wangchuanli
02e83f5b73
实现服务端解密的 KeePass 网页查看器，包含登录门户口令与验证码、RSA+会话级 AES 加密通道、审计日志持久化、HTTPS 自动证书、Docker 部署配置及端到端测试。
40 行
1.6 KiB
JavaScript
40 行
1.6 KiB
JavaScript
'use strict';
|
|
// 生成自签名证书用于本地 HTTPS / 容器默认 HTTPS（开发/自托管用，生产请使用受信任证书）
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const forge = require('node-forge');
|
|
|
|
// 生成自签证书到指定路径；cn 默认 localhost，可传入额外 SAN/主机名
|
|
function generateSelfSigned(keyPath, certPath, cn) {
|
|
cn = cn || 'localhost';
|
|
const keys = forge.pki.rsa.generateKeyPair(2048);
|
|
const cert = forge.pki.createCertificate();
|
|
cert.publicKey = keys.publicKey;
|
|
cert.serialNumber = Math.floor(Math.random() * 0xffffffffffff).toString(16);
|
|
cert.validity.notBefore = new Date();
|
|
cert.validity.notAfter = new Date(Date.now() + 3650 * 86400000); // 10 年
|
|
const attrs = [{ name: 'commonName', value: cn }];
|
|
cert.setSubject(attrs);
|
|
cert.setIssuer(attrs);
|
|
// 扩展：仅 localhost 场景足够，浏览器会提示自签不可信（属预期）
|
|
cert.sign(keys.privateKey, forge.md.sha256.create());
|
|
|
|
const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
|
|
const certPem = forge.pki.certificateToPem(cert);
|
|
const dir = path.dirname(keyPath);
|
|
fs.mkdirSync(dir, { recursive: true });
|
|
fs.writeFileSync(keyPath, keyPem);
|
|
fs.writeFileSync(certPath, certPem);
|
|
return { keyPem, certPem };
|
|
}
|
|
|
|
module.exports = { generateSelfSigned };
|
|
|
|
// 作为脚本直接运行时：按默认路径生成，便于手动预生成
|
|
if (require.main === module) {
|
|
const defKey = path.join(__dirname, 'ssl', 'key.pem');
|
|
const defCert = path.join(__dirname, 'ssl', 'cert.pem');
|
|
generateSelfSigned(defKey, defCert, 'localhost');
|
|
console.log('SSL 自签证书已生成: ssl/key.pem, ssl/cert.pem');
|
|
}
|