P12 PFX NodeJS Request

Question

I am trying to make a request with a p12 file or a pfx, but I can't get it to work. If I use PEM and KEY the code works fine. But Azure Keyvault does not support PEM and KEY. Is there an alternative that works with KEY/PEM certificates?

This is how I generated a p12/pfx file if that is the problem.

openssl pkcs12 -export -out certificate.pfx -inkey 1231181189.key -in 1231181189.pem -certfile CA.pem

Here is an example code, if I comment out cert and key the system does not work,

Error: read ECONNRESET

But if I comment out pfx and passphrase and use pem and key the connection work.

var request = require('request');
var fs = require('fs');
var path = require('path');
var certFile = __dirname + '/certs/1231181189.pem';
var keyFile = __dirname + '/certs/1231181189.key';

var options = {
  method: 'POST',
  url: 'https://mss.cpc.getswish.net/swish-cpcapi/api/v1/paymentrequests',
  headers: { 'Content-Type': 'application/json' },
  agentOptions: {
    cert: fs.readFileSync(certFile),
    key: fs.readFileSync(keyFile),
    pfx: fs.readFileSync(__dirname + '/certs/certificate.pfx'),
    passphrase: 'swish'
  },
  body: {
    payeePaymentReference: '0123456789',
    callbackUrl: 'https://example.com/api/swishcb/paymentrequests',
    payerAlias: '4671234768',
    payeeAlias: '1231181189',
    amount: '100',
    currency: 'SEK',
    message: 'Kingston USB Flash Drive 8 GB'
  },
  json: true
};

request(options, function (error, response, body) {
  if (error) throw new Error(error);

  console.log(response.headers);
  console.log(body);
});

Answer 1

ECONNRESET means the far end -- in your case the endpoint on swish.net -- unceremoniously disconnected from the https client in your nodejs program. It's hard to know precisely why it did so. It's likely due to some sort of security failure. Robust servers don't explain security failures; after all why help cybercreeps? It's possible looking at a log on that server will tell you more.

In the meantime, it's possible the npm request package you use to wrap node's https agent function doesn't know anything about .pfx files or passwords, and therefore attempts to connect without any client certificates.

The pemutils package may allow you to extract the information you need from your .pfx file and use it. Something like this may work (not debugged).

var request = require('request');
var pemutils = require('pemutils');
var fs = require('fs');
var path = require('path');
const pfxFile =  __dirname + '/certs/certificate.pfx';

pemutils.fromPfx({
    path: pfxFile,
    password: 'myPass'
}, function(err, pfxresults) {
    if(err) throw err;
    var options = {
      method: 'POST',
      url: 'https://mss.cpc.getswish.net/swish-cpcapi/api/v1/paymentrequests',
      headers: { 'Content-Type': 'application/json' },
      agentOptions: {
        cert: pfxresults.certificate,
        key:  pfxresults.key,
      },
      body: {
           ...
      },
      json: true
    };
    ...

Notice the .fromPfx method is asynchronous.