Hapi SecureContext
A plugin to load custom CA certs into node's tls.secureContext.
Installing
npm install @defra/hapi-secure-context
Usage
The plugin will load custom certificates from environment variable. This is controlled via the plugin's options during registration.
Register the plugin
This should be done when creating the server.
import { secureContext } from '@defra/hapi-secure-context'
await server.register({
plugin: secureContext.plugin,
options: {}
})
By default, the plugin will attempt to load certificates from any environment variable starting with TRUSTSTORE_.
Options
The plugin suports the following options:
- keys
- prefix
Keys
Setting keys restricts the plugin to only load certificates from environment variables in the list.
The environment variables must contain a base64 encoded certificate.
await server.register({
plugin: secureContext.plugin,
options: { keys: ['CERT_1', 'CERT_2'] }
})
Prefix
Setting prefix overrides the default prefix.
await server.register({
plugin: secureContext.plugin,
options: { prefix: 'MY_CUSTOM_PREFIX_' }
})
In the above example it will attempt to load any environment variable that begins with MY_CUSTOM_PREFIX_.
Usage
After registering, any certificate will be added to the default secureContext. Libraries that use the default node tls.secureContext will pick up these certs automatically.
The plugin will decorate the server object with an instance of secureContext, e.g. server.secureContext.
If you want to load the custom certificates manually, the plugin also decorates the server object with a customCACerts field.
This contains an