CFSSL AUTHENTICATED SIGNER

Hi Vitor,

Currently the cfssl CA only uses the /sign endpoint.

This can be improved to also support the /authsign endpoint and enhance its overall security.

var crypto = require('crypto');
var fs = require("fs")

const auth_key_as_hex = "0123456789ABCDEF0123456789ABCDEF"
const key_usable_for_crypto_hmac = new Buffer.from(auth_key_as_hex,"hex")
const cfssl_csr_as_buffer = fs.readFileSync("./csr.json","utf-8")

var hash = crypto.createHmac('sha256', key_usable_for_crypto_hmac)
hash.update(cfssl_csr_as_buffer);

label = ecc
profile = client
certificate_request = {"certificate_request": cfssl_csr_as_buffer, "label": label, "profile": profile}

var cfssl_auth_request_format = {
    "token":hash.digest("base64"),
    "request":Buffer.from(certificate_request).toString("base64")
}
console.log(JSON.stringify(cfssl_auth_request_format,null,4))

........something like this should be able to work.

Start by locating the existing CFSSL /sign integration and reading the /authsign request requirements. The example shows HMAC-SHA256 token creation and a base64-encoded request; done means the signer supports the authenticated endpoint securely alongside /sign.