Skip to content

Cert Downloading on Demand #1434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cowsed merged 2 commits into from
Jul 8, 2026
Merged

Cert Downloading on Demand #1434

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
79bb399
download cert at 4am and on request limited to once an hour
cowsed Jul 8, 2026
d448993
Merge pull request #1433 from rit-construct-makerspace/cowsed/cert_on…
cowsed Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 33 additions & 22 deletions server/src/server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,6 +249,32 @@ async function startServer() {
});
app.use("/api/files/", express.static(path.join(__dirname, '../../client/shlug-files/')));


let lastCertUpdateTime: Date | undefined = undefined
async function updateRootCert() {
try {
const url = process.env.READER_CERT_URL;
if (url == undefined || url == "") {
console.error("Can not update root cert. No download URL provided");
return
}
const response = await fetch(url);

if (!response.ok) {
console.error(`Could not download new root cert. HTTP error: ${response.status}`)
return;
}

const certString = await response.text();
// normalize \r\n to \n
setReaderCertCA(certString.replace(/\r/g, ""));
console.log("Successfully updated root cert. New cert ends in ", certString.substring(certString.length - 50, certString.length - 27))
lastCertUpdateTime = new Date()
} catch (error) {
console.error(`Failed to update root cert: ${error}`)
}
}

app.get("/api/rootCA", async function (req, res) {
const SNHeader = 'shlug-sn';
if (!req.headers[SNHeader]) {
Expand All @@ -264,6 +290,12 @@ async function startServer() {
return res.status(404).send();
}

// only update cert if its been an hour since the last time a shlug said its out of date
// prevent an easily ddos-able endpoint
if (lastCertUpdateTime == undefined || Math.abs(Date.now() - lastCertUpdateTime.getTime()) >= 1000 * 60 * 60) {
updateRootCert();
}

const certca = (await getReaderCertCA())?.value;
if (certca == null) {
return res.status(404).send();
Expand All @@ -273,7 +305,7 @@ async function startServer() {
const result = {
cert: certca,
sha: sha,
}
}
return res.json(result);
})

Expand Down Expand Up @@ -562,27 +594,6 @@ async function startServer() {
createUnassocaitedAuditLog(`Trainings: Sent ${numNotified} expiry notices, and purged ${numPurged} expired trainings.`, "server")

}
async function updateRootCert() {
try {
const url = process.env.READER_CERT_URL;
if (url == undefined || url == "") {
console.error("Can not update root cert. No download URL provided");
return
}
const response = await fetch(url);

if (!response.ok) {
console.error(`Could not download new root cert. HTTP error: ${response.status}`)
return;
}

const certString = await response.text();
// normalize \r\n to \n
setReaderCertCA(certString.replace(/\r/g,""));
} catch (error) {
console.error(`Failed to update root cert: ${error}`)
}
}
/**
Cron Format:
* * * * * *
Expand Down
Loading