PM

Can you not use Webcryto importKey for this?
https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey

CCyb3r-Jak3 Can you not use Webcryto importKey for this? https://developer.mozilla.org/en-US...

J

JeremyOP•8/10/23, 8:56 PM

When I try to import the certificate with

importKey

importKey

importKey

importKey it gives me an asn1 error about having the wrong tag

J

JeremyOP•8/10/23, 9:03 PM

My current NodeJS solution is

import jwt from "@tsndr/cloudflare-worker-jwt";
import { X509Certificate } from 'node:crypto';

export function verifyToken(keyData: string, token: string) {
  const key = Buffer.from(keyData, 'base64')
  const cert = new X509Certificate(key);
  const publicKey = cert.publicKey.export({ type: 'spki', format: 'pem' });
  return jwt.verify(token, publicKey, "ES256");
}

import jwt from "@tsndr/cloudflare-worker-jwt";
import { X509Certificate } from 'node:crypto';

export function verifyToken(keyData: string, token: string) {
  const key = Buffer.from(keyData, 'base64')
  const cert = new X509Certificate(key);
  const publicKey = cert.publicKey.export({ type: 'spki', format: 'pem' });
  return jwt.verify(token, publicKey, "ES256");
}

import jwt from "@tsndr/cloudflare-worker-jwt";
import { X509Certificate } from 'node:crypto';

export function verifyToken(keyData: string, token: string) {
  const key = Buffer.from(keyData, 'base64')
  const cert = new X509Certificate(key);
  const publicKey = cert.publicKey.export({ type: 'spki', format: 'pem' });
  return jwt.verify(token, publicKey, "ES256");
}

import jwt from "@tsndr/cloudflare-worker-jwt";
import { X509Certificate } from 'node:crypto';

export function verifyToken(keyData: string, token: string) {
  const key = Buffer.from(keyData, 'base64')
  const cert = new X509Certificate(key);
  const publicKey = cert.publicKey.export({ type: 'spki', format: 'pem' });
  return jwt.verify(token, publicKey, "ES256");
}

C

Cyb3r-Jak3•8/10/23, 9:11 PM

Ah sorry not sure then

J

JeremyOP•8/11/23, 12:05 AM

Did more research, found an x509 package that works on Node, but gives an incorrect publicKey on the workers runtime... guess this means more research

J

JeremyOP•8/11/23, 2:45 AM

Looks like a bug in SubtleCrypto?

importKey

importKey

importKey

importKey in the worker runtime is returning

CryptoKey {
  usages: undefined,
  algorithm: undefined,
  extractable: undefined,
  type: undefined
}

CryptoKey {
  usages: undefined,
  algorithm: undefined,
  extractable: undefined,
  type: undefined
}

CryptoKey {
  usages: undefined,
  algorithm: undefined,
  extractable: undefined,
  type: undefined
}

CryptoKey {
  usages: undefined,
  algorithm: undefined,
  extractable: undefined,
  type: undefined
}

meanwhile NodeJS with the exact same code returns

CryptoKey {
  type: 'public',
  extractable: true,
  algorithm: { name: 'ECDSA', namedCurve: 'P-256' },
  usages: [ 'verify' ]
}

CryptoKey {
  type: 'public',
  extractable: true,
  algorithm: { name: 'ECDSA', namedCurve: 'P-256' },
  usages: [ 'verify' ]
}

CryptoKey {
  type: 'public',
  extractable: true,
  algorithm: { name: 'ECDSA', namedCurve: 'P-256' },
  usages: [ 'verify' ]
}

CryptoKey {
  type: 'public',
  extractable: true,
  algorithm: { name: 'ECDSA', namedCurve: 'P-256' },
  usages: [ 'verify' ]
}

J

JeremyOP•8/11/23, 2:46 AM

Using:

await crypto.subtle.importKey(
  "spki",
  Buffer.from(
    "3059301306072a8648ce3d020106082a8648ce3d03010703420004ea1371a3dca5e8a934bf5e434ead0aeee951cc1d09774df2f1aa6948dde7c67cb4bc62502d1d05e03e7ae318820875ff988093e14cc541660366b5af868267c4",
    "hex"
  ),
  { name: "ECDSA", namedCurve: "P-256", hash: { name: "SHA-256" } },
  true,
  ["verify"]
)

await crypto.subtle.importKey(
  "spki",
  Buffer.from(
    "3059301306072a8648ce3d020106082a8648ce3d03010703420004ea1371a3dca5e8a934bf5e434ead0aeee951cc1d09774df2f1aa6948dde7c67cb4bc62502d1d05e03e7ae318820875ff988093e14cc541660366b5af868267c4",
    "hex"
  ),
  { name: "ECDSA", namedCurve: "P-256", hash: { name: "SHA-256" } },
  true,
  ["verify"]
)

await crypto.subtle.importKey(
  "spki",
  Buffer.from(
    "3059301306072a8648ce3d020106082a8648ce3d03010703420004ea1371a3dca5e8a934bf5e434ead0aeee951cc1d09774df2f1aa6948dde7c67cb4bc62502d1d05e03e7ae318820875ff988093e14cc541660366b5af868267c4",
    "hex"
  ),
  { name: "ECDSA", namedCurve: "P-256", hash: { name: "SHA-256" } },
  true,
  ["verify"]
)

await crypto.subtle.importKey(
  "spki",
  Buffer.from(
    "3059301306072a8648ce3d020106082a8648ce3d03010703420004ea1371a3dca5e8a934bf5e434ead0aeee951cc1d09774df2f1aa6948dde7c67cb4bc62502d1d05e03e7ae318820875ff988093e14cc541660366b5af868267c4",
    "hex"
  ),
  { name: "ECDSA", namedCurve: "P-256", hash: { name: "SHA-256" } },
  true,
  ["verify"]
)

Similar Threads

Similar Threads

Similar Threads