Skip to content
/ mac-ca Public
forked from jfromaniello/mac-ca

Get Mac OS Root certificates in node.js

License

Notifications You must be signed in to change notification settings

lensapp/mac-ca

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

15 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

This module is similar to win-ca but for Mac OS. In fact I have copied most of its documentation and I have tried to maintain api compatibility.

mac-ca

Get MacOS System Root certificates for Node.js.

Rationale

Node uses a statically compiled, manually updated, hardcoded list of certificate authorities, rather than relying on the system's trust store... Read more

This package is intended to fetch Root CAs from MacOS "SystemRootCertificates.keychain" and make them available to Node.js application with minimal efforts.

Advantages

  • No internet access is required at all
  • MacOS store is updated automatically (in most modern environments)
  • Manually installed Root certificates are used
  • Enterpise trusted certificates (GPO etc.) are made available too

Usage

Just say npm install --save mac-ca and then call require('mac-ca').

It is safe to use it under other OSes (not MacOS).

API

After require('mac-ca') MacOs' Root CAs are found, deduplicated and installed to https.globalAgent.options.ca so they are automatically used for all requests with Node.js' https module.

For use in other places, these certificates are also available via .all() method (in node-forge's format).

let ca = require('mac-ca')
let forge = require('node-forge')

for (let crt of ca.all())
  console.log(forge.pki.certificateToPem(crt))

Unfortunately, node-forge at the time of writing is unable to parse non-RSA certificates (namely, ECC certificates becoming more popular). If your Trusted Root Certification Authorities store contains modern certificates, .all() method will throw exception.

To fix this, one can pass format parameter to .all method:

let ca = require('mac-ca')

for (let crt of ca.all(ca.der2.pem))
  console.log(crt)

Available values for format are:

Constant Value Meaning
der2.der 0 DER-format (binary, Node's Buffer)
der2.pem 1 PEM-format (text, Base64-encoded)
der2.txt 2 PEM-format plus some info as text
der2.asn1 3 ASN.1-parsed certificate
* * Certificate in node-forge format (RSA only)

One can enumerate Root CAs himself using .each() method:

let ca = require('mac-ca')

ca.each(crt=>
  console.log(forge.pki.certificateToPem(crt)))

But this list may contain duplicates.

Asynchronous enumeration is not supported by this module yet.

Credits

Uses node-forge and is heavily inspired by Stas Ukolov's win-ca.

See also OpenSSL::Win::Root.

About

Get Mac OS Root certificates in node.js

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • JavaScript 100.0%