Use modern algorithm when generating p12 file. Fixes: #4

[sarim]

I updated the code to use the new modern encoder made available in SSLMate/go-pkcs12#48
Previously symfony-cli was using old algorithm, newer nodejs does not support that. It was causing webpack encore (and vite too) to fail if symfony's pfx was used. Main issue: symfony/webpack-encore#1187

After this is merged and a new version is tagged I can open another PR in https://github.com/symfony-cli/symfony-cli to use new version and also update symfony doc to no longer need workaround NODE_OPTIONS=--openssl-legacy-provider

[fabpot]

@tucksaun Can you have a look at this PR? Should fix #4 I suppose

[tucksaun]

@fabpot LGTM (but can't test it at the moment)

[sarim]

@tucksaun Can you have a look at this PR? Should fix #4 I suppose

Yes It fixes #4. I forgot to add it to title.

@fabpot LGTM (but can't test it at the moment)

Thanks for taking a look. If it helps, here how I tested it.

In /home/gittu/symfony-cli's go.mod file I added replace github.com/symfony-cli/cert => /home/gittu/symfony-cli-cert so It uses my fork. Then I deleted ~/.symfony5/certs/default.p12 and run server:start with symfony-cli. I check with openssl command and try to use default.p12 with node. Here's the result of both system one and my one.

Output from system one (installed via apt).

↪ ...backend (master *) ➤ rm ~/.symfony5/certs/default.p12
rm: remove regular file '/home/gittu/.symfony5/certs/default.p12'? y
↪ ...backend (master *) ➤ symfony server:start

 [WARNING] The local web server is optimized for local development and MUST never be used in a production setup.
                                                                                                                                                                                                                                                                                                                                                      
 [OK] Web server listening
      The Web server is using PHP FPM 8.2.14
      https://127.0.0.1:8005
                                                                                                                                                                                                                                                                                                                                                      Stream the logs via symfony server:log
↪ ...backend (master *) ➤ openssl pkcs12 -info -in ~/.symfony5/certs/default.p12 -noout
Enter Import Password:
MAC: sha1, Iteration 1
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Error outputting keys and certificates
408712696C7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()
↪ ...backend (master *) ➤ yarn dev
yarn run v1.22.19
$ vite
error when starting dev server:
Error: unsupported
    at configSecureContext (node:internal/tls/secure-context:279:15)
    at Object.createSecureContext (node:_tls_common:117:3)
    at Server.setSecureContext (node:_tls_wrap:1354:27)
    at new Server (node:_tls_wrap:1218:8)
    at new Http2SecureServer (node:internal/http2/core:3144:5)
    at createSecureServer (node:internal/http2/core:3323:10)
    at resolveHttpServer (file:///home/gittu/backend/node_modules/.pnpm/[email protected]/node_modules/vite/dist/node/chunks/dep-R0I0XnyH.js:48574:16)
    at async _createServer (file:///home/gittu/backend/node_modules/.pnpm/[email protected]/node_modules/vite/dist/node/chunks/dep-R0I0XnyH.js:59984:11)
    at async CAC.<anonymous> (file:///home/gittu/backend/node_modules/.pnpm/[email protected]/node_modules/vite/dist/node/cli.js:764:24)
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

Output from my one.

↪ ...backend (master *) ➤ rm ~/.symfony5/certs/default.p12
rm: remove regular file '/home/gittu/.symfony5/certs/default.p12'? y
↪ ...backend (master *) ➤ ~/symfony-cli/symfony-cli server:start

 [WARNING] The local web server is optimized for local development and MUST never be used in a production setup.
                                                                                                                                                                                                                                                                                                                                                      
 [OK] Web server listening
      The Web server is using PHP FPM 8.2.14
      https://127.0.0.1:8005
                                                                                                                                                                                                                                                                                                                                                      Stream the logs via symfony-cli server:log
↪ ...backend (master *) ➤ openssl pkcs12 -info -in ~/.symfony5/certs/default.p12 -noout
Enter Import Password:
MAC: sha256, Iteration 2048
MAC length: 32, salt length: 16
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
Certificate bag
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
↪ ...backend (master *) ➤ yarn dev
yarn run v1.22.19
$ vite
Forced re-optimization of dependencies
Port 5173 is in use, trying another one...

  VITE v5.0.10  ready in 219 ms                                                                                                                                                                                                                                                                                                                         ➜  Local:   https://localhost:5174/build/
  ➜  Network: use --host to expose
  ➜  Vite ⚡️Symfony: vite-plugin-symfony: v6.3.2, pentatrion/vite-bundle: vv6.3.2
  ➜  press h + enter to show help

Check the openssl output of line "PKCS7 Encrypted data:". Also node server fails vs successfully starts https.

[fabpot]

I've released a new version of Symfony CLI, can you double-check that it works well for you?

[sarim]

@fabpot Yes, I just upgraded via apt. The new version is generating the modern p12 file :)

[fabpot]

Maybe we need some docs about how to upgrade an existing p12?

[sarim]

Yes, there's already a note at
https://github.com/symfony/symfony-docs/blob/50a296fc648774e3cab0c60331f664727424fcb7/frontend/encore/dev-server.rst?plain=1#L78-L85
Should I open a PR there informing users to upgrade to latest version of symfony-cli and delete old ~/.symfony5/certs/default.p12?

[fabpot]

Yes, there's already a note at https://github.com/symfony/symfony-docs/blob/50a296fc648774e3cab0c60331f664727424fcb7/frontend/encore/dev-server.rst?plain=1#L78-L85 Should I open a PR there informing users to upgrade to latest version of symfony-cli and delete old ~/.symfony5/certs/default.p12?

Let's update the recommendation to use the latest CLI version and remove the old p12 file. Can you submit a PR there? Thank you for your help on this topic.

[sarim]

Yes I opened a PR in docs repo. symfony/symfony-docs#19369