Implemented HTTP-01 with ARI Extension in Javascript

Client dev
1

I finally implemented ARI into my project and wanted to share it

import * as asn1 from 'simple-asn1';
import * as acme from 'base-acme-client';

async function internalUpdateSuggestFromText(certificateText, acmeDirectory) {
    try {
        const certPem = asn1.pemToBuffer(certificateText);

        if (certPem != null) {
            const window = await acme.fetchSuggestedWindow(acmeDirectory.renewalInfo, await asn1.decodeAKI(certPem), await asn1.decodeSerialNumber(certPem));

            window != undefined && (suggestedWindow = window);

            return suggestedWindow;
        }
    } catch { }
}

Which will output this:

{
  suggestedWindow: { start: '2025-02-07T16:05:45Z', end: '2025-02-09T16:05:45Z' }
}

Lets Encrypt ACME Client

Contains the daemon and the mixin if you don't want to use server-ssl

The Request Url

The spec says : The hex string should be bytes before it is base64 url encoded

 url = renewalInfo || '/' || base64url(AKI keyIdentifier) || '.' || base64url(Serial)

Which in javascript ends up looking like this:

// serial: 2bf59ea7a71ed5dd18404c72c9219322a637
// aki   : fc46d101435fbb7ba63d3068ae11bae0bc6dc9d3
const url = `${renewalInfoUrl}/${base64urlEncode(hexToBytes(aki))}.${base64urlEncode(hexToBytes(serial))}`;

Very Helpful Stuff

lets-encrypt-acme-client base-acme-client

simple-open-ssl

signed npm packages

4 Likes
2

as you already have JS implementation for ari, could you make web frontend/UI for get ARI information of whatever certificate user uploads at?

1 Like
3

I could, the steps for that would be:

import * as asn1 from 'simple-asn1';

let cert2 = `-----BEGIN CERTIFICATE-----
MIIDtjCCAzugAwIBAgISK1rvUtJhWROMvjmPX10Woba9MAoGCCqGSM49BAMDMFIx
CzAJBgNVBAYTAlVTMSAwHgYDVQQKExcoU1RBR0lORykgTGV0J3MgRW5jcnlwdDEh
MB8GA1UEAxMYKFNUQUdJTkcpIFBzZXVkbyBQbHVtIEU1MB4XDTI0MTIxMzA3MzA1
NloXDTI1MDMxMzA3MzA1NVowGDEWMBQGA1UEAxMNd3d3LnNzbC5ib2F0czBZMBMG
ByqGSM49AgEGCCqGSM49AwEHA0IABB9aKqx/UjiKE9Ar8obaLS5cLRzR+ajUbAh6
b0C8c6FbtoDtMObswuMRU5j5QxQ+mI83JAzEGEi/bhlgbqbRE4mjggIpMIICJTAO
BgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwG
A1UdEwEB/wQCMAAwHQYDVR0OBBYEFOtzJRdnpoAEOTDVXYku2ZtQUT8iMB8GA1Ud
IwQYMBaAFPxG0QFDX7t7pj0waK4RuuC8bcnTMF0GCCsGAQUFBwEBBFEwTzAlBggr
BgEFBQcwAYYZaHR0cDovL3N0Zy1lNS5vLmxlbmNyLm9yZzAmBggrBgEFBQcwAoYa
aHR0cDovL3N0Zy1lNS5pLmxlbmNyLm9yZy8wIwYDVR0RBBwwGoIJc3NsLmJvYXRz
gg13d3cuc3NsLmJvYXRzMBMGA1UdIAQMMAowCAYGZ4EMAQIBMIIBCwYKKwYBBAHW
eQIEAgSB/ASB+QD3AHUAsMyD5aX5fWuvfAnMKEkEhyrH6IsTLGNQt8b9JuFsbHcA
AAGTvyMQHgAABAMARjBEAiBX2nYGN2VtVboAuZwpgTisVd49y6ZHxXX/F96BXMJT
CQIgKg4f6fiNdWWHzy9sq2fNcc2p0+oggAoDfHEY5EmUqkYAfgCVkL2F8s/FBkmY
q6tbsmwuehdnApEcE7aLSAXh65Qn7wAAAZO/Ixn7AAgAAAUANFE48wQDAEcwRQIg
I8s4151aDqUSleP2Sz4DrpHbiUm754BnsX32Ut7SoS0CIQCzLvUGsk+OYE/vElMc
XqmSAMEX2DlIYkaKQZloDGxYTzAKBggqhkjOPQQDAwNpADBmAjEA1qGVHDX+Y+G8
ce24WmB32hagTDXU+VbqjvfgjTYteL12ck23wcZ1Rw6rybXgSjCrAjEAw4fgdqE1
m8oGNfIL08TiLJ8c4vjHudCHJEGvSstdl2Ds56klMvl32YFrS7XlEyZQ
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIEljCCAn6gAwIBAgIQRzEp1D1mDiVVv4b1zlB56jANBgkqhkiG9w0BAQsFADBm
MQswCQYDVQQGEwJVUzEzMDEGA1UEChMqKFNUQUdJTkcpIEludGVybmV0IFNlY3Vy
aXR5IFJlc2VhcmNoIEdyb3VwMSIwIAYDVQQDExkoU1RBR0lORykgUHJldGVuZCBQ
ZWFyIFgxMB4XDTI0MDMxMzAwMDAwMFoXDTI3MDMxMjIzNTk1OVowUjELMAkGA1UE
BhMCVVMxIDAeBgNVBAoTFyhTVEFHSU5HKSBMZXQncyBFbmNyeXB0MSEwHwYDVQQD
ExgoU1RBR0lORykgUHNldWRvIFBsdW0gRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
AATljbbcV+mqWZa3g+z0bDOuBpZOtbi48iK9rjLtPdRU0WsgVp53MW3nXFU6qVYV
zEYaYd6PSmec0Tj3R5zEp5/F+cuOjTdh3AkTMzYm1tkflocPBN5APHYZ+76WxZad
q+WjggEAMIH9MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYI
KwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU/EbRAUNfu3um
PTBorhG64LxtydMwHwYDVR0jBBgwFoAUtfNl8v6wCpIf+zx980SgrGMlwxQwNgYI
KwYBBQUHAQEEKjAoMCYGCCsGAQUFBzAChhpodHRwOi8vc3RnLXgxLmkubGVuY3Iu
b3JnLzATBgNVHSAEDDAKMAgGBmeBDAECATArBgNVHR8EJDAiMCCgHqAchhpodHRw
Oi8vc3RnLXgxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAAtCGn4iG
cupruhkCTcoDqSIVTFgVR8JJ3GvGL7SYwIc4Fn0As66nQgnkATIzF5+gFb+CXEQD
qR2Jo+R38OeT7lQ1rNDcaJcbY6hL8cNRku3QlcfdYODZ5pgTVH04gTZUJISZKLjD
kMMcQIDZlF7iYqTvmHbn2ISSKorsJ3QKAvWhHwMoJtocSz3VeDJIep5QtbHnoXh1
/dyDx7sp8RuhC0eO9ElTgDtiA2V6JxigLPzqcnibBBR4bFLGtMNE4EvOOD/Fkd0L
hdGDbAMNd+O06n+b0rgmDvg75IgOV6fpDrdZFoiNfCckOEJh9v10uYt4pTc3B6lf
zI/X3EWP1H4VJmsYuy+OA29jPeP831sAObZtd3RWv0LQPrMfx6FCmy4AaeYEMvul
FrF6OX+JbssE+bn83F+sGEMZu/eVBwwKh3db7+2UduMdTOb8DePE3Aqlg9zofS8X
9fJXrrp+PPrdQyvM3e8DxuioWa9GLG30yD9WD6WTlSiiOrdWGOzisWpW4shFoL8u
0EfmeLVU4JVbauhOYZASQXABNeXewe9lqJWwfqaARYpRjyf+jRibn22H5NVK4Vog
l55Iq1rUgjc8r493NaNrlNwG7va7Ztkch5lJ3oL/FEVlVSK4snTbgb0b5qjQz3SA
i7rA/8QRZvOLnKNtdEUlDZNrzkZwHNluLGw=
-----END CERTIFICATE-----`;

let buffer1 = asn1.pemToBuffer(cert2);

let aki1 = asn1.decodeAKI(buffer1);

let serial1 = asn1.decodeSerialNumber(buffer1);

console.log(aki1 === "fc46d101435fbb7ba63d3068ae11bae0bc6dc9d3", serial1 === "2b5aef52d26159138cbe398f5f5d16a1b6bd");

import * as acme from 'base-acme-client';
// ... newDirectoryAsync for renewalInfoUrl
acme.fetchSuggestedWindow(renewalInfoUrl, aki, serial)

{
  suggestedWindow: { start: '2025-02-11T00:43:41Z', end: '2025-02-13T00:43:41Z' }
}

base-acme-client package simple-asn1 package

I think this would be a good idea and quite simple to implement actually.

You could start a development server in a few seconds if you want to play around locally.

1 Like
4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.