localcert: SSL Certificate Generation and Trust


Generates and trusts self-signed SSL certificates for local development. Based off the popular mkcert library for Go.

Requirements

In order to install certificates in NSS browsers such as Firefox, the Mozilla certutil is required. You can install it with the following:

$3

``bash
brew install certutil
`

$3

`bash
sudo apt install libnss3-tools
-or-
sudo yum install nss-tools
-or-
sudo pacman -S nss
-or-
sudo zypper install mozilla-nss-tools
`

$3

Installation to Firefox is not yet supported on Windows. Localcert will only install the certificate to the system store.

Usage

Import and instantiate the the localcert module:

`javascript
var localcert = require('localcert')

var certgen = new localcert()
`

Generate the certificate:

`javascript
certgen.generate(['test.local'], 'US', 'FL', 'Sarasota', 'Acme Inc', '')

const certPaths = await certgen.saveCertificate();
`

Note, you can pass a "certPath" to the saveCertificate method. Without it, localcert will save certificates to ~/.localcert

You can also load an existing certificate with the following:

`javascript
const certPaths = certgen.loadCertificate(certPath,privateKeyPath);
`

Next, trust the certificate either in the system store, NSS browsers such as Firefox and Chrome, or both:

`javascript
certgen.trustCertificatePlatform();
certgen.trustCertificateNSS();
`

To remove the certificate trusts, locate the certificate to remove and run the following:

`javascript
certgen.removeCertificateTrustPlatform();
certgen.removeCertificateTrustNSS();
`

For the following functions, you can pass a second, optional, parameter of execute (bool) which defaults to true. If false, the command called will simply return the command parameters and not execute. Hopefully this will be handy in applications that may have wrapped sudo and/or other system calls.

$3

Determine if the user has certutil installed:

`javascript
certgen.hasCertUtil();
`

Determine if the user has any NSS browsers that need to be trusted:

`javascript
certgen.hasNSS();
`

Verify if the current certificate has been trusted in the system store

`javascript
await verifyPlatformTrust();
`

Changelog

$3

* Bump js-yaml dependency from 3.13.1 to 3.14.2 for security and bug fixes.
* Add .idea in .gitignore`.

$3

* Added support for Apple Silicon in sudo-prompt applet.

$3

* Added serialNumber prop to certificate object upon verification
* Updated trust verification on windows to use serialNumber and commonName
* Removed meaningless verification check

$3

* Resolved missing 'certutil' command in windows truststore

$3

* Update sha1 to sha256
* Have self-signed certs also be Certificate Authorities

$3

* Fix issue with duplicate DNS names

$3

* Fix inconsistencies with package-lock

$3

* Move to getflywheel organization

$3

* Remove dependencies on native node modules

$3

* Ensure we're properly verifying the certificate to build NSS commands

$3

* Fix default certPath when removing NSS trusts

$3

* Improve readme documentation
* Fix bug where commands weren't returned from nss de-trust
* Make certPath optional on most functions

$3

* Setup testing
* Use npm instead of yarn

$3

* Fix filename when generating new key

$3

* Minor refactor

$3

* Savecertificate method is now properly async.

$3

* Use which package to avoid errors.

$3

* Add ability to verify system store on host machine has been trusted.

$3

* We need to escape paths for the child_process.exec execution

$3

* Send the correct database string to the NSS insert method.

$3

* export NSS command paths without normalized paths

$3

* Add helper function to retrieve NSS operations
* Add ability to not execute NSS trust commands

$3

* Generated cert should not be listed as a CA.

$3

* Properly escape spaces in all paths for NSS browser trust

$3

* Don't escape Mac and Linux paths unless we have to

$3

* Add ability to avoid direct execution of sudo commands with optional "execute" parameter.

$3

* Ensure spaces are accounted for in Linux and Mac paths

$3

* Ensure certutil path is populated in Linux
* Cleanout some unused variables after the port from mkcert

$3

* Add ability to load an existing certificate for trusting

$3

* Initial release