CertZipDL

src/tls.js

@@ -4,6 +4,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import config from './config.js';
+import { createZip } from './zip.js';
 
 /**
  * Certificates for an internal-only kiosk.
@@ -250,6 +251,80 @@ export function caCertificateDer() {
   return openssl(['x509', '-in', p.caCert, '-outform', 'der']);
 }
 
+/**
+ * Every form of the authority certificate in one archive, with instructions.
+ *
+ * Browsers increasingly refuse to download a bare .crt or .cer as a dangerous
+ * file type, which leaves no way to get the certificate onto a device. A zip is
+ * accepted, and carrying all the encodings means whichever tool is being fed —
+ * Jamf, Windows, Android — has the one it wants.
+ */
+export function caBundleZip() {
+  const p = paths();
+  if (!fs.existsSync(p.caCert)) return null;
+
+  const pem = fs.readFileSync(p.caCert);
+  const der = caCertificateDer();
+  const info = describe();
+
+  const readme = [
+    `${config.siteName} — certificate authority`,
+    '='.repeat(60),
+    '',
+    'Install ONE of these on each device. They are the same certificate in',
+    'different encodings; which one you need depends on the tool.',
+    '',
+    '  visitor-signin-ca.cer   binary DER. Jamf Pro, Apple Configurator, iOS, macOS.',
+    '  visitor-signin-ca.crt   PEM text. Windows, Android, Chromebook, Linux.',
+    '  visitor-signin-ca.pem   identical to the .crt, for tools expecting .pem.',
+    '',
+    'Fingerprint (SHA-256)',
+    `  ${info.ca?.fingerprint || 'unknown'}`,
+    '',
+    'Check this matches what the device shows before trusting it.',
+    '',
+    'Valid until',
+    `  ${info.ca?.validTo || 'unknown'}`,
+    '',
+    'The server certificate currently covers',
+    `  ${(info.server?.names || ['unknown']).join('\n  ')}`,
+    '',
+    'Installing',
+    '----------',
+    'Jamf Pro    Devices > Configuration Profiles > New > Certificate payload.',
+    '            Upload the .cer, scope to the kiosk devices, save. A root',
+    '            certificate delivered by MDM is trusted for TLS automatically.',
+    '',
+    'Windows     Double-click the .crt > Install Certificate > Local Machine >',
+    '            Place all certificates in the following store > Trusted Root',
+    '            Certification Authorities.',
+    '',
+    'Android     Settings > Security > Encryption & credentials > Install a',
+    '            certificate > CA certificate, then pick the .crt. Chrome on',
+    '            Android will not accept a certificate for a bare IP address,',
+    '            so reach the kiosk by hostname.',
+    '',
+    'Chromebook  Settings > Privacy and security > Security > Manage',
+    '            certificates > Authorities > Import, then pick the .crt.',
+    '',
+    'iOS by hand Open the .crt in Safari, allow the profile, install it under',
+    '            Settings > General > VPN & Device Management, THEN turn it on',
+    '            under Settings > General > About > Certificate Trust Settings.',
+    '            Both steps are needed when installing by hand.',
+    '',
+    'Renewing the server certificate does not change this authority, so devices',
+    'only need this done once.',
+    '',
+  ].join('\n');
+
+  return createZip([
+    { name: 'visitor-signin-ca.cer', data: der },
+    { name: 'visitor-signin-ca.crt', data: pem },
+    { name: 'visitor-signin-ca.pem', data: pem },
+    { name: 'README.txt', data: readme },
+  ]);
+}
+
 export function caCertificate() {
   const p = paths();
   return fs.existsSync(p.caCert) ? fs.readFileSync(p.caCert) : null;