[範例] node-forge 驗證憑證鏈 | 自然人憑證開發筆記

前文有介紹到，自然人憑證卡裡面有四張憑證，包含政府根憑證、內政部中繼憑證、兩張個人終端憑證（簽章、加密），本文將說明如何透過後端對終端憑證做憑證鏈驗證。

Demo#

前端：CodePen
後端：Cloudflare Worker Playground

前端程式碼#

前文學習到如何讀取自然人憑證裡面的四張憑證，範例為讀取憑證後，按下驗證按鈕進行驗證憑證鏈。

1
<h1>自然人憑證 憑證鏈驗證</h1>
2
<input type="button" value="讀取簽章憑證" onclick="getCert(true)" />
3
<input type="button" value="讀取加密憑證" onclick="getCert(false)" />
4
<form action="https://cert.modatw.workers.dev/api/certChainVerify" method="post">
5
  根憑證<br>
6
  <textarea name="cert1b64" rows="8" cols="65"></textarea><br>
7
  中繼憑證<br>
8
  <textarea name="cert2b64" rows="8" cols="65"></textarea><br>
9
  終端憑證<br>
10
  <textarea name="cert3b64" rows="8" cols="65"></textarea><br>
11
  <input value="驗證" type="submit">
12
</form>
13
<script>
14
  let popupForm;
15
  let timeout;
16
  let cert;
17

18
  function getCert(c) {
19
    cert = c;
20
    popupForm = window.open(
21
      "http://localhost:61161/popupForm",
22
      "popupForm",
23
      "height=200, width=200, left=100, top=20"
24
    );
25
    timeout = setTimeout(() => {
26
      popupForm.close();
27
      alert("尚未安裝元件");
28
    }, 5000);
29
  }
30

31
  function receiveMessage(event) {
32
    if (event.origin !== "http://localhost:61161") return;
33

34
    let ret = JSON.parse(event.data);
35
    if (ret.func === "getTbs") {
36
      clearTimeout(timeout);
37
      const tbsData = { func: "GetUserCert" };
38
      popupForm.postMessage(JSON.stringify(tbsData), "*");
39
    } else {
40
      const data = JSON.parse(event.data);
41
      const certs = data.slots[0].token.certs;
42
      document.getElementsByName("cert1b64")[0].value = certs[0].certb64;
43
      document.getElementsByName("cert2b64")[0].value = certs[1].certb64;
44
      document.getElementsByName("cert3b64")[0].value = cert
45
        ? certs[2].certb64
46
        : certs[3].certb64;
47
    }
48
  }
49

50
  window.addEventListener("message", receiveMessage, false);
51
</script>

後端程式碼#

後端接收到前端傳過來的三張憑證，並進行憑證鏈驗證，這裡以 Cloudflare Workers 搭配 node-forge 套件來實作。

1
// 本範例環境為 Cloudflare Workers
2
// 程式碼適用於 NodeJS，需安裝 node-forge
3

4
// 以下為 Cloudflare Workers 可用的 node-forge
5
// https://gist.github.com/chouhsiang/2dad8070e517b61cec3d175b1832c4be
6
import { forge } from "./node-forge.js";
7

8
export default {
9
  async fetch(request, env, ctx) {
10
    try {
11
      const { pathname } = new URL(request.url);
12
      if (pathname == "/api/certChainVerify" && request.method == "POST") {
13
        return await certChainVerify(request);
14
      }
15
      return new Response("");
16
    } catch (e) {
17
      return new Response(e);
18
    }
19
  },
20
};
21

22
async function certChainVerify(request) {
23
  const formData = await request.formData();
24
  const begin = "-----BEGIN CERTIFICATE-----";
25
  const end = "-----END CERTIFICATE-----";
26

27
  // 將憑證轉為 PEM 格式
28
  const rootCACert = begin + formData.get("cert1b64") + end;
29
  const intermediateCert = begin + formData.get("cert2b64") + end;
30
  const endEntityCert = begin + formData.get("cert3b64") + end;
31

32
  // 解析 PEM
33
  const rootCACertificate = forge.pki.certificateFromPem(rootCACert);
34
  const intermediateCertificate = forge.pki.certificateFromPem(intermediateCert);
35
  const endEntityCertificate = forge.pki.certificateFromPem(endEntityCert);
36

37
  // 建立 CA 儲存庫，加入根憑證、中繼憑證
38
  const caStore = forge.pki.createCaStore([rootCACertificate, intermediateCertificate]);
39

40
  // 驗證憑證
41
  try {
42
    forge.pki.verifyCertificateChain(caStore, [endEntityCertificate]);
43
    return new Response("成功");
44
  } catch (e) {
45
    return new Response("失敗，" + JSON.stringify(e));
46
  }
47
}