fix(iam): oidc provider retrieves leaf certificate instead of root certificate

packages/@aws-cdk/aws-iam/lib/oidc-provider/external.ts

@@ -1,5 +1,6 @@
 /* istanbul ignore file */
-
+import { DetailedPeerCertificate } from 'node:tls';
+import * as util from 'node:util';
 import * as tls from 'tls';
 import * as url from 'url';
 // eslint-disable-next-line import/no-extraneous-dependencies
@@ -20,26 +21,77 @@ function defaultLogger(fmt: string, ...args: any[]) {
 /**
  * Downloads the CA thumbprint from the issuer URL
  */
-async function downloadThumbprint(issuerUrl: string) {
-  external.log(`downloading certificate authority thumbprint for ${issuerUrl}`);
+export async function downloadThumbprint(issuerUrl: string) {
+
+  external.log(`Downloading certificate authority thumbprint for ${issuerUrl}`);
+
   return new Promise<string>((ok, ko) => {
     const purl = url.parse(issuerUrl);
     const port = purl.port ? parseInt(purl.port, 10) : 443;
+
     if (!purl.host) {
       return ko(new Error(`unable to determine host from issuer url ${issuerUrl}`));
     }
+
     const socket = tls.connect(port, purl.host, { rejectUnauthorized: false, servername: purl.host });
     socket.once('error', ko);
+
     socket.once('secureConnect', () => {
-      const cert = socket.getPeerCertificate();
+      // This set to `true` would return the entire chain of certificates as a circular reference object
+      let cert = socket.getPeerCertificate(true);
+
+      const unqiueCerts = new Set<DetailedPeerCertificate>();
+      do {
+        unqiueCerts.add(cert);
+        cert = cert.issuerCertificate;
+      } while ( cert && typeof cert === 'object' && !unqiueCerts.has(cert));
+
+      // The last `cert` obtained must be the root certificate in the certificate chain
+      const rootCert = [...unqiueCerts].pop()!;
+
+      // Add `ca: true` when node merges the feature. Awaiting resolution: https://github.com/nodejs/node/issues/44905
+      if (!(util.isDeepStrictEqual(rootCert.issuer, rootCert.subject))) {
+        return ko(new Error(`Subject and Issuer of certificate received are different. 
+        Received: \'Subject\' is ${JSON.stringify(rootCert.subject, null, 4)} and \'Issuer\':${JSON.stringify(rootCert.issuer, null, 4)}`));
+      }
+
+      const validTo = new Date(rootCert.valid_to);
+      const certificateValidity = getCertificateValidity(validTo);
+
+      if (certificateValidity < 0) {
+        return ko(new Error(`The certificate has already expired on: ${validTo.toUTCString()}`));
+      }
+
+      // Warning user if certificate validity is expiring within 6 months
+      if (certificateValidity < 180) {
+        /* eslint-disable-next-line no-console */
+        console.warn(`The root certificate obtained would expire in ${certificateValidity} days!`);
+      }
+
       socket.end();
-      const thumbprint = cert.fingerprint.split(':').join('');
-      external.log(`certificate authority thumbprint for ${issuerUrl} is ${thumbprint}`);
+
+      const thumbprint = rootCert.fingerprint.split(':').join('');
+      external.log(`Certificate Authority thumbprint for ${issuerUrl} is ${thumbprint}`);
+
       ok(thumbprint);
     });
   });
 }
 
+/**
+ * To get the validity timeline for the certificate
+ * @param certDate The valid to date for the certificate
+ * @returns The number of days the certificate is valid wrt current date
+ */
+function getCertificateValidity(certDate: Date): Number {
+  const millisecondsInDay = 24 * 60 * 60 * 1000;
+  const currentDate = new Date();
+
+  const validity = Math.round((certDate.getTime() - currentDate.getTime()) / millisecondsInDay);
+
+  return validity;
+}
+
 // allows unit test to replace with mocks
 /* eslint-disable max-len */
 export const external = {

packages/@aws-cdk/aws-iam/test/oidc-provider.test.ts

@@ -434,3 +434,8 @@ describe('OIDC issuer', () => {
 async function invokeHandler(event: Partial<AWSLambda.CloudFormationCustomResourceEvent>) {
   return handler.handler(event as any);
 }
+
+
+// Make sure root certificates are obtained
+// Make sure relevant errors are thrown when expected
+// Make sure validity is printed

packages/@aws-cdk/aws-iam/test/oidc-provider/external.test.ts

@@ -0,0 +1,172 @@
+import { TLSSocket, DetailedPeerCertificate, Certificate } from 'tls';
+import { downloadThumbprint } from '../../lib/oidc-provider/external';
+
+const chainLength = 3;
+let certificateCount = 0;
+let placeholderCertificate: DetailedPeerCertificate;
+let peerCertificate: DetailedPeerCertificate;
+
+describe('downloadThumbprint', () => {
+
+  const peerCertificateMock = jest.spyOn(TLSSocket.prototype, 'getPeerCertificate').mockImplementation(()=> {
+    return peerCertificate;
+  });
+
+  beforeEach(() => {
+    certificateCount = 0;
+    peerCertificate = createChainedCertificateObject();
+
+    // This is to create a circular reference in the root certificate
+    getRootCertificateFromChain().issuerCertificate = peerCertificate;
+
+    // To have silent test runs for this test
+    jest.spyOn(console, 'warn').mockImplementation(() => {});
+    jest.spyOn(console, 'log').mockImplementation(() => {});
+  });
+
+  test('is able to get root certificate from certificate chain', async () => {
+    // WHEN
+    await downloadThumbprint('https://example.com');
+
+    // THEN
+    expect(peerCertificateMock).toHaveBeenCalledTimes(2);
+  });
+
+  test('throws when subject and issuer are different of expected root certificate', async () => {
+    // GIVEN
+    const subject: Certificate = {
+      C: 'another-country-code-root',
+      ST: 'another-street-root',
+      L: 'another-locality-root',
+      O: 'another-organization-root',
+      OU: 'another-organizational-unit-root',
+      CN: 'another-common-name-root',
+    };
+
+    getRootCertificateFromChain().subject = subject;
+
+    // THEN
+    await expect(() => downloadThumbprint('https://example.com')).rejects.toThrowError(/Subject and Issuer of certificate received are different/);
+
+    expect(peerCertificateMock).toHaveBeenCalledTimes(2);
+  });
+
+  test('throws error when certificate receieved is expired', async () => {
+    // GIVEN
+    const currentDate = new Date();
+    const expiredValidityDate = subtractDaysFromDate(currentDate, 5);
+
+    getRootCertificateFromChain().valid_to = expiredValidityDate.toUTCString();
+
+    // THEN
+    await expect(() => downloadThumbprint('https://example.com')).rejects.toThrowError(/The certificate has already expired on/);
+
+    expect(peerCertificateMock).toHaveBeenCalledTimes(2);
+  });
+
+  afterEach(() => {
+    peerCertificateMock.mockClear();
+  });
+});
+
+function createChainedCertificateObject(): DetailedPeerCertificate {
+  return createCertificateObject();
+}
+
+function createCertificateObject(): DetailedPeerCertificate {
+  const currentDate = new Date();
+
+  if (certificateCount == chainLength ) {
+    // Root Certificate with circular reference to first certificate
+    return {
+      subject: {
+        C: 'country-code-root',
+        ST: 'street-root',
+        L: 'locality-root',
+        O: 'organization-root',
+        OU: 'organizational-unit-root',
+        CN: 'common-name-root',
+      },
+      issuer: {
+        C: 'country-code-root',
+        ST: 'street-root',
+        L: 'locality-root',
+        O: 'organization-root',
+        OU: 'organizational-unit-root',
+        CN: 'common-name-root',
+      },
+      subjectaltname: 'subjectal-name-root',
+      infoAccess: {
+        key: ['value-root'],
+      },
+      modulus: 'modulus-root',
+      exponent: 'exponent-root',
+      valid_from: currentDate.toUTCString(),
+      valid_to: addDaysToDate(currentDate, 200).toUTCString(),
+      fingerprint: '01:02:59:D9:C3:D2:0D:08:F7:82:4E:44:A4:B4:53:C5:E2:3A:87:00',
+      fingerprint256: '69:AE:1A:6A:D4:3D:C6:C1:1B:EA:C6:23:DE:BA:2A:14:62:62:93:5C:7A:EA:06:41:9B:0B:BC:87:CE:48:4E:00',
+      ext_key_usage: ['key-usage-root'],
+      serialNumber: 'serial-number-root',
+      raw: Buffer.alloc(10),
+      issuerCertificate: placeholderCertificate,
+    };
+  }
+
+  certificateCount++;
+
+  const certificate = {
+    subject: {
+      C: `subject-country-code-${certificateCount}`,
+      ST: `subject-street-${certificateCount}`,
+      L: `subject-locality-${certificateCount}`,
+      O: `subject-organization-${certificateCount}`,
+      OU: `subject-organizational-unit-${certificateCount}`,
+      CN: `subject-common-name-${certificateCount}`,
+    },
+    issuer: {
+      C: `issuer-country-code-${certificateCount}`,
+      ST: `issuer-street-${certificateCount}`,
+      L: `issuer-locality-${certificateCount}`,
+      O: `issuer-organization-${certificateCount}`,
+      OU: `issuer-organizational-unit-${certificateCount}`,
+      CN: `issuer-common-name-${certificateCount}`,
+    },
+    subjectaltname: `subjectal-name-${certificateCount}`,
+    infoAccess: {
+      key: [`value-${certificateCount}`],
+    },
+    modulus: `modulus-${certificateCount}`,
+    exponent: `exponent-${certificateCount}`,
+    valid_from: currentDate.toUTCString(),
+    valid_to: addDaysToDate(currentDate, 200).toUTCString(),
+    fingerprint: `01:02:59:D9:C3:D2:0D:08:F7:82:4E:44:A4:B4:53:C5:E2:3A:87:${certificateCount}D`,
+    fingerprint256: `69:AE:1A:6A:D4:3D:C6:C1:1B:EA:C6:23:DE:BA:2A:14:62:62:93:5C:7A:EA:06:41:9B:0B:BC:87:CE:48:4E:0${certificateCount}`,
+    ext_key_usage: [`key-usage-${certificateCount}`],
+    serialNumber: `serial-number-${certificateCount}`,
+    raw: Buffer.alloc(10),
+    issuerCertificate: createCertificateObject(),
+  };
+
+  return certificate;
+}
+
+function addDaysToDate(date: Date, numberOfDays: number): Date {
+  const newDate = new Date();
+  return new Date(newDate.setDate(date.getDate() + numberOfDays));
+}
+
+function subtractDaysFromDate(date: Date, numberOfDays: number): Date {
+  const newDate = new Date();
+  return new Date(newDate.setDate(date.getDate() - numberOfDays));
+}
+
+function getRootCertificateFromChain(): DetailedPeerCertificate {
+  let rootCert: DetailedPeerCertificate = peerCertificate;
+  let certificateNumber = 0;
+
+  while (chainLength > certificateNumber++) {
+    rootCert = rootCert.issuerCertificate;
+  }
+
+  return rootCert;
+}