tls: multiple PFX in createSecureContext

Add support for multiple PFX files in tls.createSecureContext. Also added support for object-style PFX pass. Fixes: #14756
nodejs · djphoenix · Aug 12, 2017 · Aug 23, 2017 · Aug 23, 2017 · Aug 23, 2017
commit 21e2413b2b661ac63e97f029b24fdc5c9a2793e7
diff --git a/doc/api/tls.md b/doc/api/tls.md
@@ -934,10 +934,14 @@ changes:
 -->
 
 * `options` {Object}
-  * `pfx` {string|Buffer} Optional PFX or PKCS12 encoded private key and
-    certificate chain. `pfx` is an alternative to providing `key` and `cert`
+  * `pfx` {Buffer|Buffer[]|Object[]} Optional PFX or PKCS12 encoded private key
+    and certificate chain. `pfx` is an alternative to providing `key` and `cert`
     individually. PFX is usually encrypted, if it is, `passphrase` will be used
-    to decrypt it.
+    to decrypt it. Multiple PFX can be provided either as an array of unencrypted
+    PFX buffers, or an array of objects in the form `{buffer: <buffer>[,
+    passphrase: <string>]}`. The object form can only occur in an array.
+    `object.passphrase` is optional. Encrypted PFX will be decrypted with
+    `object.passphrase` if provided, or `options.passphrase` if it is not.
   * `key` {string|string[]|Buffer|Buffer[]|Object[]} Optional private keys in
     PEM format. PEM allows the option of private keys being encrypted. Encrypted
     keys will be decrypted with `options.passphrase`.  Multiple keys using

diff --git a/lib/_tls_common.js b/lib/_tls_common.js
@@ -161,19 +161,34 @@ exports.createSecureContext = function createSecureContext(options, context) {
   }
 
   if (options.pfx) {
-    var pfx = options.pfx;
-
     if (!crypto)
       crypto = require('crypto');
-
-    pfx = crypto._toBuf(pfx);
-    if (passphrase)
-      passphrase = crypto._toBuf(passphrase);
-
-    if (passphrase) {
-      c.context.loadPKCS12(pfx, passphrase);
+    const Buffer = require('buffer').Buffer;
+
+    if (Array.isArray(options.pfx)) {
+      for (i = 0; i < options.pfx.length; i++) {
+        const pfx = options.pfx[i];
+        let buf;
+        if (pfx.buffer instanceof Buffer) {
+          buf = crypto._toBuf(pfx.buffer);
+        } else {
+          buf = crypto._toBuf(pfx);
+        }
+        const passphrase = pfx.passphrase || options.passphrase;
+        if (passphrase) {
+          c.context.loadPKCS12(buf, crypto._toBuf(passphrase));
+        } else {
+          c.context.loadPKCS12(buf);
+        }
+      }
     } else {
-      c.context.loadPKCS12(pfx);
+      const buf = crypto._toBuf(options.pfx);
+      const passphrase = options.passphrase;
+      if (passphrase) {
+        c.context.loadPKCS12(buf, crypto._toBuf(passphrase));
+      } else {
+        c.context.loadPKCS12(buf);
+      }
     }
   }
 

diff --git a/test/fixtures/keys/ec-pfx.pem b/test/fixtures/keys/ec-pfx.pem
diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
@@ -0,0 +1,50 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const tls = require('tls');
+const fs = require('fs');
+
+const options = {
+  pfx: [
+    {
+      buffer: fs.readFileSync(`${common.fixturesDir}/keys/agent1-pfx.pem`),
+      passphrase: 'sample'
+    },
+    fs.readFileSync(`${common.fixturesDir}/keys/ec-pfx.pem`)
+  ]
+};
+
+const ciphers = [];
+
+const server = tls.createServer(options, function(conn) {
+  conn.end('ok');
+}).listen(0, function() {
+  const ecdsa = tls.connect(this.address().port, {
+    ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384',
+    rejectUnauthorized: false
+  }, function() {
+    ciphers.push(ecdsa.getCipher());
+    const rsa = tls.connect(server.address().port, {
+      ciphers: 'ECDHE-RSA-AES256-GCM-SHA384',
+      rejectUnauthorized: false
+    }, function() {
+      ciphers.push(rsa.getCipher());
+      ecdsa.end();
+      rsa.end();
+      server.close();
+    });
+  });
+});
+
+process.on('exit', function() {
+  assert.deepStrictEqual(ciphers, [{
+    name: 'ECDHE-ECDSA-AES256-GCM-SHA384',
+    version: 'TLSv1/SSLv3'
+  }, {
+    name: 'ECDHE-RSA-AES256-GCM-SHA384',
+    version: 'TLSv1/SSLv3'
+  }]);
+});