zwave-js / zwave-js-ui / 40358806036

18%

Build Type

push

github

Committed by web-flow

Commit Message

fix(https): regenerate self-signed certs rejected by Node 24 (#4881)

## Problem

After upgrading to 11.25.0, containers with HTTPS enabled crash-loop at
startup:

```
Error: error:0A00018F:SSL routines::ee key too small
    at createServer (node:https:153:10)
    at startServer (file:///usr/src/app/server/app.js:194:26)
  code: 'ERR_SSL_EE_KEY_TOO_SMALL'
```

11.25.0 ships Node 24 (#4757). Node 24 uses OpenSSL security level 2 by
default, so it rejects RSA keys smaller than 2048 bits. Before v9.29.0
(4222d040) the self-signed cert in the store was generated with a
1024-bit key, and it is only regenerated when the files are missing.
Installs that enabled HTTPS before then still have that key.

Same 1024-bit pair passed to `https.createServer`:

| Image | Result |
|---|---|
| `node:22.20.0-alpine3.22` | OK |
| `node:24.22.0-alpine3.23` | `ERR_SSL_EE_KEY_TOO_SMALL` |

`createHttpsServer` throws and nothing catches it, so the process exits.

## Fix

Cert loading moved from `api/app.ts` to `api/lib/tlsCert.ts`
(`loadCertKey(storeDir, certFile?, keyFile?)`) so it can be tested. It
checks the loaded pair with `tls.createSecureContext({ cert, key })`,
the same check `https.createServer` does. That also catches other
rejections (key/cert mismatch, weak signature) without hardcoding a key
size.

| Case | Before | Now |
|---|---|---|
| Stored pair rejected by Node (no `SSL_CERTIFICATE`/`SSL_KEY`) | crash
| warning, old files moved to `cert.pem.bak` / `key.pem.bak`, new
2048-bit pair generated |
| Custom pair rejected by Node | crash | **startup stops** with an error
naming both files, the OpenSSL reason and how to fix it |
| Custom file missing, unreadable or empty | silently served a
self-signed cert | **startup stops** with an error naming the file |
| Only one of `SSL_CERTIFICATE` / `SSL_KEY` set | the other side was
read from the store | **startup stops**: set both or neither |
| No pair in store | generated | generated (unchanged) |

A custom pair never fa... (continued)

Coverage Stats

753 of 4617 branches covered (16.31%)

Branch coverage included in aggregate %.

42 of 45 new or added lines in 2 files covered. (93.33%)

1 existing line in 1 file now uncovered.

1298 of 7113 relevant lines covered (18.25%)

2.63 hits per line