- Jump To … +
  lib/helper.js lib/openssl.js lib/pem.js

- # pem.js

- ¶

      'use strict'

      /**
       * pem module
       *
       * @module pem
       */

      const { promisify } = require('es6-promisify')
      var net = require('net')
      var helper = require('./helper.js')
      var openssl = require('./openssl.js')

      module.exports.createPrivateKey = createPrivateKey
      module.exports.createDhparam = createDhparam
      module.exports.createEcparam = createEcparam
      module.exports.createCSR = createCSR
      module.exports.createCertificate = createCertificate
      module.exports.readCertificateInfo = readCertificateInfo
      module.exports.getPublicKey = getPublicKey
      module.exports.getFingerprint = getFingerprint
      module.exports.getModulus = getModulus
      module.exports.getDhparamInfo = getDhparamInfo
      module.exports.createPkcs12 = createPkcs12
      module.exports.readPkcs12 = readPkcs12
      module.exports.verifySigningChain = verifySigningChain
      module.exports.checkCertificate = checkCertificate
      module.exports.checkPkcs12 = checkPkcs12
      module.exports.config = config

      /**
       * quick access the convert module
       * @type {module:convert}
       */
      module.exports.convert = require('./convert.js')

      var KEY_START = '-----BEGIN PRIVATE KEY-----'
      var KEY_END = '-----END PRIVATE KEY-----'
      var RSA_KEY_START = '-----BEGIN RSA PRIVATE KEY-----'
      var RSA_KEY_END = '-----END RSA PRIVATE KEY-----'
      var ENCRYPTED_KEY_START = '-----BEGIN ENCRYPTED PRIVATE KEY-----'
      var ENCRYPTED_KEY_END = '-----END ENCRYPTED PRIVATE KEY-----'
      var CERT_START = '-----BEGIN CERTIFICATE-----'
      var CERT_END = '-----END CERTIFICATE-----'

      /**
       * Creates a private key
       *
       * @static
       * @param {Number} [keyBitsize=2048] Size of the key, defaults to 2048bit
       * @param {Object} [options] object of cipher and password {cipher:'aes128',password:'xxx'}, defaults empty object
       * @param {String} [options.cipher] string of the cipher for the encryption - needed with password
       * @param {String} [options.password] string of the cipher password for the encryption needed with cipher
       * @param {Function} callback Callback function with an error object and {key}
       */
      function createPrivateKey (keyBitsize, options, callback) {
        if (!callback && !options && typeof keyBitsize === 'function') {
          callback = keyBitsize
          keyBitsize = undefined
          options = {}
        } else if (!callback && keyBitsize && typeof options === 'function') {
          callback = options
          options = {}
        }

        keyBitsize = Number(keyBitsize) || 2048

        var params = ['genrsa']
        var delTempPWFiles = []

        if (options && options.cipher && (Number(helper.ciphers.indexOf(options.cipher)) !== -1) && options.password) {
          helper.createPasswordFile({ cipher: options.cipher, password: options.password, passType: 'out' }, params, delTempPWFiles)
        }

        params.push(keyBitsize)

        openssl.exec(params, 'RSA PRIVATE KEY', function (sslErr, key) {
          function done (err) {
            if (err) {
              return callback(err)
            }
            callback(null, {
              key: key
            })
          }
          helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
            done(sslErr || fsErr)
          })
        })
      }

      /**
       * Creates a dhparam key
       *
       * @static
       * @param {Number} [keyBitsize=512] Size of the key, defaults to 512bit
       * @param {Function} callback Callback function with an error object and {dhparam}
       */
      function createDhparam (keyBitsize, callback) {
        if (!callback && typeof keyBitsize === 'function') {
          callback = keyBitsize
          keyBitsize = undefined
        }

        keyBitsize = Number(keyBitsize) || 512

        var params = ['dhparam',
          '-outform',
          'PEM',
          keyBitsize
        ]

        openssl.exec(params, 'DH PARAMETERS', function (error, dhparam) {
          if (error) {
            return callback(error)
          }
          return callback(null, {
            dhparam: dhparam
          })
        })
      }

      /**
       * Creates a ecparam key
       * @static
       * @param {String} [keyName=secp256k1] Name of the key, defaults to secp256k1
       * @param {String} [paramEnc=explicit] Encoding of the elliptic curve parameters, defaults to explicit
       * @param {Boolean} [noOut=false] This option inhibits the output of the encoded version of the parameters.
       * @param {Function} callback Callback function with an error object and {ecparam}
       */
      function createEcparam (keyName, paramEnc, noOut, callback) {
        if (!callback && typeof noOut === 'undefined' && !paramEnc && typeof keyName === 'function') {
          callback = keyName
          keyName = undefined
        } else if (!callback && typeof noOut === 'undefined' && keyName && typeof paramEnc === 'function') {
          callback = paramEnc
          paramEnc = undefined
        } else if (!callback && typeof noOut === 'function' && keyName && paramEnc) {
          callback = noOut
          noOut = undefined
        }

        keyName = keyName || 'secp256k1'
        paramEnc = paramEnc || 'explicit'
        noOut = noOut || false

        var params = ['ecparam',
          '-name',
          keyName,
          '-genkey',
          '-param_enc',
          paramEnc
        ]

        var searchString = 'EC PARAMETERS'
        if (noOut) {
          params.push('-noout')
          searchString = 'EC PRIVATE KEY'
        }

        openssl.exec(params, searchString, function (error, ecparam) {
          if (error) {
            return callback(error)
          }
          return callback(null, {
            ecparam: ecparam
          })
        })
      }

      /**
       * Creates a Certificate Signing Request
       * If client key is undefined, a new key is created automatically. The used key is included
       * in the callback return as clientKey
       * @static
       * @param {Object} [options] Optional options object
       * @param {String} [options.clientKey] Optional client key to use
       * @param {Number} [options.keyBitsize] If clientKey is undefined, bit size to use for generating a new key (defaults to 2048)
       * @param {String} [options.hash] Hash function to use (either md5 sha1 or sha256, defaults to sha256)
       * @param {String} [options.country] CSR country field
       * @param {String} [options.state] CSR state field
       * @param {String} [options.locality] CSR locality field
       * @param {String} [options.organization] CSR organization field
       * @param {String} [options.organizationUnit] CSR organizational unit field
       * @param {String} [options.commonName='localhost'] CSR common name field
       * @param {String} [options.emailAddress] CSR email address field
       * @param {String} [options.csrConfigFile] CSR config file
       * @param {Array}  [options.altNames] is a list of subjectAltNames in the subjectAltName field
       * @param {Function} callback Callback function with an error object and {csr, clientKey}
       */
      function createCSR (options, callback) {
        if (!callback && typeof options === 'function') {
          callback = options
          options = undefined
        }

        options = options || {}

- ¶

  http://stackoverflow.com/questions/14089872/why-does-node-js-accept-ip-addresses-in-certificates-only-for-san-not-for-cn

        if (options.commonName && (net.isIPv4(options.commonName) || net.isIPv6(options.commonName))) {
          if (!options.altNames) {
            options.altNames = [options.commonName]
          } else if (options.altNames.indexOf(options.commonName) === -1) {
            options.altNames = options.altNames.concat([options.commonName])
          }
        }

        if (!options.clientKey) {
          createPrivateKey(options.keyBitsize || 2048, function (error, keyData) {
            if (error) {
              return callback(error)
            }
            options.clientKey = keyData.key
            createCSR(options, callback)
          })
          return
        }

        var params = ['req',
          '-new',
          '-' + (options.hash || 'sha256')
        ]

        if (options.csrConfigFile) {
          params.push('-config')
          params.push(options.csrConfigFile)
        } else {
          params.push('-subj')
          params.push(generateCSRSubject(options))
        }

        params.push('-key')
        params.push('--TMPFILE--')

        var tmpfiles = [options.clientKey]
        var config = null

        if (options.altNames && Array.isArray(options.altNames) && options.altNames.length) {
          params.push('-extensions')
          params.push('v3_req')
          params.push('-config')
          params.push('--TMPFILE--')
          var altNamesRep = []
          for (var i = 0; i < options.altNames.length; i++) {
            altNamesRep.push((net.isIP(options.altNames[i]) ? 'IP' : 'DNS') + '.' + (i + 1) + ' = ' + options.altNames[i])
          }

          tmpfiles.push(config = [
            '[req]',
            'req_extensions = v3_req',
            'distinguished_name = req_distinguished_name',
            '[v3_req]',
            'subjectAltName = @alt_names',
            '[alt_names]',
            altNamesRep.join('\n'),
            '[req_distinguished_name]',
            'commonName = Common Name',
            'commonName_max = 64'
          ].join('\n'))
        } else if (options.config) {
          config = options.config
        }

        var delTempPWFiles = []
        if (options.clientKeyPassword) {
          helper.createPasswordFile({ cipher: '', password: options.clientKeyPassword, passType: 'in' }, params, delTempPWFiles)
        }

        openssl.exec(params, 'CERTIFICATE REQUEST', tmpfiles, function (sslErr, data) {
          function done (err) {
            if (err) {
              return callback(err)
            }
            callback(null, {
              csr: data,
              config: config,
              clientKey: options.clientKey
            })
          }
          helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
            done(sslErr || fsErr)
          })
        })
      }

      /**
       * Creates a certificate based on a CSR. If CSR is not defined, a new one
       * will be generated automatically. For CSR generation all the options values
       * can be used as with createCSR.
       * @static
       * @param {Object} [options] Optional options object
       * @param {String} [options.serviceCertificate] PEM encoded certificate
       * @param {String} [options.serviceKey] Private key for signing the certificate, if not defined a new one is generated
       * @param {String} [options.serviceKeyPassword] Password of the service key
       * @param {Boolean} [options.selfSigned] If set to true and serviceKey is not defined, use clientKey for signing
       * @param {String|Number} [options.serial] Set a serial max. 20 octets - only together with options.serviceCertificate
       * @param {String} [options.serialFile] Set the name of the serial file, without extension. - only together with options.serviceCertificate and never in tandem with options.serial
       * @param {String} [options.hash] Hash function to use (either md5 sha1 or sha256, defaults to sha256)
       * @param {String} [options.csr] CSR for the certificate, if not defined a new one is generated
       * @param {Number} [options.days] Certificate expire time in days
       * @param {String} [options.clientKeyPassword] Password of the client key
       * @param {String} [options.extFile] extension config file - without '-extensions v3_req'
       * @param {String} [options.config] extension config file - with '-extensions v3_req'
       * @param {String} [options.csrConfigFile] CSR config file - only used if no options.csr is provided
       * @param {Array}  [options.altNames] is a list of subjectAltNames in the subjectAltName field - only used if no options.csr is provided
       * @param {Function} callback Callback function with an error object and {certificate, csr, clientKey, serviceKey}
       */
      function createCertificate (options, callback) {
        if (!callback && typeof options === 'function') {
          callback = options
          options = undefined
        }

        options = options || {}

        if (!options.csr) {
          createCSR(options, function (error, keyData) {
            if (error) {
              return callback(error)
            }
            options.csr = keyData.csr
            options.config = keyData.config
            options.clientKey = keyData.clientKey
            createCertificate(options, callback)
          })
          return
        }

        if (!options.clientKey) {
          options.clientKey = ''
        }

        if (!options.serviceKey) {
          if (options.selfSigned) {
            options.serviceKey = options.clientKey
          } else {
            createPrivateKey(options.keyBitsize || 2048, function (error, keyData) {
              if (error) {
                return callback(error)
              }
              options.serviceKey = keyData.key
              createCertificate(options, callback)
            })
            return
          }
        }

        readCertificateInfo(options.csr, function (error2, data2) {
          if (error2) {
            return callback(error2)
          }

          var params = ['x509',
            '-req',
            '-' + (options.hash || 'sha256'),
            '-days',
            Number(options.days) || '365',
            '-in',
            '--TMPFILE--'
          ]
          var tmpfiles = [options.csr]
          var delTempPWFiles = []

          if (options.serviceCertificate) {
            params.push('-CA')
            params.push('--TMPFILE--')
            params.push('-CAkey')
            params.push('--TMPFILE--')
            if (options.serial) {
              params.push('-set_serial')
              if (helper.isNumber(options.serial)) {

- ¶

  set the serial to the max lenth of 20 octets () A certificate serial number is not decimal conforming. That is the bytes in a serial number do not necessarily map to a printable ASCII character. eg: 0x00 is a valid serial number and can not be represented in a human readable format (atleast one that can be directly mapped to the ACSII table).

                params.push('0x' + ('0000000000000000000000000000000000000000' + options.serial.toString(16)).slice(-40))
              } else {
                if (helper.isHex(options.serial)) {
                  if (options.serial.startsWith('0x')) {
                    options.serial = options.serial.substring(2, options.serial.length)
                  }
                  params.push('0x' + ('0000000000000000000000000000000000000000' + options.serial).slice(-40))
                } else {
                  params.push('0x' + ('0000000000000000000000000000000000000000' + helper.toHex(options.serial)).slice(-40))
                }
              }
            } else {
              params.push('-CAcreateserial')
              if (options.serialFile) {
                params.push('-CAserial')
                params.push(options.serialFile + '.srl')
              }
            }
            if (options.serviceKeyPassword) {
              helper.createPasswordFile({ cipher: '', password: options.serviceKeyPassword, passType: 'in' }, params, delTempPWFiles)
            }
            tmpfiles.push(options.serviceCertificate)
            tmpfiles.push(options.serviceKey)
          } else {
            params.push('-signkey')
            params.push('--TMPFILE--')
            if (options.serviceKeyPassword) {
              helper.createPasswordFile({ cipher: '', password: options.serviceKeyPassword, passType: 'in' }, params, delTempPWFiles)
            }
            tmpfiles.push(options.serviceKey)
          }

          if (options.config) {
            params.push('-extensions')
            params.push('v3_req')
            params.push('-extfile')
            params.push('--TMPFILE--')
            tmpfiles.push(options.config)
          } else if (options.extFile) {
            params.push('-extfile')
            params.push(options.extFile)
          } else {
            var altNamesRep = []
            if (data2 && data2.san) {
              for (var i = 0; i < data2.san.dns.length; i++) {
                altNamesRep.push('DNS' + '.' + (i + 1) + ' = ' + data2.san.dns[i])
              }
              for (var i2 = 0; i2 < data2.san.ip.length; i2++) {
                altNamesRep.push('IP' + '.' + (i2 + 1) + ' = ' + data2.san.ip[i2])
              }
              for (var i3 = 0; i3 < data2.san.email.length; i3++) {
                altNamesRep.push('email' + '.' + (i3 + 1) + ' = ' + data2.san.email[i3])
              }
              params.push('-extensions')
              params.push('v3_req')
              params.push('-extfile')
              params.push('--TMPFILE--')
              tmpfiles.push([
                '[v3_req]',
                'subjectAltName = @alt_names',
                '[alt_names]',
                altNamesRep.join('\n')
              ].join('\n'))
            }
          }

          if (options.clientKeyPassword) {
            helper.createPasswordFile({ cipher: '', password: options.clientKeyPassword, passType: 'in' }, params, delTempPWFiles)
          }

          openssl.exec(params, 'CERTIFICATE', tmpfiles, function (sslErr, data) {
            function done (err) {
              if (err) {
                return callback(err)
              }
              var response = {
                csr: options.csr,
                clientKey: options.clientKey,
                certificate: data,
                serviceKey: options.serviceKey
              }
              return callback(null, response)
            }

            helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
              done(sslErr || fsErr)
            })
          })
        })
      }

      /**
       * Exports a public key from a private key, CSR or certificate
       * @static
       * @param {String} certificate PEM encoded private key, CSR or certificate
       * @param {Function} callback Callback function with an error object and {publicKey}
       */
      function getPublicKey (certificate, callback) {
        if (!callback && typeof certificate === 'function') {
          callback = certificate
          certificate = undefined
        }

        certificate = (certificate || '').toString()

        var params

        if (certificate.match(/BEGIN(\sNEW)? CERTIFICATE REQUEST/)) {
          params = ['req',
            '-in',
            '--TMPFILE--',
            '-pubkey',
            '-noout'
          ]
        } else if (certificate.match(/BEGIN RSA PRIVATE KEY/) || certificate.match(/BEGIN PRIVATE KEY/)) {
          params = ['rsa',
            '-in',
            '--TMPFILE--',
            '-pubout'
          ]
        } else {
          params = ['x509',
            '-in',
            '--TMPFILE--',
            '-pubkey',
            '-noout'
          ]
        }

        openssl.exec(params, 'PUBLIC KEY', certificate, function (error, key) {
          if (error) {
            return callback(error)
          }
          return callback(null, {
            publicKey: key
          })
        })
      }

      /**
       * Reads subject data from a certificate or a CSR
       * @static
       * @param {String} certificate PEM encoded CSR or certificate
       * @param {Function} callback Callback function with an error object and {country, state, locality, organization, organizationUnit, commonName, emailAddress}
       */
      function readCertificateInfo (certificate, callback) {
        if (!callback && typeof certificate === 'function') {
          callback = certificate
          certificate = undefined
        }

        certificate = (certificate || '').toString()
        var isMatch = certificate.match(/BEGIN(\sNEW)? CERTIFICATE REQUEST/)
        var type = isMatch ? 'req' : 'x509'
        var params = [type,
          '-noout',
          '-nameopt',
          'RFC2253,sep_multiline,space_eq,-esc_msb,utf8',
          '-text',
          '-in',
          '--TMPFILE--'
        ]
        openssl.spawnWrapper(params, certificate, function (err, code, stdout, stderr) {
          if (err) {
            return callback(err)
          } else if (stderr) {
            return callback(stderr)
          }
          return fetchCertificateData(stdout, callback)
        })
      }

      /**
       * get the modulus from a certificate, a CSR or a private key
       * @static
       * @param {String} certificate PEM encoded, CSR PEM encoded, or private key
       * @param {String} [password] password for the certificate
       * @param {String} [hash] hash function to use (up to now `md5` supported) (default: none)
       * @param {Function} callback Callback function with an error object and {modulus}
       */
      function getModulus (certificate, password, hash, callback) {
        if (!callback && !hash && typeof password === 'function') {
          callback = password
          password = undefined
          hash = false
        } else if (!callback && hash && typeof hash === 'function') {
          callback = hash
          hash = false

- ¶

  password will be falsy if not provided

        }

- ¶

  adding hash function to params, is not supported by openssl. process piping would be the right way (… | openssl md5) No idea how this can be achieved in easy with the current build in methods of pem.

        if (hash && hash !== 'md5') {
          hash = false
        }

        certificate = (Buffer.isBuffer(certificate) && certificate.toString()) || certificate

        var type = ''
        if (certificate.match(/BEGIN(\sNEW)? CERTIFICATE REQUEST/)) {
          type = 'req'
        } else if (certificate.match(/BEGIN RSA PRIVATE KEY/) || certificate.match(/BEGIN PRIVATE KEY/)) {
          type = 'rsa'
        } else {
          type = 'x509'
        }
        var params = [
          type,
          '-noout',
          '-modulus',
          '-in',
          '--TMPFILE--'
        ]
        var delTempPWFiles = []
        if (password) {
          helper.createPasswordFile({ cipher: '', password: password, passType: 'in' }, params, delTempPWFiles)
        }

        openssl.spawnWrapper(params, certificate, function (sslErr, code, stdout, stderr) {
          function done (err) {
            if (err) {
              return callback(err)
            }
            var match = stdout.match(/Modulus=([0-9a-fA-F]+)$/m)
            if (match) {
              return callback(null, {
                modulus: hash ? require(hash)(match[1]) : match[1]
              })
            } else {
              return callback(new Error('No modulus'))
            }
          }
          helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
            done(sslErr || fsErr || stderr)
          })
        })
      }

      /**
       * get the size and prime of DH parameters
       * @static
       * @param {String} DH parameters PEM encoded
       * @param {Function} callback Callback function with an error object and {size, prime}
       */
      function getDhparamInfo (dh, callback) {
        dh = (Buffer.isBuffer(dh) && dh.toString()) || dh

        var params = [
          'dhparam',
          '-text',
          '-in',
          '--TMPFILE--'
        ]

        openssl.spawnWrapper(params, dh, function (err, code, stdout, stderr) {
          if (err) {
            return callback(err)
          } else if (stderr) {
            return callback(stderr)
          }

          var result = {}
          var match = stdout.match(/Parameters: \((\d+) bit\)/)

          if (match) {
            result.size = Number(match[1])
          }

          var prime = ''
          stdout.split('\n').forEach(function (line) {
            if (/\s+([0-9a-f][0-9a-f]:)+[0-9a-f]?[0-9a-f]?/g.test(line)) {
              prime += line.trim()
            }
          })

          if (prime) {
            result.prime = prime
          }

          if (!match && !prime) {
            return callback(new Error('No DH info found'))
          }

          return callback(null, result)
        })
      }

      /**
       * config the pem module
       * @static
       * @param {Object} options
       */
      function config (options) {
        Object.keys(options).forEach(function (k) {
          openssl.set(k, options[k])
        })
      }

      /**
       * Gets the fingerprint for a certificate
       * @static
       * @param {String} PEM encoded certificate
       * @param {String} [hash] hash function to use (either `md5`, `sha1` or `sha256`, defaults to `sha1`)
       * @param {Function} callback Callback function with an error object and {fingerprint}
       */
      function getFingerprint (certificate, hash, callback) {
        if (!callback && typeof hash === 'function') {
          callback = hash
          hash = undefined
        }

        hash = hash || 'sha1'

        var params = ['x509',
          '-in',
          '--TMPFILE--',
          '-fingerprint',
          '-noout',
          '-' + hash
        ]

        openssl.spawnWrapper(params, certificate, function (err, code, stdout, stderr) {
          if (err) {
            return callback(err)
          } else if (stderr) {
            return callback(stderr)
          }
          var match = stdout.match(/Fingerprint=([0-9a-fA-F:]+)$/m)
          if (match) {
            return callback(null, {
              fingerprint: match[1]
            })
          } else {
            return callback(new Error('No fingerprint'))
          }
        })
      }

      /**
       * Export private key and certificate to a PKCS12 keystore
       * @static
       * @param {String} PEM encoded private key
       * @param {String} PEM encoded certificate
       * @param {String} Password of the result PKCS12 file
       * @param {Object} [options] object of cipher and optional client key password {cipher:'aes128', clientKeyPassword: 'xxxx', certFiles: ['file1','file2']}
       * @param {Function} callback Callback function with an error object and {pkcs12}
       */
      function createPkcs12 (key, certificate, password, options, callback) {
        if (!callback && typeof options === 'function') {
          callback = options
          options = {}
        }

        var params = ['pkcs12', '-export']
        var delTempPWFiles = []

        if (options.cipher && options.clientKeyPassword) {

- ¶

  NOTICE: The password field is needed! self if it is empty. create password file for the import “-passin”

          helper.createPasswordFile({ cipher: options.cipher, password: options.clientKeyPassword, passType: 'in' }, params, delTempPWFiles)
        }

- ¶

  NOTICE: The password field is needed! self if it is empty. create password file for the password “-password”

        helper.createPasswordFile({ cipher: '', password: password, passType: 'word' }, params, delTempPWFiles)

        params.push('-in')
        params.push('--TMPFILE--')
        params.push('-inkey')
        params.push('--TMPFILE--')

        var tmpfiles = [certificate, key]

        if (options.certFiles) {
          tmpfiles.push(options.certFiles.join(''))

          params.push('-certfile')
          params.push('--TMPFILE--')
        }

        openssl.execBinary(params, tmpfiles, function (sslErr, pkcs12) {
          function done (err) {
            if (err) {
              return callback(err)
            }
            return callback(null, {
              pkcs12: pkcs12
            })
          }
          helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
            done(sslErr || fsErr)
          })
        })
      }

      /**
       * read sslcert data from Pkcs12 file. Results are provided in callback response in object notation ({cert: .., ca:..., key:...})
       * @static
       * @param  {Buffer|String}   bufferOrPath Buffer or path to file
       * @param  {Object}   [options]      openssl options
       * @param  {Function} callback     Called with error object and sslcert bundle object
       */
      function readPkcs12 (bufferOrPath, options, callback) {
        if (!callback && typeof options === 'function') {
          callback = options
          options = {}
        }

        options.p12Password = options.p12Password || ''

        var tmpfiles = []
        var delTempPWFiles = []
        var args = ['pkcs12', '-in', bufferOrPath]

        helper.createPasswordFile({ cipher: '', password: options.p12Password, passType: 'in' }, args, delTempPWFiles)

        if (Buffer.isBuffer(bufferOrPath)) {
          tmpfiles = [bufferOrPath]
          args[2] = '--TMPFILE--'
        }

        if (options.clientKeyPassword) {
          helper.createPasswordFile({ cipher: '', password: options.clientKeyPassword, passType: 'out' }, args, delTempPWFiles)
        } else {
          args.push('-nodes')
        }

        openssl.execBinary(args, tmpfiles, function (sslErr, stdout) {
          function done (err) {
            var keybundle = {}

            if (err && err.message.indexOf('No such file or directory') !== -1) {
              err.code = 'ENOENT'
            }

            if (!err) {
              var certs = readFromString(stdout, CERT_START, CERT_END)
              keybundle.cert = certs.shift()
              keybundle.ca = certs
              keybundle.key = readFromString(stdout, KEY_START, KEY_END).pop()

              if (keybundle.key) {

- ¶

  convert to RSA key

                return openssl.exec(['rsa', '-in', '--TMPFILE--'], 'RSA PRIVATE KEY', [keybundle.key], function (err, key) {
                  keybundle.key = key

                  return callback(err, keybundle)
                })
              }

              if (options.clientKeyPassword) {
                keybundle.key = readFromString(stdout, ENCRYPTED_KEY_START, ENCRYPTED_KEY_END).pop()
              } else {
                keybundle.key = readFromString(stdout, RSA_KEY_START, RSA_KEY_END).pop()
              }
            }

            return callback(err, keybundle)
          }
          helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
            done(sslErr || fsErr)
          })
        })
      }

      /**
       * Check a certificate
       * @static
       * @param {String} PEM encoded certificate
       * @param {String} [passphrase] password for the certificate
       * @param {Function} callback Callback function with an error object and a boolean valid
       */
      function checkCertificate (certificate, passphrase, callback) {
        var params
        var delTempPWFiles = []

        if (!callback && typeof passphrase === 'function') {
          callback = passphrase
          passphrase = undefined
        }
        certificate = (certificate || '').toString()

        if (certificate.match(/BEGIN(\sNEW)? CERTIFICATE REQUEST/)) {
          params = ['req', '-text', '-noout', '-verify', '-in', '--TMPFILE--']
        } else if (certificate.match(/BEGIN RSA PRIVATE KEY/) || certificate.match(/BEGIN PRIVATE KEY/)) {
          params = ['rsa', '-noout', '-check', '-in', '--TMPFILE--']
        } else {
          params = ['x509', '-text', '-noout', '-in', '--TMPFILE--']
        }
        if (passphrase) {
          helper.createPasswordFile({ cipher: '', password: passphrase, passType: 'in' }, params, delTempPWFiles)
        }

        openssl.spawnWrapper(params, certificate, function (sslErr, code, stdout, stderr) {
          function done (err) {
            if (err && err.toString().trim() !== 'verify OK') {
              return callback(err)
            }
            var result
            switch (params[0]) {
              case 'rsa':
                result = /^Rsa key ok$/i.test(stdout.trim())
                break
              default:
                result = /Signature Algorithm/im.test(stdout)
                break
            }

            callback(null, result)
          }
          helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
            done(sslErr || fsErr || stderr)
          })
        })
      }

      /**
       * check a PKCS#12 file (.pfx or.p12)
       * @static
       * @param {Buffer|String} bufferOrPath PKCS#12 certificate
       * @param {String} [passphrase] optional passphrase which will be used to open the keystore
       * @param {Function} callback Callback function with an error object and a boolean valid
       */
      function checkPkcs12 (bufferOrPath, passphrase, callback) {
        if (!callback && typeof passphrase === 'function') {
          callback = passphrase
          passphrase = ''
        }

        var tmpfiles = []
        var delTempPWFiles = []
        var args = ['pkcs12', '-info', '-in', bufferOrPath, '-noout', '-maciter', '-nodes']

        helper.createPasswordFile({ cipher: '', password: passphrase, passType: 'in' }, args, delTempPWFiles)

        if (Buffer.isBuffer(bufferOrPath)) {
          tmpfiles = [bufferOrPath]
          args[3] = '--TMPFILE--'
        }

        openssl.spawnWrapper(args, tmpfiles, function (sslErr, code, stdout, stderr) {
          function done (err) {
            if (err) {
              return callback(err)
            }
            callback(null, (/MAC verified OK/im.test(stderr) || (!(/MAC verified OK/im.test(stderr)) && !(/Mac verify error/im.test(stderr)))))
          }
          helper.deleteTempFiles(delTempPWFiles, function (fsErr) {
            done(sslErr || fsErr)
          })
        })
      }

      /**
       * Verifies the signing chain of the passed certificate
       * @static
       * @param {String|Array} PEM encoded certificate include intermediate certificates
       * @param {String|Array} [List] of CA certificates
       * @param {Function} callback Callback function with an error object and a boolean valid
       */
      function verifySigningChain (certificate, ca, callback) {
        if (!callback && typeof ca === 'function') {
          callback = ca
          ca = undefined
        }
        if (!Array.isArray(certificate)) {
          certificate = [certificate]
        }
        if (!Array.isArray(ca) && ca !== undefined) {
          if (ca !== '') {
            ca = [ca]
          }
        }

        var files = []

        if (ca !== undefined) {

- ¶

  ca certificates

          files.push(ca.join('\n'))
        }

- ¶

  certificate incl. intermediate certificates

        files.push(certificate.join('\n'))

        var params = ['verify']

        if (ca !== undefined) {

- ¶

  ca certificates

          params.push('-CAfile')
          params.push('--TMPFILE--')
        }

- ¶

  certificate incl. intermediate certificates

        params.push('--TMPFILE--')

        openssl.spawnWrapper(params, files, function (err, code, stdout, stderr) {
          if (err) {
            return callback(err)
          }

          callback(null, stdout.trim().slice(-4) === ': OK')
        })
      }

- ¶

  HELPER FUNCTIONS

      function fetchCertificateData (certData, callback) {

- ¶

  try catch : if something will fail in parsing it won’t crash the calling code

        try {
          certData = (certData || '').toString()

          var serial, subject, tmp, issuer
          var certValues = {
            issuer: {}
          }
          var validity = {}
          var san

          var ky, i

- ¶

  serial

          if ((serial = certData.match(/\s*Serial Number:\r?\n?\s*([^\r\n]*)\r?\n\s*\b/)) && serial.length > 1) {
            certValues.serial = serial[1]
          }

          if ((subject = certData.match(/\s*Subject:\r?\n(\s*(([a-zA-Z0-9.]+)\s=\s[^\r\n]+\r?\n))*\s*\b/)) && subject.length > 1) {
            subject = subject[0]
            tmp = matchAll(subject, /\s([a-zA-Z0-9.]+)\s=\s([^\r\n].*)/g)
            if (tmp) {
              for (i = 0; i < tmp.length; i++) {
                ky = tmp[i][1].trim()
                if (ky.match('(C|ST|L|O|OU|CN|emailAddress|DC)') || ky === '') {
                  continue
                }
                certValues[ky] = tmp[i][2].trim()
              }
            }

- ¶

  country

            tmp = subject.match(/\sC\s=\s([^\r\n].*?)[\r\n]/)
            certValues.country = (tmp && tmp[1]) || ''

- ¶

  state

            tmp = subject.match(/\sST\s=\s([^\r\n].*?)[\r\n]/)
            certValues.state = (tmp && tmp[1]) || ''

- ¶

  locality

            tmp = subject.match(/\sL\s=\s([^\r\n].*?)[\r\n]/)
            certValues.locality = (tmp && tmp[1]) || ''

- ¶

  organization

            tmp = matchAll(subject, /\sO\s=\s([^\r\n].*)/g)
            certValues.organization = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''

- ¶

  unit

            tmp = matchAll(subject, /\sOU\s=\s([^\r\n].*)/g)
            certValues.organizationUnit = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''

- ¶

  common name

            tmp = matchAll(subject, /\sCN\s=\s([^\r\n].*)/g)
            certValues.commonName = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''

- ¶

  email

            tmp = matchAll(subject, /emailAddress\s=\s([^\r\n].*)/g)
            certValues.emailAddress = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''

- ¶

  DC name

            tmp = matchAll(subject, /\sDC\s=\s([^\r\n].*)/g)
            certValues.dc = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''
          }

          if ((issuer = certData.match(/\s*Issuer:\r?\n(\s*([a-zA-Z0-9.]+)\s=\s[^\r\n].*\r?\n)*\s*\b/)) && issuer.length > 1) {
            issuer = issuer[0]
            tmp = matchAll(issuer, /\s([a-zA-Z0-9.]+)\s=\s([^\r\n].*)/g)
            for (i = 0; i < tmp.length; i++) {
              ky = tmp[i][1].toString()
              if (ky.match('(C|ST|L|O|OU|CN|emailAddress|DC)')) {
                continue
              }
              certValues.issuer[ky] = tmp[i][2].toString()
            }

- ¶

  country

            tmp = issuer.match(/\sC\s=\s([^\r\n].*?)[\r\n]/)
            certValues.issuer.country = (tmp && tmp[1]) || ''

- ¶

  state

            tmp = issuer.match(/\sST\s=\s([^\r\n].*?)[\r\n]/)
            certValues.issuer.state = (tmp && tmp[1]) || ''

- ¶

  locality

            tmp = issuer.match(/\sL\s=\s([^\r\n].*?)[\r\n]/)
            certValues.issuer.locality = (tmp && tmp[1]) || ''

- ¶

  organization

            tmp = matchAll(issuer, /\sO\s=\s([^\r\n].*)/g)
            certValues.issuer.organization = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''

- ¶

  unit

            tmp = matchAll(issuer, /\sOU\s=\s([^\r\n].*)/g)
            certValues.issuer.organizationUnit = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var
                r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''

- ¶

  common name

            tmp = matchAll(issuer, /\sCN\s=\s([^\r\n].*)/g)
            certValues.issuer.commonName = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var
                r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''

- ¶

  DC name

            tmp = matchAll(issuer, /\sDC\s=\s([^\r\n].*)/g)
            certValues.issuer.dc = tmp ? (tmp.length > 1 ? tmp.sort(function (t, n) {
              var e = t[1].toUpperCase()
              var
                r = n[1].toUpperCase()
              return r > e ? -1 : e > r ? 1 : 0
            }).sort(function (t, n) {
              return t[1].length - n[1].length
            }).map(function (t) {
              return t[1]
            }) : tmp[0][1]) : ''
          }

- ¶

  SAN

          if ((san = certData.match(/X509v3 Subject Alternative Name: \r?\n([^\r\n]*)\r?\n/)) && san.length > 1) {
            san = san[1].trim() + '\n'
            certValues.san = {}

- ¶

  hostnames

            tmp = pregMatchAll('DNS:([^,\\r\\n].*?)[,\\r\\n\\s]', san)
            certValues.san.dns = tmp || ''

- ¶

  IP-Addresses IPv4 & IPv6

            tmp = pregMatchAll('IP Address:([^,\\r\\n].*?)[,\\r\\n\\s]', san)
            certValues.san.ip = tmp || ''

- ¶

  Email Addresses

            tmp = pregMatchAll('email:([^,\\r\\n].*?)[,\\r\\n\\s]', san)
            certValues.san.email = tmp || ''
          }

- ¶

  Validity

          if ((tmp = certData.match(/Not Before\s?:\s?([^\r\n]*)\r?\n/)) && tmp.length > 1) {
            validity.start = Date.parse((tmp && tmp[1]) || '')
          }

          if ((tmp = certData.match(/Not After\s?:\s?([^\r\n]*)\r?\n/)) && tmp.length > 1) {
            validity.end = Date.parse((tmp && tmp[1]) || '')
          }

          if (validity.start && validity.end) {
            certValues.validity = validity
          }

- ¶

  Validity end

- ¶

  Signature Algorithm

          if ((tmp = certData.match(/Signature Algorithm: ([^\r\n]*)\r?\n/)) && tmp.length > 1) {
            certValues.signatureAlgorithm = (tmp && tmp[1]) || ''
          }

- ¶

  Public Key

          if ((tmp = certData.match(/Public[ -]Key: ([^\r\n]*)\r?\n/)) && tmp.length > 1) {
            certValues.publicKeySize = ((tmp && tmp[1]) || '').replace(/[()]/g, '')
          }

- ¶

  Public Key Algorithm

          if ((tmp = certData.match(/Public Key Algorithm: ([^\r\n]*)\r?\n/)) && tmp.length > 1) {
            certValues.publicKeyAlgorithm = (tmp && tmp[1]) || ''
          }

          callback(null, certValues)
        } catch (err) {
          callback(err)
        }
      }

      function matchAll (str, regexp) {
        var matches = []
        str.replace(regexp, function () {
          var arr = ([]).slice.call(arguments, 0)
          var extras = arr.splice(-2)
          arr.index = extras[0]
          arr.input = extras[1]
          matches.push(arr)
        })
        return matches.length ? matches : null
      }

      function pregMatchAll (regex, haystack) {
        var globalRegex = new RegExp(regex, 'g')
        var globalMatch = haystack.match(globalRegex) || []
        var matchArray = []
        var nonGlobalRegex, nonGlobalMatch
        for (var i = 0; i < globalMatch.length; i++) {
          nonGlobalRegex = new RegExp(regex)
          nonGlobalMatch = globalMatch[i].match(nonGlobalRegex)
          matchArray.push(nonGlobalMatch[1])
        }
        return matchArray
      }

      function generateCSRSubject (options) {
        options = options || {}

        var csrData = {
          C: options.country || options.C,
          ST: options.state || options.ST,
          L: options.locality || options.L,
          O: options.organization || options.O,
          OU: options.organizationUnit || options.OU,
          CN: options.commonName || options.CN || 'localhost',
          DC: options.dc || options.DC || '',
          emailAddress: options.emailAddress
        }

        var csrBuilder = Object.keys(csrData).map(function (key) {
          if (csrData[key]) {
            if (typeof csrData[key] === 'object' && csrData[key].length >= 1) {
              var tmpStr = ''
              csrData[key].map(function (o) {
                tmpStr += '/' + key + '=' + o.replace(/[^\w .*\-,@']+/g, ' ').trim()
              })
              return tmpStr
            } else {
              return '/' + key + '=' + csrData[key].replace(/[^\w .*\-,@']+/g, ' ').trim()
            }
          }
        })

        return csrBuilder.join('')
      }

      function readFromString (string, start, end) {
        if (Buffer.isBuffer(string)) {
          string = string.toString('utf8')
        }

        var output = []

        if (!string) {
          return output
        }

        var offset = string.indexOf(start)

        while (offset !== -1) {
          string = string.substring(offset)

          var endOffset = string.indexOf(end)

          if (endOffset === -1) {
            break
          }

          endOffset += end.length

          output.push(string.substring(0, endOffset))
          offset = string.indexOf(start, endOffset)
        }

        return output
      }

- ¶

  promisify not tested yet

      /**
       * Verifies the signing chain of the passed certificate
       * @namespace
       * @name promisified
       * @property {function}  createPrivateKey               @see createPrivateKey
       * @property {function}  createDhparam       - The default number of players.
       * @property {function}  createEcparam         - The default level for the party.
       * @property {function}  createCSR      - The default treasure.
       * @property {function}  createCertificate - How much gold the party starts with.
       */
      module.exports.promisified = {
        createPrivateKey: promisify(createPrivateKey),
        createDhparam: promisify(createDhparam),
        createEcparam: promisify(createEcparam),
        createCSR: promisify(createCSR),
        createCertificate: promisify(createCertificate),
        readCertificateInfo: promisify(readCertificateInfo),
        getPublicKey: promisify(getPublicKey),
        getFingerprint: promisify(getFingerprint),
        getModulus: promisify(getModulus),
        getDhparamInfo: promisify(getDhparamInfo),
        createPkcs12: promisify(createPkcs12),
        readPkcs12: promisify(readPkcs12),
        verifySigningChain: promisify(verifySigningChain),
        checkCertificate: promisify(checkCertificate),
        checkPkcs12: promisify(checkPkcs12)
      }